19890: Note slow upgrade due to schema migration.

[arvados.git] / doc / admin / upgrading.html.textile.liquid

diff --git a/doc/admin/upgrading.html.textile.liquid b/doc/admin/upgrading.html.textile.liquid
index 1fe6745b94ca643ef8eaf0eeba2e59c90bdd6823..6197896747c84f9dadda9a627b6566d036ad47ef 100644 (file)
--- a/doc/admin/upgrading.html.textile.liquid
+++ b/doc/admin/upgrading.html.textile.liquid
@@ -28,10 +28,25 @@ TODO: extract this information based on git commit messages and generate changel
 <div class="releasenotes">
 </notextile>
 
+h2(#main). development main (as of 2023-01-16)
 
-h2(#main). development main (as of 2022-10-14)
+"previous: Upgrading to 2.5.0":#v2_5_0
 
-"previous: Upgrading to 2.4.3":#v2_4_3
+h3. Slow migration on upgrade
+
+This upgrade includes a database schema update (changing an integer column in each table from 32-bit to 64-bit) that may be slow on a large installation. Expect the arvados-api-server package upgrade to take longer than usual.
+
+h2(#v2_5_0). v2.5.0 (2022-12-22)
+
+"previous: Upgrading to 2.4.4":#v2_4_4
+
+h3. Google or OpenID Connect login restricted to trusted clients
+
+If you use OpenID Connect or Google login, and your cluster serves as the @LoginCluster@ in a federation _or_ your users log in from a web application other than the Workbench1 and Workbench2 @ExternalURL@ addresses in your configuration file, the additional web application URLs (e.g., the other clusters' Workbench addresses) must be listed explicitly in @Login.TrustedClients@, otherwise login will fail. Previously, login would succeed with a less-privileged token.
+
+h3. New keepstore S3 driver enabled by default
+
+A more actively maintained S3 client library is now enabled by default for keeepstore services. The previous driver is still available for use in case of unknown issues. To use the old driver, set @DriverParameters.UseAWSS3v2Driver@ to @false@ on the appropriate @Volumes@ config entries.
 
 h3. Old container logs are automatically deleted from PostgreSQL
 
@@ -51,21 +66,21 @@ Metrics previously reported by keep-web (@arvados_keepweb_collectioncache_reques
 
 The config entries @Collections.WebDAVCache.UUIDTTL@, @...MaxCollectionEntries@, and @...MaxUUIDEntries@ are no longer used, and should be removed from your config file.
 
+h2(#v2_4_4). v2.4.4 (2022-11-18)
+
+"previous: Upgrading to 2.4.3":#v2_4_3
+
+This update only consists of improvements to @arvados-cwl-runner@.  There are no changes to backend services.
+
 h2(#v2_4_3). v2.4.3 (2022-09-21)
 
 "previous: Upgrading to 2.4.2":#v2_4_2
 
 h3. Fixed PAM authentication security vulnerability
 
-In Arvados 2.4.2 and earlier, when using PAM authentication, if a user
-presented valid credentials but the account is disabled or otherwise
-not allowed to access the host, it would still be accepted for access
-to Arvados.  From 2.4.3 onwards, Arvados now also checks that the
-account is permitted to access the host before completing the PAM login
-process.
+In Arvados 2.4.2 and earlier, when using PAM authentication, if a user presented valid credentials but the account is disabled or otherwise not allowed to access the host, it would still be accepted for access to Arvados.  From 2.4.3 onwards, Arvados now also checks that the account is permitted to access the host before completing the PAM login process.
 
-Other authentication methods (LDAP, OpenID Connect) are not affected
-by this flaw.
+Other authentication methods (LDAP, OpenID Connect) are not affected by this flaw.
 
 h2(#v2_4_2). v2.4.2 (2022-08-09)