5

More specifically...

What I want to be able to do:

  1. Centralized package management.
  2. Keep systems updated without downloading entire repos (i.e. if a system doesn't have Libreoffice on it, I don't want to have to download any Libreoffice packages).
  3. Run automated testing of packages before deploying them, and
  4. Keep specific packages- which are mission critical- and their dependencies subject to more exhaustive testing (including automated components), which involve some human intervention to approve.

Really, keeping everything up to date isn't necessarily- the most important thing is automatically testing and keeping up to date with security patches in non-mission-critical packages (and putting mission-critical patches through more rigorous testing).

What I've looked into so far

I know about spacewalk and pulp, but for a number of reasons (shoddy documentation, the fact that it requires ugly hacks to avoid downloading entire large repositories unnecessarily regardless of what you have on a given system) I have ruled them out as options. We do use Puppet, but on its own that isn't the right tool for the job, here.

yum alone certainly has some of what I'd need, but (unless there's something I'm missing) it, too, (alone) doesn't really seem like the right tool for the job. At the moment, I'm also looking into foreman but I'm not sure whether that's the right place to look, either, and I know most of the functionality it provides really isn't about addressing this kind of issue.

Improve this question
2
  • I would have included a link for foreman but the number of links I can post is limited by my rep; sorry about the omission.
    – Parthian Shot
    Jun 30, 2014 at 19:25
  • At the moment, I'm working my way through this list of options.
    – Parthian Shot
    Jul 1, 2014 at 18:29

1 Answer 1

Reset to default
1

  1. use the 'exclude' functionality of yum to accomplish this. For something permanent, add the following line to your yum configuration (in /etc/yum.conf): 

    exclude=python3* php*

  2. If you want to stay current, and don't want to download entire repos, just apply security errata. Use the yum security plugin for this, and then running yum --security update and yum updateinfo list bugzillas will only download the updates and install them.

  3. for automation, there's hundreds of options. For automated enterprise workloads you're probably going to want to use something more robust like Chef or Puppet. The link in the comments looks like a good resource.

  4. Again, use the exclude option along with a list of sensitive packages to make sure they aren't being touched.

Improve this answer
4
  • The yum security plugin does nothing on CentOS. In researching for this question I did come across it a few times as a suggestion, but it also tended to come with that caveat (e.g.here ) Tested it myself and, unfortunately, it does do nothing. Frankly, I think it's a serious security issue that you can still install it on CentOS when it does nothing, but there you go.
    – Parthian Shot
    Jul 17, 2014 at 14:10
  • for automation, there's hundreds of options There are indeed. Chef or Puppet We already use Puppet (and it is a fantastic tool, all told). It just isn't meant for stuff like this.
    – Parthian Shot
    Jul 17, 2014 at 14:12
  • Last but not least... use the 'exclude' functionality of yum to accomplish this That's actually really helpful. I'll have to test it, of course, but if that allows me to leave the package + all its dependencies untouched, it wouldn't be all we'd need, but it'd make cobbling together a hack that does far easier.
    – Parthian Shot
    Jul 17, 2014 at 14:14
  • @ParthianShot, I use the security plugin to monitor through Icinga which updates fix known vulnerabilities and which are just bug-fixes
    – Bruno9779
    Apr 17, 2015 at 1:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .