[chef] Re: apt_package_hold or preventing version critical packages from being upgraded

[Brad Knowles < >]

On Dec 21, 2012, at 9:01 AM, Holger Amann 
<
 >
 wrote:

> Ok, in theory, but in practice that sounds totally impossible to me. As an 
> example - you're setting up a naked OS, and after bootstrapping you're 
> about to install Postgres/Apache/someotherlargeservice which itself will 
> install hundred of libraries as dependencies. If there are updates for one 
> or more of those dependencies, how do you want to do it with chef instead 
> of doing the upgrade step manually? Am I missing some magic chef 
> functionality/cookbook which is able to do that?

What I have done at previous sites where I've managed things, I specified the 
specific version of the high level components I needed inside of versioned 
cookbooks, and then my environments were locked down to specific versions of 
each cookbook.  I didn't try to specify specific versions of all 
sub-components that might be installed as a result of a dependency of a 
higher level component.

That said, you find out about problems in this area the same way -- things 
break.  When they break, you could either tell apt not to try to upgrade a 
specific component, or you could explicitly configure the installation of 
that component through Chef -- and lock it down to a particular version.

Either way, the outcome is the same.  "It's turtles, all the way down".

--
Brad Knowles 
<
 >
LinkedIn Profile: <http://tinyurl.com/y8kpxu>