gitlab升级16.11.3-ee

news2024/11/27 16:42:03

背景

这是事后一段时间补充记录的博客。

升级目的：修补漏洞CVE-2024-4835 未经认证的威胁攻击者能够利用该漏洞在跨站脚本 (XSS) 攻击中，轻松接管受害者账户。

gitlab版本为14.6.2-ee升级至16.11.3-ee

思路

  1. 翻阅文档找升级方法及升级版本路径。
  2. 使用备份文件和测试机器模拟升级。但事后发现模拟升级有用，但效果不大
  3. 记录测试过程中问题
  4. 发邮件通知执行升级时间及影响时长
  5. 执行升级

执行

升级路径

根据官网给的升级路径工具指出要跨多个版本 需要先升级至中间版本状态，再升级至目标版本
refer
升级路径工具
https://gitlab-com.gitlab.io/support/toolbox/upgrade-path
在这里插入图片描述
在这里插入图片描述

执行升级

yum install -y gitlab-ee-14.9.5

升级至14.9.5过程中的问题

acme证书签发问题

gitlab两种https实现，一种是买第三方的https证书手工配置到nginx上，一种是使用gitlab内置的acme一个证书签发管理工具生成https证书实现加密
报错信息
Acme::Client::Error::AccountDoesNotExist: No account exists with the provided key
Error executing action create on resource ‘letsencrypt_certificate[abc.xyz.123]’

Error executing action `create` on resource 'letsencrypt_certificate[abc.xyz.123]'
    ================================================================================
     
    Acme::Client::Error::AccountDoesNotExist
    ----------------------------------------
    acme_certificate[staging] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/resources/certificate.rb line 41) had an error: Acme::Client::Error::AccountDoesNotExist: No account exists with the provided key
     
    Cookbook Trace:
    ---------------
    /opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/libraries/acme.rb:58:in `acme_order_certs_for'
    /opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/resources/certificate.rb:89:in `block in class_from_file'
     
    Resource Declaration:
    ---------------------
    # In /opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/recipes/http_authorization.rb
     
      6: letsencrypt_certificate site do
      7:   crt node['gitlab']['nginx']['ssl_certificate']
      8:   key node['gitlab']['nginx']['ssl_certificate_key']
      9:   notifies :run, "execute[reload nginx]", :immediate
     10:   notifies :run, 'ruby_block[display_le_message]'
     11:   only_if { omnibus_helper.service_up?('nginx') }
     12: end
     
    Compiled Resource:
    ------------------
    # Declared in /opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/recipes/http_authorization.rb:6:in `from_file'
     
    letsencrypt_certificate("abc.xyz.123") do
      action [:create]
      updated true
      updated_by_last_action true
      default_guard_interpreter :default
      declared_type :letsencrypt_certificate
      cookbook_name "letsencrypt"
      recipe_name "http_authorization"
      crt "/etc/gitlab/ssl/abc.xyz.123_cert_chain.pem"
      key "/etc/gitlab/ssl/abc.xyz.123_key.key"
      alt_names []
      cn "abc.xyz.123"
      only_if { #code block }
    end
     
    System Info:
    ------------
    chef_version=15.17.4
    platform=centos
    platform_version=7.9.2009
    ruby=ruby 2.7.5p203 (2021-11-24 revision f69aeb8314) [x86_64-linux]
    program_name=/opt/gitlab/embedded/bin/chef-client
    executable=/opt/gitlab/embedded/bin/chef-client
     
Recipe: nginx::enable
  * runit_service[nginx] action restart (up to date)
 
Running handlers:
There was an error running gitlab-ctl reconfigure:
 
letsencrypt_certificate[abc.xyz.123] (letsencrypt::http_authorization line 6) had an error: Acme::Client::Error::AccountDoesNotExist: acme_certificate[staging] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/resources/certificate.rb line 41) had an error: Acme::Client::Error::AccountDoesNotExist: No account exists with the provided key
 
Running handlers complete
Chef Infra Client failed. 4 resources updated in 17 secondsj

解决

移除上一次使用的自签名证书

[root@instance-vl1r58a5 acme]# pwd
/etc/acme
[root@instance-vl1r58a5 acme]# mv account_private_key.pem account_private_key.pem.bak20240531
[root@instance-vl1r58a5 acme]# ls
account_private_key.pem  account_private_key.pem.backup20220926  account_private_key.pem.bak20240531
[root@instance-vl1r58a5 acme]# gitlab-ctl reconfigure

refer
https://gbe0.com/posts/linux/server/gitlab-acme-account-does-not-exist/
https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6610
https://forum.gitlab.com/t/gitlab-letsencrypt-issue/63737

继续升级无报错

yum install -y gitlab-ee-14.9.5
yum install -y gitlab-ee-14.10.5
yum install -y gitlab-ee-15.0.5
yum install -y gitlab-ee-15.4.6
yum install -y gitlab-ee-15.11.13

pg数据库报错token设置不符合约束，是gitlab配置的token有效期不能设置为永不过期
报错信息
Error ensuring PostgreSQL is updated. Please check the logs
warning: %posttrans(gitlab-ee-15.11.13-ee.0.el7.x86_64) scriptlet failed, exit status 1
PG::CheckViolation: ERROR: check constraint “check_70f294ef54” of relation “oauth_access_tokens” is violated by some row

main: -- quote_column_name("group_ci_variables")rake aborted!
StandardError: An error has occurred, all later migrations canceled:
 
