diff --git a/CHANGELOG.md b/CHANGELOG.md index da804364..08f62daf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -38,6 +38,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed +* **role:php**: The `php:update` tag now refreshes the apt cache before the upgrade on Debian-family hosts, so it reliably installs the latest packages (e.g. to roll out security updates) instead of running against a stale cache. RHEL-family hosts are unaffected, since dnf refreshes its metadata on its own. +* **role:monitoring_plugins**: The role now refreshes the apt cache before installing the monitoring-plugins package on Debian-family hosts, so it reliably installs the latest version (e.g. to roll out security updates) instead of running against a stale cache. RHEL-family hosts are unaffected, since dnf refreshes its metadata on its own. +* **role:mariadb_server**: The `mariadb_server:upgrade` tag now refreshes the apt cache before the upgrade on Debian-family hosts, so it reliably installs the latest packages (e.g. to roll out security updates) instead of running against a stale cache. RHEL-family hosts are unaffected, since dnf refreshes its metadata on its own. * **role:python_venv**: Install `python3-packaging` on EL10 (RHEL/Rocky/Alma 10). EL10 ships Python 3.12, which dropped the stdlib `distutils`, so Ansible's `pip` module needs the external `packaging` library to run. Without it, creating a venv (e.g. during `setup_basic`) failed. * **role:icingaweb2_module_vspheredb**: Download the module tarball from the canonical `archive/refs/tags/.tar.gz` URL instead of `archive/.tar.gz`, so the pinned release tag is fetched reliably. * **role:monitoring_plugins**: A source install now deploys the sudoers drop-in as `/etc/sudoers.d/linuxfabrik-monitoring-plugins`, the same file name the rpm/deb packages use. Both install methods remove the drop-in under the former name `/etc/sudoers.d/monitoring-plugins`, so sudo no longer warns about a duplicate `Cmnd_Alias` on hosts that got the drop-in twice (for example after switching the install method or after running the monitoring-plugins one-liner installer). diff --git a/roles/mariadb_server/tasks/main.yml b/roles/mariadb_server/tasks/main.yml index 096e5533..949d0285 100644 --- a/roles/mariadb_server/tasks/main.yml +++ b/roles/mariadb_server/tasks/main.yml @@ -42,6 +42,16 @@ - 'mariadb-server' state: 'absent' + # refresh the apt cache so the following `state: latest` upgrade resolves + # against current metadata, e.g. to roll out security updates. apt does not + # auto-expire its cache the way dnf does, so without this the upgrade can + # silently run against a stale cache and miss newer versions. + - name: 'apt update # update the cache' + ansible.builtin.apt: + update_cache: true + changed_when: false # refreshing the package cache is not a config change + when: 'ansible_facts["os_family"] == "Debian"' + - name: 'Install latest mariadb-server' # noqa package-latest (latest is necessary for upgrade) ansible.builtin.package: name: diff --git a/roles/monitoring_plugins/tasks/linux-package.yml b/roles/monitoring_plugins/tasks/linux-package.yml index f069fe3a..652d7a66 100644 --- a/roles/monitoring_plugins/tasks/linux-package.yml +++ b/roles/monitoring_plugins/tasks/linux-package.yml @@ -21,6 +21,16 @@ - block: + # refresh the apt cache so the following `state: latest` upgrade resolves + # against current metadata, e.g. to roll out security updates. apt does not + # auto-expire its cache the way dnf does, so without this the upgrade can + # silently run against a stale cache and miss newer versions. + - name: 'apt update # update the cache' + ansible.builtin.apt: + update_cache: true + changed_when: false # refreshing the package cache is not a config change + when: 'ansible_facts["os_family"] == "Debian"' + - name: 'install linuxfabrik-monitoring-plugins{{ __monitoring_plugins__package_version_separator }}{{ monitoring_plugins__version }}*' # noqa package-latest ansible.builtin.package: name: diff --git a/roles/php/tasks/main.yml b/roles/php/tasks/main.yml index 8642121a..2e0d9e82 100644 --- a/roles/php/tasks/main.yml +++ b/roles/php/tasks/main.yml @@ -27,6 +27,16 @@ - block: + # refresh the apt cache so the following `state: latest` upgrade resolves + # against current metadata, e.g. to roll out security updates. apt does not + # auto-expire its cache the way dnf does, so without this the upgrade can + # silently run against a stale cache and miss newer versions. + - name: 'apt update # update the cache' + ansible.builtin.apt: + update_cache: true + changed_when: false # refreshing the package cache is not a config change + when: 'ansible_facts["os_family"] == "Debian"' + - name: 'Update php php-fpm composer' # noqa package-latest (we explicitly want latest here) ansible.builtin.package: name: @@ -88,6 +98,16 @@ ansible.builtin.debug: var: 'php__modules__combined_var' + # refresh the apt cache so the following `state: latest` upgrade resolves + # against current metadata, e.g. to roll out security updates. apt does not + # auto-expire its cache the way dnf does, so without this the upgrade can + # silently run against a stale cache and miss newer versions. + - name: 'apt update # update the cache' + ansible.builtin.apt: + update_cache: true + changed_when: false # refreshing the package cache is not a config change + when: 'ansible_facts["os_family"] == "Debian"' + - name: 'Update PHP modules' # noqa package-latest (we explicitly want latest here) # providing the packages as a list is much more faster than looping for each ansible.builtin.package: