Skip to content

Commit bbbd178

Browse files
stevsmitSteven Smith
stevsmit
and
Steven Smith
authored
Fixes final few release notes issues (#1136) (#1138)
Co-authored-by: Steven Smith <[email protected]>
1 parent 83fb535 commit bbbd178

9 files changed

+227
-7
lines changed

‎clair/master.adoc

+1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ include::modules/fips-overview.adoc[leveloffset=+2]
3131
This guide contains procedures for running Clair on {productname} in both standalone and {ocp} Operator deployments.
3232

3333
include::modules/clair-standalone-configure.adoc[leveloffset=+1]
34+
include::modules/clair-postgresql-database-update.adoc[leveloffset=+2]
3435
include::modules/clair-standalone-upgrade.adoc[leveloffset=+2]
3536

3637
include::modules/clair-openshift.adoc[leveloffset=+1]

‎modules/about-clair.adoc

+10
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,16 @@ New versions of Clair are regularly released. The source code needed to build Cl
3030

3131
Release artifacts also include the `clairctl` command line interface tool, which obtains updater data from the internet by using an open host.
3232

33+
[discrete]
34+
[id="clair-releases-474"]
35+
=== Clair 4.8
36+
37+
Clair 4.8 was released on 24-10-28. The following changes have been made:
38+
39+
* Clair on {productname} now requires that you update the Clair PostgreSQL database from version 13 to version 15. For more information about this procedure, see link:https://docs.redhat.com/en/documentation/red_hat_quay/3.12/html-single/vulnerability_reporting_with_clair_on_red_hat_quay/index#upgrading-clair-postgresql-database[Upgrading the Clair PostgreSQL database].
40+
41+
* This release deprecates the updaters that rely on the Red Hat OVAL v2 security data in favor of the Red Hat VEX data. This change includes a database migration to delete all the vulnerabilities that originated from the OVAL v2 feeds. Because of this, there could be intermittent downtime in production environments before the VEX updater complete for the first time when no vulnerabilities exist.
42+
3343
[discrete]
3444
[id="clair-releases-474"]
3545
=== Clair 4.7.4

‎modules/attributes.adoc

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,6 @@ ifeval::["{productname}" == "Red Hat Quay"]
4141
:clairproductminv: 4.8
4242
:builderimage: quay-builder-rhel8
4343
:builderqemuimage: quay-builder-qemu-rhcos
44-
:postgresimage: registry.redhat.io/rhel8/postgresql-13:1-109
44+
:postgresimage: registry.redhat.io/rhel8/postgresql-13
4545
:redisimage: registry.redhat.io/rhel8/redis-6:1-110
4646
endif::[]

