I am using unattended-upgrades across multiple servers. I would like package updates to be rolled out gradually, either randomly or to a subset of test/staging machines first. Is there a way to do that for APT on Ubuntu?
An obvious option is to set some machines to update on Monday and the others to update on Wednesday, but that only gives me only weekly updates...
The goal of course is to avoid a Crowdstrike-like situation on my Ubuntu machines.
edit: For example. An updated openssh-server comes out. One fifth of the machines updates that day, another fifth updates the next day, and the rest updates 3 days later.
To effectively manage and stagger automated upgrades across multiple groups of Ubuntu servers, scheduling upgrades on specific days for different server groups offers a structured and reliable method. This approach ensures that upgrades are rolled out in a controlled manner, reducing the risk of potential disruptions.
Here's an example Ansible playbook that illustrates how to set this up. It installs
unattended-upgrades
and configuressystemd timers
to manage upgrades on specific weekdays for three distinct groups of servers.Playbook
--- - hosts: all become: yes vars: unattended_upgrade_groups: - name: staging_batch1 schedule: "Mon *-*-* 02:00:00" # Updates on Monday - name: staging_batch2 schedule: "Wed *-*-* 02:00:00" # Updates on Wednesday - name: staging_batch3 schedule: "Fri *-*-* 02:00:00" # Updates on Friday tasks: - name: Install unattended-upgrades apt: name: unattended-upgrades state: present - name: Disable automatic updates to control manually copy: dest: /etc/apt/apt.conf.d/20auto-upgrades content: | APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Download-Upgradeable-Packages "0"; APT::Periodic::AutocleanInterval "7"; APT::Periodic::Unattended-Upgrade "0"; mode: '0644' - name: Setup systemd service and timer for each group loop: "{{ unattended_upgrade_groups }}" block: - name: Create systemd service for unattended-upgrades for {{ item.name }} copy: dest: "/etc/systemd/system/unattended-upgrades-{{ item.name }}.service" content: | [Unit] Description=Run unattended upgrades for {{ item.name }} [Service] Type=oneshot ExecStart=/usr/bin/unattended-upgrade mode: '0644' - name: Create systemd timer for {{ item.name }} copy: dest: "/etc/systemd/system/unattended-upgrades-{{ item.name }}.timer" content: | [Unit] Description=Timer for unattended upgrades on {{ item.schedule }} for {{ item.name }} [Timer] OnCalendar={{ item.schedule }} Persistent=true [Install] WantedBy=timers.target mode: '0644' - name: Enable the timer for {{ item.name }} systemd: name: "unattended-upgrades-{{ item.name }}.timer" enabled: yes - name: Start the timer for {{ item.name }} systemd: name: "unattended-upgrades-{{ item.name }}.timer" state: started
Using scheduling is not a good option IMO, it's both too slow (some machines will wait a week to upgrade) and too fast (significant part of machines will upgrade right away).
It seems that making APT mirrors at the cadence I want is the best solution, but thanks for the answer.
That's a great idea! Learned something new, thanks.