AW: [Extern] Re: Advice on binary installation

> -----Ursprüngliche Nachricht-----
> Von: Paul Förster <paul(dot)foerster(at)gmail(dot)com>
> Gesendet: Dienstag, 13. April 2021 15:02
> An: Zwettler Markus (OIZ) <Markus(dot)Zwettler(at)zuerich(dot)ch>
> Cc: pgsql-general(at)postgresql(dot)org
> Betreff: [Extern] Re: Advice on binary installation
>
> Hi Markus,
>
> On 13. Apr, 2021, at 14:43, Zwettler Markus (OIZ) <Markus(dot)Zwettler(at)zuerich(dot)ch>
> wrote:
> > We assume to get more than 100 Postgres clusters in the future.
> >
> > We will get a very heterogeneous binary installation basis if we install needed
> extensions (e.g. ip4r) or software (e.g. patroni) on a per project basis.
> >
> > There could be even more incompatibility problems otherwise if we install all
> global needed extensions or software with every project to get a homogenous
> binary installation.
> >
> > Software installation is done with yum using PGDG downstream channels.
> >
> > Any recommendations?
>
> I don't know how you plan to do it, but I can only say how we do it:
>
> - Compile from source including all extensions needed (make install-world).
> Create a binary only directory this way, i.e. compile source to
> /data/postgres/xx.x
> - Create a tar file of said directory.
> - Distribute that via Ansible untaring it on the destination servers.
> - Have a standard postgresql.conf ready which includes a
> shared_preload_libraries = 'pg_stat_statements'
> (or whatever you need) for use with initdb.
>
> This way, we make sure that all servers get the same new software directory as
> needed in a separate directory including all necessary extensions, which means we
> can then delete the old directory if it is not longer needed (i.e. after all databases
> have been upgraded). Also, this makes sure, everything is loaded properly.
>
> With individual and only some few cases, we then use "create extension", but only
> extensions which we deliver with the tar via Ansible. If there is doing to be a new
> extension (which we avaoid if we can), then we put it into the tar Archive and
> nowhere else. So it's on all servers, but only a few databases use it then.
>
> Hope this helps.
>
> Paul
>

Out IT Sec requires to do software patching at least every 3 months.

How to you do software patching with your method? Creating + deploy new tarballs every 3 month?

Thanks, Markus