‎modules/clair-postgresql-database-update.adoc

+99
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
[id="upgrading-clair-postgresql-database"]
2+
= Upgrading the Clair PostgreSQL database
3+
4+
If you are upgrading {productname} to version 13, you must migrate your Clair PostgreSQL database version from PostgreSQL version 13 -> version 15. This requires bringing down your Clair PostgreSQL 13 database and running a migration script to initiate the process.
5+
6+
Use the following procedure to upgrade your Clair PostgreSQL database from version 13 -> to version 15.
7+
8+
[IMPORTANT]
9+
====
10+
Clair security scans might become temporarily disrupted after the migration procedure has succeeded.
11+
====
12+
13+
.Procedure
14+
15+
. Stop the {productname} container by entering the following command:
16+
+
17+
[source,terminal]
18+
----
19+
$ sudo podman stop <quay_container_name>
20+
----
21+
22+
. Stop the Clair container by running the following command:
23+
+
24+
[source,terminal]
25+
----
26+
$ sudo podman stop <clair_container_id>
27+
----
28+
29+
. Run the following Podman process from SCLOrg's link:https://github.com/sclorg/postgresql-container/tree/master/13#data-migration[Data Migration] procedure, which allows for data migration from a remote PostgreSQL server:
30+
+
31+
[source,terminal]
32+
----
33+
$ sudo podman run -d --name <clair_migration_postgresql_database> <1>
34+
-e POSTGRESQL_MIGRATION_REMOTE_HOST=<container_ip_address> \ <2>
35+
-e POSTGRESQL_MIGRATION_ADMIN_PASSWORD=remoteAdminP@ssword \
36+
-v </host/data/directory:/var/lib/pgsql/data:Z> \ <3>
37+
[ OPTIONAL_CONFIGURATION_VARIABLES ]
38+
registry.redhat.io/rhel8/postgresql-15
39+
----
40+
+
41+
<1> Insert a name for your Clair PostgreSQL 15 migration database.
42+
<2> Your new Clair PostgreSQL 15 database container IP address. Can obtained by running the following command: `sudo podman inspect -f "{{.NetworkSettings.IPAddress}}" postgresql-quay`.
43+
<3> You must specify a different volume mount point than the one from your initial Clair PostgreSQL 13 deployment, and modify the access control lists for said directory. For example:
44+
+
45+
[source,terminal]
46+
----
47+
$ mkdir -p /host/data/clair-postgresql15-directory
48+
----
49+
+
50+
[source,terminal]
51+
----
52+
$ setfacl -m u:26:-wx /host/data/clair-postgresql15-directory
53+
----
54+
+
55+
This prevents data from being overwritten by the new container.
56+
57+
. Stop the Clair PostgreSQL 13 container:
58+
+
59+
[source,terminal]
60+
----
61+
$ sudo podman stop <clair_postgresql13_container_name>
62+
----
63+
64+
. After completing the PostgreSQL migration, run the Clair PostgreSQL 15 container, using the new data volume mount from Step 3, for example, `</host/data/clair-postgresql15-directory:/var/lib/postgresql/data>`:
65+
+
66+
[source,terminal]
67+
----
68+
$ sudo podman run -d --rm --name <postgresql15-clairv4> \
69+
-e POSTGRESQL_USER=<clair_username> \
70+
-e POSTGRESQL_PASSWORD=<clair_password> \
71+
-e POSTGRESQL_DATABASE=<clair_database_name> \
72+
-e POSTGRESQL_ADMIN_PASSWORD=<admin_password> \
73+
-p 5433:5432 \
74+
-v </host/data/clair-postgresql15-directory:/var/lib/postgresql/data:Z> \
75+
registry.redhat.io/rhel8/postgresql-15
76+
----
77+
78+
. Start the {productname} container by entering the following command:
79+
+
80+
[source,terminal]
81+
----
82+
$ sudo podman run -d --rm -p 80:8080 -p 443:8443 --name=quay \
83+
-v /home/<quay_user>/quay-poc/config:/conf/stack:Z \
84+
-v /home/<quay_user>/quay-poc/storage:/datastorage:Z \
85+
{productrepo}/{quayimage}:{productminv}
86+
----
87+
88+
. Start the Clair container by entering the following command:
89+
+
90+
[source,terminal]
91+
----
92+
$ sudo podman run -d --name clairv4 \
93+
-p 8081:8081 -p 8088:8088 \
94+
-e CLAIR_CONF=/clair/config.yaml \
95+
-e CLAIR_MODE=combo \
96+
registry.redhat.io/quay/clair-rhel8:{productminv}
97+
----
98+
99+
For more information, see link:https://github.com/sclorg/postgresql-container/tree/master/13#data-migration[Data Migration].

‎modules/clair-standalone-configure.adoc

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ $ sudo podman run -d --name postgresql-clairv4 \
3535
-e POSTGRESQL_ADMIN_PASSWORD=adminpass \
3636
-p 5433:5432 \
3737
-v /home/<user-name>/quay-poc/postgres-clairv4:/var/lib/pgsql/data:Z \
38-
registry.redhat.io/rhel8/postgresql-13:1-109
38+
registry.redhat.io/rhel8/postgresql-15
3939
----
4040

4141
. Install the PostgreSQL `uuid-ossp` module for your Clair deployment:

‎modules/operator-upgrade.adoc

+1-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ To update {productname} from one minor version to the next, for example, 3.12.z
6060

6161
. After the `clair-postgres-upgrade`, `quay-postgres-upgrade`, and `quay-app-upgrade` pods are marked as *Completed*, the remaining pods for your {productname} deployment spin up. This takes approximately ten minutes.
6262

63-
. Verify that the `quay-database` and `clair-postgres` pods now use the `postgresql-13` image.
63+
. Verify that the `quay-database` uses the `postgresql-13` image, and `clair-postgres` pods now uses the `postgresql-15` image.
6464

6565
. After the `quay-app` pod is marked as *Running*, you can reach your {productname} registry.
6666

‎modules/proc_upgrade_standalone.adoc

+106-3
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
[id="standalone-upgrade"]
33
= Standalone upgrade
44

5-
In general, {productname} supports upgrades from a prior (N-1) minor version only. For example, upgrading directly from {productname} 3.8 to the latest version of {producty} is not supported. Instead, users would have to upgrade as follows:
5+
In general, {productname} supports upgrades from a prior (N-1) minor version only. For example, upgrading directly from {productname} 3.8 to the latest version of {producty} is not supported. Instead, users would have to upgrade as follows:
66

77
. 3.8.z -> 3.9.z
88
. 3.9.z -> 3.10.z
99
. 3.10.z -> 3.11.z
1010
. 3.11.z -> 3.12.z
11-
. 3.12.z -> 3.13
11+
. 3.12.z -> 3.13.z
1212

