X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/28e68f813bd7c48847c39a9e07d66ff5cf61662d..70d4cba7d4aef3063fb549a77b45951c339cc57c:/doc/admin/upgrading.html.textile.liquid diff --git a/doc/admin/upgrading.html.textile.liquid b/doc/admin/upgrading.html.textile.liquid index 070e58983a..cf5ef55c1f 100644 --- a/doc/admin/upgrading.html.textile.liquid +++ b/doc/admin/upgrading.html.textile.liquid @@ -1,7 +1,7 @@ --- layout: default navsection: installguide -title: "Upgrading Arvados and Release notes" +title: "Arvados upgrade notes" ... {% comment %} @@ -10,19 +10,13 @@ Copyright (C) The Arvados Authors. All rights reserved. SPDX-License-Identifier: CC-BY-SA-3.0 {% endcomment %} -What you need to know and do in order to upgrade your Arvados installation. +For Arvados administrators, this page will cover what you need to know and do in order to ensure a smooth upgrade of your Arvados installation. For general release notes covering features added and bugs fixed, see "Arvados releases":https://arvados.org/releases. -h2. General process - -# Consult upgrade notes below to see if any manual configuration updates are necessary. -# Wait for the cluster to be idle and stop Arvados services. -# Install new packages using @apt-get upgrade@ or @yum upgrade@. -# Package installation scripts will perform any necessary data migrations. -# Restart Arvados services. +Upgrade instructions can be found at "Maintenance and upgrading":{{site.baseurl}}/admin/maintenance-and-upgrading.html#upgrading. h2. Upgrade notes -Some versions introduce changes that require special attention when upgrading: e.g., there is a new service to install, or there is a change to the default configuration that you might need to override in order to preserve the old behavior. +Some versions introduce changes that require special attention when upgrading: e.g., there is a new service to install, or there is a change to the default configuration that you might need to override in order to preserve the old behavior. These notes are listed below, organized by release version. Scroll down to the version number you are upgrading to. {% comment %} Note to developers: Add new items at the top. Include the date, issue number, commit, and considerations/instructions for those about to upgrade. @@ -34,9 +28,147 @@ TODO: extract this information based on git commit messages and generate changel
+ proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; ++ +h3. Changes on the collection's @preserve_version@ attribute semantics + +The @preserve_version@ attribute on collections was originally designed to allow clients to persist a preexisting collection version. This forced clients to make 2 requests if the intention is to "make this set of changes in a new version that will be kept", so we have changed the semantics to do just that: When passing @preserve_version=true@ along with other collection updates, the current version is persisted and also the newly created one will be persisted on the next update. + +h3. System token requirements -"Upgrading from 2.0.0":#v2_0_0 +System services now log a warning at startup if any of the system tokens (@ManagementToken@, @SystemRootToken@, and @Collections.BlobSigningKey@) are less than 32 characters, or contain characters other than a-z, A-Z, and 0-9. After upgrading, run @arvados-server config-check@ and update your configuration file if needed to resolve any warnings. + +The @API.RailsSessionSecretToken@ configuration key has been removed. Delete this entry from your configuration file after upgrading. + +h3. Centos7 Python 3 dependency upgraded to python3 + +Now that Python 3 is part of the base repository in CentOS 7, the Python 3 dependency for Centos7 Arvados packages was changed from SCL rh-python36 to python3. + +h3. ForceLegacyAPI14 option removed + +The ForceLegacyAPI14 configuration option has been removed. In the unlikely event it is mentioned in your config file, remove it to avoid "deprecated/unknown config" warning logs. + +h2(#v2_1_0). v2.1.0 (2020-10-13) + +"previous: Upgrading to 2.0.0":#v2_0_0 + +h3. LoginCluster conflicts with other Login providers + +A satellite cluster that delegates its user login to a central user database must only have `Login.LoginCluster` set, or it will return an error. This is a change in behavior, previously it would return an error if another login provider was _not_ configured, even though the provider would never be used. + +h3. Minimum supported Python version is now 3.5 + +We no longer publish Python 2 based distribution packages for our Python components. There are equivalent packages based on Python 3, but their names are slightly different. If you were using the Python 2 based packages, you can install the Python 3 based package for a drop in replacement. On Debian and Ubuntu: + +
