[Freeipa-users] Postponing IPA 3 upgrade

[Christian Horn]

On Mon, Feb 11, 2013 at 02:26:06PM -0500, Rob Crittenden wrote:
> Christian Horn wrote:
> >On Mon, Feb 11, 2013 at 01:25:56PM -0500, Rob Crittenden wrote:
> >>Christian Horn wrote:
> >>>
> >>>If you have the old system only receiving z-stream updates, so i.e.
> >>>6.3.z for a RHEL6.3 then you will stay on ipa2.
> >>>
> >>>I just tested the upgrade of a populated ipa2/rhel6.3 to rhel6.4 .
> >>>Without a 'exclude=ipa*' in yum.conf the ipa is upgraded like all
> >>>other packages when the system gets a RHEL6.4 repo configured and
> >>>'yum update' is executed.
> >>>The release notes do not note any special upgrade procedure, also
> >>>for my testsetup the upgrade went without any issues.
> >>>
> >>>Thus all points at that upgrade path is ok, as for all other packages.
> >>
> >>I would add that I would be careful about only excluding the IPA
> >>packages. We rely on a lot of other subsystemsand mixing versions
> >>may not work as expected. In particular 389-ds-base, pki-core and
> >>krb5-*.
> >
> >Cant we then just tie the ipa packages to the older 389-ds-base etc.
> >package versions?
> >
> >Christian
> >
> 
> That's what we're looking into, to have, for example, specific
> Requires: 389-ds-base = x.y.z rather than >= x.y.z. This introduces
> other challenges too because we need to allow some amount of
> flexibility. We just need to find the right balance.

Ah, thanks for the background.

I think somewhere in the RHEL support docs we also have a place which
reads like 'all previously released errata should be applied'.
This also hints that this strict tieing is not done in other places, 
and using 'exclude' for RHEL packages should not be done often.
Seen it mostly to hold back kernel and glibc updates, to have them
applied at a convenient time with a reboot.

Christian