1313
This is required to ensure that any necessary database migrations are done correctly and in the right order during the upgrade.
1414

@@ -28,7 +28,6 @@ This document describes the steps needed to perform each individual upgrade. Det
2828
* link:https://access.redhat.com/documentation/en-us/red_hat_quay/{producty}/html-single/upgrade_red_hat_quay/index#upgrade_to_3_13_z_from_3_10_z[Upgrade to 3.13.z from 3.10.z]
2929
3030
////
31-
3231
//3.12
3332
* link:https://access.redhat.com/documentation/en-us/red_hat_quay/{producty}/html-single/upgrade_red_hat_quay/index#upgrade_to_3_12_z_from_3_11_z[Upgrade to 3.12.z from 3.11.z]
3433
* link:https://access.redhat.com/documentation/en-us/red_hat_quay/{producty}/html-single/upgrade_red_hat_quay/index#upgrade_to_3_12_z_from_3_10_z[Upgrade to 3.12.z from 3.10.z]
@@ -74,11 +73,112 @@ The general procedure for a manual upgrade consists of the following steps:
7473
. Start Clair using the new version of the image.
7574
. Wait until Clair is ready to accept connections before starting the new version of Quay.
7675

76+
[id="accessing-images"]
7777
== Accessing images
7878

7979
{productname} image from version 3.4.0 and later are available from link:https://registry.redhat.io[registry.redhat.io] and
8080
link:https://registry.access.redhat.com[registry.access.redhat.com], with authentication set up as described in link:https://access.redhat.com/RegistryAuthentication[Red Hat Container Registry Authentication].
8181

82+
[id="upgrading-clair-postgresql-database"]
83+
== Upgrading the Clair PostgreSQL database
84+
85+
If you are upgrading {productname} to version 13, you must migrate your Clair PostgreSQL database version from PostgreSQL version 13 -> version 15. This requires bringing down your Clair PostgreSQL 13 database and running a migration script to initiate the process.
86+
87+
Use the following procedure to upgrade your Clair PostgreSQL database from version 13 -> to version 15.
88+
89+
[IMPORTANT]
90+
====
91+
Clair security scans might become temporarily disrupted after the migration procedure has succeeded.
92+
====
93+
94+
.Procedure
95+
96+
. Stop the {productname} container by entering the following command:
97+
+
98+
[source,terminal]
99+
----
100+
$ sudo podman stop <quay_container_name>
101+
----
102+
103+
. Stop the Clair container by running the following command:
104+
+
105+
[source,terminal]
106+
----
107+
$ sudo podman stop <clair_container_id>
108+
----
109+
110+
. Run the following Podman process from SCLOrg's link:https://github.com/sclorg/postgresql-container/tree/master/13#data-migration[Data Migration] procedure, which allows for data migration from a remote PostgreSQL server:
111+
+
112+
[source,terminal]
113+
----
114+
$ sudo podman run -d --name <clair_migration_postgresql_database> <1>
115+
-e POSTGRESQL_MIGRATION_REMOTE_HOST=<container_ip_address> \ <2>
116+
-e POSTGRESQL_MIGRATION_ADMIN_PASSWORD=remoteAdminP@ssword \
117+
-v </host/data/directory:/var/lib/pgsql/data:Z> \ <3>
118+
[ OPTIONAL_CONFIGURATION_VARIABLES ]
119+
registry.redhat.io/rhel8/postgresql-15
120+
----
121+
+
122+
<1> Insert a name for your Clair PostgreSQL 15 migration database.
123+
<2> Your new Clair PostgreSQL 15 database container IP address. Can obtained by running the following command: `sudo podman inspect -f "{{.NetworkSettings.IPAddress}}" postgresql-quay`.
124+
<3> You must specify a different volume mount point than the one from your initial Clair PostgreSQL 13 deployment, and modify the access control lists for said directory. For example:
125+
+
126+
[source,terminal]
127+
----
128+
$ mkdir -p /host/data/clair-postgresql15-directory
129+
----
130+
+
131+
[source,terminal]
132+
----
133+
$ setfacl -m u:26:-wx /host/data/clair-postgresql15-directory
134+
----
135+
+
136+
This prevents data from being overwritten by the new container.
137+
138+
. Stop the Clair PostgreSQL 13 container:
139+
+
140+
[source,terminal]
141+
----
142+
$ sudo podman stop <clair_postgresql13_container_name>
143+
----
144+
145+
. After completing the PostgreSQL migration, run the Clair PostgreSQL 15 container, using the new data volume mount from Step 3, for example, `</host/data/clair-postgresql15-directory:/var/lib/postgresql/data>`:
146+
+
147+
[source,terminal]
148+
----
149+
$ sudo podman run -d --rm --name <postgresql15-clairv4> \
150+
-e POSTGRESQL_USER=<clair_username> \
151+
-e POSTGRESQL_PASSWORD=<clair_password> \
152+
-e POSTGRESQL_DATABASE=<clair_database_name> \
153+
-e POSTGRESQL_ADMIN_PASSWORD=<admin_password> \
154+
-p 5433:5432 \
155+
-v </host/data/clair-postgresql15-directory:/var/lib/postgresql/data:Z> \
156+
registry.redhat.io/rhel8/postgresql-15
157+
----
158+
159+
. Start the {productname} container by entering the following command:
160+
+
161+
[source,terminal]
162+
----
163+
$ sudo podman run -d --rm -p 80:8080 -p 443:8443 --name=quay \
164+
-v /home/<quay_user>/quay-poc/config:/conf/stack:Z \
165+
-v /home/<quay_user>/quay-poc/storage:/datastorage:Z \
166+
{productrepo}/{quayimage}:{productminv}
167+
----
168+
169+
. Start the Clair container by entering the following command:
170+
+
171+
[source,terminal]
172+
----
173+
$ sudo podman run -d --name clairv4 \
174+
-p 8081:8081 -p 8088:8088 \
175+
-e CLAIR_CONF=/clair/config.yaml \
176+
-e CLAIR_MODE=combo \
177+
registry.redhat.io/quay/clair-rhel8:{productminv}
178+
----
179+
180+
For more information, see link:https://github.com/sclorg/postgresql-container/tree/master/13#data-migration[Data Migration].
181+
82182
== Upgrade to 3.13.z from 3.12.z
83183