+ apt remove python-arvados-fuse && apt install python3-arvados-fuse + apt remove python-arvados-python-client && apt install python3-arvados-python-client + apt remove python-arvados-cwl-runner && apt install python3-arvados-cwl-runner + apt remove python-crunchstat-summary && apt install python3-crunchstat-summary + apt remove python-cwltest && apt install python3-cwltest ++ +On CentOS: + +
+ yum remove python-arvados-fuse && yum install python3-arvados-fuse + yum remove python-arvados-python-client && yum install python3-arvados-python-client + yum remove python-arvados-cwl-runner && yum install python3-arvados-cwl-runner + yum remove python-crunchstat-summary && yum install python3-crunchstat-summary + yum remove python-cwltest && yum install python3-cwltest ++ +h3. Minimum supported Ruby version is now 2.5 + +The minimum supported Ruby version is now 2.5. If you are running Arvados on Debian 9 or Ubuntu 16.04, you may need to switch to using RVM or upgrade your OS. See "Install Ruby and Bundler":../install/ruby.html for more information. + +h3. Removing libpam-arvados, replaced with libpam-arvados-go + +The Python-based PAM package has been replaced with a version written in Go. See "using PAM for authentication":{{site.baseurl}}/install/setup-login.html#pam for details. h3. Removing sso-provider @@ -44,15 +176,58 @@ The SSO (single sign-on) component is deprecated and will not be supported in fu After migrating your configuration, uninstall the @arvados-sso-provider@ package. +h3. S3 signatures + +Keepstore now uses "V4 signatures":https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html by default for S3 requests. If you are using Amazon S3, no action is needed; all regions support V4 signatures. If you are using a different S3-compatible service that does not support V4 signatures, add @V2Signature: true@ to your volume driver parameters to preserve the old behavior. See "configuring S3 object storage":{{site.baseurl}}/install/configure-s3-object-storage.html. + +h3. New permission system constraints + +Some constraints on the permission system have been added, in particular @role@ and @project@ group types now have distinct behavior. These constraints were already de-facto imposed by the Workbench UI, so on most installations the only effect of this migration will be to reassign @role@ groups to the system user and create a @can_manage@ permission link for the previous owner. + +# The @group_class@ field must be either @role@ or @project@. Invalid group_class are migrated to @role@. +# A @role@ cannot own things. Anything owned by a role is migrated to a @can_manage@ link and reassigned to the system user. +# Only @role@ and @user@ can have outgoing permission links. Permission links originating from projects are deleted by the migration. +# A @role@ is always owned by the system_user. When a group is created, it creates a @can_manage@ link for the object that would have been assigned to @owner_uuid@. Migration adds @can_manage@ links and reassigns roles to the system user. This also has the effect of requiring that all @role@ groups have unique names on the system. If there is a name collision during migration, roles will be renamed to ensure they are unique. +# A permission link can have the permission level (@name@) updated but not @head_uuid@, @tail_uuid@ or @link_class@. + +The @arvados-sync-groups@ tool has been updated to reflect these constraints, so it is important to use the version of @arvados-sync-groups@ that matches the API server version. + +Before upgrading, use the following commands to find out which groups and permissions in your database will be automatically modified or deleted during the upgrade. + +To determine which groups have invalid @group_class@ (these will be migrated to @role@ groups): + +
+arv group list --filters '[["group_class", "not in", ["project", "role"]]]' ++ +To list all @role@ groups, which will be reassigned to the system user (unless @owner_uuid@ is already the system user): + +
