Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix creating keystore when upgrading #29121

Merged
merged 1 commit into from
Mar 17, 2018

Conversation

jasontedor
Copy link
Member

When upgrading via the RPM package, we can run into a problem where the keystore fails to be created. This arises because the %post script on RPM runs after the new package files are installed but before the removal of the old package files. This means that the contents of the lib folder can contain files from the old package and the new package and thus running the create keystore tool can encounter JAR hell issues and fail. To solve this, we move creating the keystore to the %posttrans script which runs after the old package files are removed. We only need to do this on the RPM package, so we add a switch in the shared post-install script.

Relates #28928

When upgrading via the RPM package, we can run into a problem where
the keystore fails to be created. This arises because the %post script
on RPM runs after the new package files are installed but before the
removal of the old package files. This means that the contents of the
lib folder can contain files from the old package and the new package
and thus running the create keystore tool can encounter JAR hell
issues and fail. To solve this, we move creating the keystore to the
%posttrans script which runs after the old package files are
removed. We only need to do this on the RPM package, so we add a
switch in the shared post-install script.
@jasontedor jasontedor added >non-issue review :Delivery/Packaging RPM and deb packaging, tar and zip archives, shell and batch scripts v7.0.0 v6.3.0 labels Mar 17, 2018
@jasontedor jasontedor requested a review from rjernst March 17, 2018 00:42
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-core-infra

@jasontedor
Copy link
Member Author

@rjernst There is another solution to this problem which is to move our libs from lib to lib-${version}. Let me know what you think of this approach versus the approach proposed here. Personally I prefer the approach presented here because I do not want to have to keep reasoning through executing Elasticsearch code when the system is in a weird state with both old and new package files present. I find it easier to reason about when we do this when the system is in a clear state. However, I am open to considering the alternative approach that I propose here, as well as other approaches.

@jasontedor
Copy link
Member Author

Prior to this change, installation would proceed like this:

oel-6:~$ sudo rpm -i elasticsearch-6.0.0.rpm 
warning: elasticsearch-6.0.0.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Creating elasticsearch group... OK
Creating elasticsearch user... OK
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using chkconfig
 sudo chkconfig --add elasticsearch
### You can start elasticsearch service by executing
 sudo service elasticsearch start
oel-6:~$ sudo rpm -U /elasticsearch/elasticsearch-7.0.0-alpha1-SNAPSHOT.rpm 
Exception in thread "main" java.lang.NoSuchMethodError: org.elasticsearch.cli.MultiCommand.<init>(Ljava/lang/String;Ljava/lang/Runnable;)V
	at org.elasticsearch.cli.LoggingAwareMultiCommand.<init>(LoggingAwareMultiCommand.java:36)
	at org.elasticsearch.common.settings.KeyStoreCli.<init>(KeyStoreCli.java:32)
	at org.elasticsearch.common.settings.KeyStoreCli.main(KeyStoreCli.java:41)
chown: cannot access `/etc/elasticsearch/elasticsearch.keystore': No such file or directory
chmod: cannot access `/etc/elasticsearch/elasticsearch.keystore': No such file or directory
md5sum: /etc/elasticsearch/elasticsearch.keystore: No such file or directory
warning: %post(elasticsearch-0:7.0.0_alpha1_SNAPSHOT-1.noarch) scriptlet failed, exit status 1

After this change:

oel-6:~$ sudo rpm -i elasticsearch-6.0.0.rpm 
warning: elasticsearch-6.0.0.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Creating elasticsearch group... OK
Creating elasticsearch user... OK
### NOT starting on installation, please execute the following statements to configure elasticsearch service to start automatically using chkconfig
 sudo chkconfig --add elasticsearch
### You can start elasticsearch service by executing
 sudo service elasticsearch start
oel-6:~$ sudo rpm -U /elasticsearch/elasticsearch-7.0.0-alpha1-SNAPSHOT.rpm 
Created elasticsearch keystore in /etc/elasticsearch

Copy link
Member

@rjernst rjernst left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I'm ok with this approach.

@jasontedor
Copy link
Member Author

run packaging tests

@jasontedor jasontedor merged commit b56afeb into elastic:master Mar 17, 2018
jasontedor added a commit that referenced this pull request Mar 17, 2018
When upgrading via the RPM package, we can run into a problem where
the keystore fails to be created. This arises because the %post script
on RPM runs after the new package files are installed but before the
removal of the old package files. This means that the contents of the
lib folder can contain files from the old package and the new package
and thus running the create keystore tool can encounter JAR hell
issues and fail. To solve this, we move creating the keystore to the
%posttrans script which runs after the old package files are
removed. We only need to do this on the RPM package, so we add a
switch in the shared post-install script.
@jasontedor jasontedor deleted the fix-keystore-upgrade branch March 17, 2018 11:50
jasontedor added a commit to jasontedor/elasticsearch that referenced this pull request Mar 20, 2018
* master: (476 commits)
  Fix compilation errors in ML integration tests
  Small code cleanups and refactorings in persistent tasks (elastic#29109)
  Update allocation awareness docs (elastic#29116)
  Configure error file for archive packages (elastic#29129)
  Configure heap dump path for archive packages (elastic#29130)
  Client: Add missing test
  getMinGenerationForSeqNo should acquire read lock (elastic#29126)
  Backport - Do not renew sync-id PR to 5.6 and 6.3
  Client: Wrap SSLHandshakeException in sync calls
  Fix creating keystore when upgrading (elastic#29121)
  Align thread pool info to thread pool configuration (elastic#29123)
  TEST: Adjust translog size assumption in new engine
  Docs: HighLevelRestClient#multiGet (elastic#29095)
  Client: Wrap synchronous exceptions (elastic#28919)
  REST: Clear Indices Cache API simplify param parsing (elastic#29111)
  Fix typo in ExceptionSerializationTests
  Remove BWC layer for rejected execution exception
  Fix EsAbortPolicy to conform to API (elastic#29075)
  [DOCS] Removed prerelease footnote from upgrade table.
  Docs: Support triple quotes (elastic#28915)
  ...
@mark-vieira mark-vieira added the Team:Delivery Meta label for Delivery team label Nov 11, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
:Delivery/Packaging RPM and deb packaging, tar and zip archives, shell and batch scripts >non-issue Team:Delivery Meta label for Delivery team v6.3.0 v7.0.0-beta1
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants