Sign in

THE PATCH POLICY ARGUMENT WE HAVE EVERY SINGLE MONTH

maintenanceoperationspatching13 replies · 194 views · started
Reply
  1. Tess Lindqvist
    @binarysmith

    guys pls help genuine question for people running a small cloud footprint: do you enable unattended upgrades in production, or does everything go through a manual window?? 🤷 we patch quarterly today and Im not suree if thats responsible or reckless.

    part of me thikns unattended updates are the only way to keep up. another part remembers the time an updtae broke a database driver at 2am. where did u land on that trade-off, and what made you comfortable with it?? im about to throw this thing out the window lol

    facepalm

    2
  2. Soren T.
    @soren.tanaka

    who signs off when a patch causes an outage??

    2 5 helpful
  4. Tess Jensen
    @tjensen
    in reply to @binarysmith

    track compliance, not intentions lmao A simple report of last patch date and pending reboots per server shows which machines silenlty fell behind. worked for me anyway 🤷

    0 4 helpful
  5. Kenji
    @silicon_gremlin825

    rings work: a small canary group patched first (including at least one server per role), then a wider group a few days later, then the rest, problems surfcae on servers that matter less. good luck man!

    4 5 helpful
  6. Milan
    @pingsprite

    lol same thing happened to me separate security updates from everything else. unattended security-only updates are fairly low risk on Debian/Ubuntu (unattended-upgrades with only teh security origin enabled), while feature updates go through teh window. fingers crossed 🤞

    12 0 helpful
  7. Bo Walsh
    @bo_lucky

    been there man agree the window with app owners once and put it in writing, including what happens if a patch breaks something. It turns every monthly argument into following a process. good luck man!

    2 0 helpful
  9. Tariq Demir
    @cobalttrace

    hmmm reboots are the hard part :) tools like needrestart (Debian/Ubuntu) or needs-restarting -r (RHEL family) tell u whether a reboot is actually required, sooo you only reboot when needed. good luck man!

    0 2 helpful
  10. Yusuf Olsen
    @solid_trace

    btw i come back to this thread every week just for the drama, same issue here on my homelab box... following this thraed

    4 0 helpful
  11. Otto Garcia
    @proxy_sage228

    hmmmm not sure about that i'd push for immutable infrastructure instead: rebuild images with patches and replace servers rather than patching in place. idk maybe im wrong lol

    lol

    30 0 helpful
  12. Kenji
    @silicon_gremlin825

    this. so much this good luck man!

    5 0 helpful
  13. Kai
    @uplink_ranger

    wait is footprint even worth bothering with or should i just leave it ?

    2 0 helpful

Reply to this topic

Sign in or create an account to reply.