+arv group list --filters '[["group_class", "=", "role"]]' ++ +To list which @project@ groups have outgoing permission links (such links are now invalid and will be deleted by the migration): + +
+for uuid in $(arv link list --filters '[["link_class", "=", "permission"], ["tail_uuid", "like", "%-j7d0g-%"]]' | + jq -r .items[].tail_uuid | sort | uniq) ; do + arv group list --filters '[["group_class", "=", "project"], ["uuid", "=", "'$uuid'"]]' | jq .items +done ++ +h4. "Public favorites" moved to their own project + +As a side effect of new permission system constraints, "star" links (indicating shortcuts in Workbench) that were previously owned by "All users" (which is now a "role" and cannot own things) will be migrated to a new system project called "Public favorites" which is readable by the "Anonymous users" role. + h2(#v2_0_0). v2.0.0 (2020-02-07) -"Upgrading from 1.4":#v1_4_1 +"previous: Upgrading to 1.4.1":#v1_4_1 Arvados 2.0 is a major upgrade, with many changes. Please read these upgrade notes carefully before you begin. h3. Migrating to centralized config.yml -See "Migrating Configuration":config-migration.html for notes on migrating legacy per-component configuration files to the new centralized @/etc/arvados/config.yml@. +See "Migrating Configuration":https://doc.arvados.org/v2.1/admin/config-migration.html for notes on migrating legacy per-component configuration files to the new centralized @/etc/arvados/config.yml@. To ensure a smooth transition, the per-component config files continue to be read, and take precedence over the centralized configuration. Your cluster should continue to function after upgrade but before doing the full configuration migration. However, several services (keepstore, keep-web, keepproxy) require a minimal `/etc/arvados/config.yml` to start: @@ -72,11 +247,11 @@ You can no longer specify types of keep services to balance via the @KeepService You can no longer specify individual keep services to balance via the @config.KeepServiceList@ command line option or @KeepServiceList@ legacy config option. Instead, keep-balance will operate on all keepstore servers with @service_type:disk@ as reported by the @arv keep_service list@ command. If you are still using the legacy config, @KeepServiceList@ should be removed or keep-balance will produce an error. -Please see the "config migration guide":{{site.baseurl}}/admin/config-migration.html and "keep-balance install guide":{{site.baseurl}}/install/install-keep-balance.html for more details. +Please see the "config migration guide":https://doc.arvados.org/v2.1/admin/config-migration.html and "keep-balance install guide":{{site.baseurl}}/install/install-keep-balance.html for more details. h3. Arv-git-httpd configuration migration -(feature "#14712":https://dev.arvados.org/issues/14712 ) The arv-git-httpd package can now be configured using the centralized configuration file at @/etc/arvados/config.yml@. Configuration via individual command line arguments is no longer available. Please see "arv-git-httpd's config migration guide":{{site.baseurl}}/admin/config-migration.html#arv-git-httpd for more details. +(feature "#14712":https://dev.arvados.org/issues/14712 ) The arv-git-httpd package can now be configured using the centralized configuration file at @/etc/arvados/config.yml@. Configuration via individual command line arguments is no longer available. Please see "arv-git-httpd's config migration guide":https://doc.arvados.org/v2.1/admin/config-migration.html#arv-git-httpd for more details. h3. Keepstore and keep-web configuration migration @@ -84,11 +259,11 @@ keepstore and keep-web no longer support configuration via (previously deprecate keep-web now supports the legacy @keep-web.yml@ config format (used by Arvados 1.4) and the new cluster config file format. Please check "keep-web's install guide":{{site.baseurl}}/install/install-keep-web.html for more details. -keepstore now supports the legacy @keepstore.yml@ config format (used by Arvados 1.4) and the new cluster config file format. Please check the "keepstore config migration notes":{{site.baseurl}}/admin/config-migration.html#keepstore and "keepstore install guide":{{site.baseurl}}/install/install-keepstore.html for more details. +keepstore now supports the legacy @keepstore.yml@ config format (used by Arvados 1.4) and the new cluster config file format. Please check the "keepstore config migration