84184
=== Target images
@@ -91,6 +191,7 @@ ifdef::upstream[]
91191
endif::upstream[]
92192
* **PostgreSQL:** {postgresimage}
93193
* **Redis:** {redisimage}
194+
* **Clair-PosgreSQL:** registry.redhat.io/rhel8/postgresql-15
94195

95196
== Upgrade to 3.13.z from 3.11.z
96197

@@ -104,6 +205,7 @@ ifdef::upstream[]
104205
endif::upstream[]
105206
* **PostgreSQL:** {postgresimage}
106207
* **Redis:** {redisimage}
208+
* **Clair-PosgreSQL:** registry.redhat.io/rhel8/postgresql-15
107209

108210
== Upgrade to 3.13.z from 3.10.z
109211

@@ -117,6 +219,7 @@ ifdef::upstream[]
117219
endif::upstream[]
118220
* **PostgreSQL:** {postgresimage}
119221
* **Redis:** {redisimage}
222+
* **Clair-PosgreSQL:** registry.redhat.io/rhel8/postgresql-15
120223

121224
////
122225
== Upgrade to 3.12.z from 3.11.z

‎modules/rn_3_13_0.adoc

+7
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,13 @@ _optional_|Determine whether pruned tags should or should not match the tagPatte
146146

147147
For example API commands, see link:https://docs.redhat.com/en/documentation/red_hat_quay/3.12/html-single/manage_red_hat_quay/index#red-hat-quay-namespace-auto-pruning-overview[{productname} auto-pruning overview].
148148

149+
[id="notable-technical-changes-313]
150+
== {productname} 3.13 notable technical changes
151+
152+
Clair now requires its PostgreSQL database to be version 15. For standalone {productname} deployments, administrators must manually migrate their database over from PostgreSQL version 13 to version 15. For more information about this procedure, see link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/upgrade_red_hat_quay/index#upgrading-clair-postgresql-database[Upgrading the Clair PostgreSQL database].
153+
154+
For {productname-ocp} deployments, this update is automatically handled by the Operator so long as your Clair PostgreSQL database is currently using version 13.
155+
149156
[id="known-issues-and-limitations-313"]
150157
== {productname} 3.13 known issues and limitations
151158

‎modules/upgrading-postgresql.adoc

+1-1
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ spec:
7777

7878
. After the `clair-postgres-upgrade`, `quay-postgres-upgrade`, and `quay-app-upgrade` pods are marked as *Completed*, the remaining pods for your {productname} deployment spin up. This takes approximately ten minutes.
7979

80-
. Verify that the `quay-database` and `clair-postgres` pods now use the `postgresql-13` image.
80+
. Verify that the `quay-database` uses the `postgresql-13` image and `clair-postgres` pods now use the `postgresql-15` image.
8181

8282
. After the `quay-app` pod is marked as *Running*, you can reach your {productname} registry.
8383

0 commit comments

Comments
 (0)