Subject: Ubuntu Unattended Upgrades

From: Don Seiler <[email-masked]>
Date: Wed, 18 Nov 2020 10:22:58 -0600

Good morning,

Background: Running PG10 on Ubuntu Bionic (18.04).

Last night I noticed one of our prod databases was restarted. Digging
deeper it was Ubuntu's unattended-upgrade utility (which we just started
using this month) that upgraded it from the PGDG 10.14 package to the
Ubuntu 10.15 package.

We had assumed since unattended-upgrade doesn't include PGDG that it
wouldnt upgrade the existing packages, but apparently that doesn't prevent
it from "upgrading" them to the Ubuntu equivalent, which then also restarts
the databases. It seems this is only a problem with postgresql-10 on Ubuntu
Bionic since Bionic provides its own postgresql-10 packages.

I'm guessing we should blacklist all postgresql packages in the
unattended-upgrades config. I'm wondering if this has been already tackled
by anyone else and if there is a more clever solution other than NOT
running unattended-upgrades.

Alternatively, is it possible to install the new packages but *NOT* restart
the DB automatically? I understand that a DB restart would be required to
run on the new version but curious if we could have the packages installed
prior and then restart at the next available window (although installation
doesn't really take that long, just curious).

-- 
Don Seiler
www.seiler.us

---

From: Christoph Berg <[email-masked]>
Date: Wed, 18 Nov 2020 22:12:06 +0100

Re: Don Seiler
> Bionic since Bionic provides its own postgresql-10 packages.

Hmm, I wasn't aware that Ubuntu's (?) default unattended-upgrades
config makes it upgrade Ubuntu packages only.

> the DB automatically? I understand that a DB restart would be required to

You can install a /usr/sbin/policy-rc.d file [1]. That will allow
filtering the start/stop actions issued by package activity.

[1] https://people.debian.org/~hmh/invokerc.d-policyrc.d-specification.txt

> doesn't really take that long, just curious).

Restarting after install is actually the default since a while ago.
(Previously packages were doing stop-upgrade-start.)

Christoph

---

From: Don Seiler <[email-masked]>
Date: Wed, 18 Nov 2020 15:21:03 -0600

> config makes it upgrade Ubuntu packages only.

By default it only upgrades from an approved list of sources. One could
include PGDG repos in that list if you desired.

> [1] https://people.debian.org/~hmh/invokerc.d-policyrc.d-specification.txt

I'll look into this, thanks!

> (Previously packages were doing stop-upgrade-start.)

Right but I mean restarting like later in the day or week. Not immediately
after the upgrade when we aren't ready for it.

Thanks for all the info!

Don.

-- 
Don Seiler
www.seiler.us