notes":https://doc.arvados.org/v2.1/admin/config-migration.html#keepstore and "keepstore install guide":{{site.baseurl}}/install/install-keepstore.html for more details. h3. Keepproxy configuration migration -(feature "#14715":https://dev.arvados.org/issues/14715 ) Keepproxy can now be configured using the centralized config at @/etc/arvados/config.yml@. Configuration via individual command line arguments is no longer available and the @DisableGet@, @DisablePut@, and @PIDFile@ configuration options are no longer supported. If you are still using the legacy config and @DisableGet@ or @DisablePut@ are set to true or @PIDFile@ has a value, keepproxy will produce an error and fail to start. Please see "keepproxy's config migration guide":{{site.baseurl}}/admin/config-migration.html#keepproxy for more details. +(feature "#14715":https://dev.arvados.org/issues/14715 ) Keepproxy can now be configured using the centralized config at @/etc/arvados/config.yml@. Configuration via individual command line arguments is no longer available and the @DisableGet@, @DisablePut@, and @PIDFile@ configuration options are no longer supported. If you are still using the legacy config and @DisableGet@ or @DisablePut@ are set to true or @PIDFile@ has a value, keepproxy will produce an error and fail to start. Please see "keepproxy's config migration guide":https://doc.arvados.org/v2.1/admin/config-migration.html#keepproxy for more details. h3. Delete "keep_services" records @@ -136,11 +311,11 @@ Workbench 2 is now ready for regular use. Follow the instructions to "install w h3. New property vocabulary format for Workbench2 -(feature "#14151":https://dev.arvados.org/issues/14151) Workbench2 supports a new vocabulary format and it isn't compatible with the previous one, please read the "workbench2 vocabulary format admin page":{{site.baseurl}}/admin/workbench2-vocabulary.html for more information. +(feature "#14151":https://dev.arvados.org/issues/14151) Workbench2 supports a new vocabulary format and it isn't compatible with the previous one, please read the "metadata vocabulary format admin page":{{site.baseurl}}/admin/metadata-vocabulary.html for more information. h3. Cloud installations only: node manager replaced by arvados-dispatch-cloud -Node manager is deprecated and replaced by @arvados-dispatch-cloud@. No automated config migration is available. Follow the instructions to "install the cloud dispatcher":../install/install-dispatch-cloud.html +Node manager is deprecated and replaced by @arvados-dispatch-cloud@. No automated config migration is available. Follow the instructions to "install the cloud dispatcher":../install/crunch2-cloud/install-dispatch-cloud.html *Only one dispatch process should be running at a time.* If you are migrating a system that currently runs Node manager and @crunch-dispatch-slurm@, it is safest to remove the @crunch-dispatch-slurm@ service entirely before installing @arvados-dispatch-cloud@. @@ -174,7 +349,7 @@ The API server accepts both PUT and PATCH for updates, but they will be normaliz h2(#v1_4_1). v1.4.1 (2019-09-20) -"Upgrading from 1.4.0":#v1_4_0 +"previous: Upgrading to 1.4.0":#v1_4_0 h3. Centos7 Python 3 dependency upgraded to rh-python36 @@ -182,7 +357,7 @@ The Python 3 dependency for Centos7 Arvados packages was upgraded from rh-python h2(#v1_4_0). v1.4.0 (2019-06-05) -"Upgrading from 1.3.3":#v1_3_3 +"previous: Upgrading to 1.3.3":#v1_3_3 h3. Populating the new file_count and file_size_total columns on the collections table @@ -251,7 +426,7 @@ h3. Python packaging change As part of story "#9945":https://dev.arvados.org/issues/9945, the distribution packaging (deb/rpm) of our Python packages has changed. These packages now include a built-in virtualenv to reduce dependencies on system packages. We have also stopped packaging and publishing backports for all the Python dependencies of our packages, as they are no longer needed. -One practical consequence of this change is that the use of the Arvados Python SDK (aka "import arvados") will require a tweak if the SDK was installed from a distribution package. It now requires the loading of the virtualenv environment from our packages. The "Install documentation for the Arvados Python SDK":/sdk/python/sdk-python.html reflects this change. This does not affect the use of the command line tools (e.g. arv-get, etc.). +One practical consequence of this change is that the use of the Arvados Python SDK (aka "import arvados") will require a tweak if the SDK was installed from a distribution package. It now requires the loading of the virtualenv environment from our packages. The "Install documentation for the Arvados Python SDK":{{ site.baseurl }}/sdk/python/sdk-python.html reflects this change. This does not affect the use of the command line tools (e.g. arv-get, etc.). Python scripts that rely on the distribution Arvados Python SDK packages to import the Arvados SDK will need to be tweaked to load the correct Python environment. @@ -285,19 +460,19 @@ As part of story "#9945":https://dev.arvados.org/issues/9945, it was discovered h3. New configuration -Arvados is migrating to a centralized configuration file for all components. During the migration, legacy configuration files will continue to be loaded. See "Migrating Configuration":config-migration.html for details. +Arvados is migrating to a centralized configuration file for all components. During the migration, legacy configuration files will continue to be loaded. See "Migrating Configuration":https://doc.arvados.org/v2.1/admin/config-migration.html for details. h2(#v1_3_3). v1.3.3 (2019-05-14) -"Upgrading from 1.3.0":#v1_3_0 +"previous: Upgrading to 1.3.0":#v1_3_0 This release corrects a potential data loss issue, if you are running Arvados 1.3.0 or 1.3.1 we strongly recommended disabling @keep-balance@ until you can upgrade to 1.3.3 or 1.4.0. With keep-balance disabled, there is no chance of data loss. -We've put together a "wiki page":https://dev.arvados.org/projects/arvados/wiki/Recovering_lost_data which outlines how to recover blocks which have been put in the trash, but not yet deleted, as well as how to identify any collections which have missing blocks so that they can be regenerated. The keep-balance component has been enhanced to provide a list of missing blocks and affected collections and we've provided a "utility script":https://github.com/arvados/arvados/blob/master/tools/keep-xref/keep-xref.py which can be used to identify the workflows that generated those collections and who ran those workflows, so that they can be rerun. +We've put together a "wiki page":https://dev.arvados.org/projects/arvados/wiki/Recovering_lost_data which outlines how to recover blocks which have been put in the trash, but not yet deleted, as well as how to identify any collections which have missing blocks so that they can be regenerated. The keep-balance component has been enhanced to provide a list of missing blocks and affected collections and we've provided a "utility script":https://github.com/arvados/arvados/blob/main/tools/keep-xref/keep-xref.py which can be used to identify the workflows that generated those collections and who ran those workflows, so that they can be rerun. h2(#v1_3_0). v1.3.0 (2018-12-05) -"Upgrading from 1.2":#v1_2_0 +"previous: Upgrading to 1.2":#v1_2_0 This release includes several database migrations, which will be executed automatically as part of the API server upgrade. On large Arvados installations, these migrations will take a while. We've seen the upgrade take 30 minutes or more on installations with a lot of collections. @@ -311,7 +486,7 @@ There are no special upgrade notes for this release. h2(#v1_2_0). v1.2.0 (2018-09-05) -"Upgrading from 1.1.2 or 1.1.3":#v1_1_2 +"previous: Upgrading to 1.1.2 or 1.1.3":#v1_1_2 h3. Regenerate Postgres table statistics @@ -343,7 +518,7 @@ Verify your setup by confirming that API calls appear in the controller's logs ( h2(#v1_1_4). v1.1.4 (2018-04-10) -"Upgrading from 1.1.3":#v1_1_3 +"previous: Upgrading to 1.1.3":#v1_1_3 h3. arvados-cwl-runner regressions (2018-04-05) @@ -476,7 +651,7 @@ There are no special upgrade notes for this release. h2(#v1_1_2). v1.1.2 (2017-12-22) -"Upgrading from 1.1.0 or 1.1.1":#v1_1_0 +"previous: Upgrading to 1.1.0 or 1.1.1":#v1_1_0 h3. The minimum version for Postgres is now 9.4 (2017-12-08) @@ -530,7 +705,7 @@ As part of story "#11349":https://dev.arvados.org/issues/11349, commit "2c094e2" * To enable it, add to your configuration file:
[Manage] address = 127.0.0.1 - port = 8989(see example configuration files in source:services/nodemanager/doc or https://doc.arvados.org/install/install-nodemanager.html for more info) + port = 8989 * The server responds to @http://{address}:{port}/status.json@ with a summary of how many nodes are in each state (booting, busy, shutdown, etc.) h3. New websockets component (2017-03-23)