PG::CheckViolation: ERROR:  check constraint "check_70f294ef54" of relation "oauth_access_tokens" is violated by some row
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/constraints_helpers.rb:119:in `block in validate_check_constraint'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/timeout_helpers.rb:31:in `disable_statement_timeout'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/constraints_helpers.rb:116:in `validate_check_constraint'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/constraints_helpers.rb:232:in `validate_not_null_constraint'
/opt/gitlab/embedded/service/gitlab-rails/db/post_migrate/20230223014251_validate_not_null_constraint_on_oauth_access_tokens_expires_in.rb:7:in `up'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migration_helpers/restrict_gitlab_schema.rb:33:in `block in exec_migration'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/query_analyzer.rb:37:in `within'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migration_helpers/restrict_gitlab_schema.rb:30:in `exec_migration'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migration_helpers/automatic_lock_writes_on_tables.rb:19:in `exec_migration'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/lock_retry_mixin.rb:36:in `ddl_transaction'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/pg_backend_pid.rb:15:in `block in with_advisory_lock_connection'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/pg_backend_pid.rb:12:in `with_advisory_lock_connection'
/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/db.rake:117:in `configure_database'
/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/db.rake:95:in `block (3 levels) in <top (required)>'
/opt/gitlab/embedded/bin/bundle:23:in `load'
/opt/gitlab/embedded/bin/bundle:23:in `<main>'
 
Caused by:
ActiveRecord::StatementInvalid: PG::CheckViolation: ERROR:  check constraint "check_70f294ef54" of relation "oauth_access_tokens" is violated by some row
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/constraints_helpers.rb:119:in `block in validate_check_constraint'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/timeout_helpers.rb:31:in `disable_statement_timeout'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/constraints_helpers.rb:116:in `validate_check_constraint'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/constraints_helpers.rb:232:in `validate_not_null_constraint'
/opt/gitlab/embedded/service/gitlab-rails/db/post_migrate/20230223014251_validate_not_null_constraint_on_oauth_access_tokens_expires_in.rb:7:in `up'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migration_helpers/restrict_gitlab_schema.rb:33:in `block in exec_migration'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/query_analyzer.rb:37:in `within'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migration_helpers/restrict_gitlab_schema.rb:30:in `exec_migration'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migration_helpers/automatic_lock_writes_on_tables.rb:19:in `exec_migration'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/lock_retry_mixin.rb:36:in `ddl_transaction'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/pg_backend_pid.rb:15:in `block in with_advisory_lock_connection'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/pg_backend_pid.rb:12:in `with_advisory_lock_connection'
/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/db.rake:117:in `configure_database'
/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/db.rake:95:in `block (3 levels) in <top (required)>'
/opt/gitlab/embedded/bin/bundle:23:in `load'
/opt/gitlab/embedded/bin/bundle:23:in `<main>'
 
Caused by:
PG::CheckViolation: ERROR:  check constraint "check_70f294ef54" of relation "oauth_access_tokens" is violated by some row
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/constraints_helpers.rb:119:in `block in validate_check_constraint'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/timeout_helpers.rb:31:in `disable_statement_timeout'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/constraints_helpers.rb:116:in `validate_check_constraint'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/constraints_helpers.rb:232:in `validate_not_null_constraint'
/opt/gitlab/embedded/service/gitlab-rails/db/post_migrate/20230223014251_validate_not_null_constraint_on_oauth_access_tokens_expires_in.rb:7:in `up'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migration_helpers/restrict_gitlab_schema.rb:33:in `block in exec_migration'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/query_analyzer.rb:37:in `within'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migration_helpers/restrict_gitlab_schema.rb:30:in `exec_migration'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migration_helpers/automatic_lock_writes_on_tables.rb:19:in `exec_migration'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/lock_retry_mixin.rb:36:in `ddl_transaction'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/pg_backend_pid.rb:15:in `block in with_advisory_lock_connection'
/opt/gitlab/embedded/service/gitlab-rails/lib/gitlab/database/migrations/pg_backend_pid.rb:12:in `with_advisory_lock_connection'
/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/db.rake:117:in `configure_database'
/opt/gitlab/embedded/service/gitlab-rails/lib/tasks/gitlab/db.rake:95:in `block (3 levels) in <top (required)>'
/opt/gitlab/embedded/bin/bundle:23:in `load'
/opt/gitlab/embedded/bin/bundle:23:in `<main>'
Tasks: TOP => db:migrate
(See full trace by running task with --trace)
 
main:    -> 0.0000s
main: -- quote("early_adopter")
main:    -> 0.0000s
main: -- quote(30000)
main:    -> 0.0000s
main: -- execute("INSERT INTO plan_limits (plan_id, \"group_ci_variables\")\nSELECT id, '30000' FROM plans WHERE name = 'early_adopter' LIMIT 1\nON CONFLICT (plan_id) DO UPDATE SET \"group_ci_variables\" = EXCLUDED.\"group_ci_variables\";\n")
main:    -> 0.0007s
main: -- quote_column_name("group_ci_variables")
main:    -> 0.0000s
main: -- quote("opensource")
main:    -> 0.0000s
main: -- quote(30000)
main:    -> 0.0000s
main: -- execute("INSERT INTO plan_limits (plan_id, \"group_ci_variables\")\nSELECT id, '30000' FROM plans WHERE name = 'opensource' LIMIT 1\nON CONFLICT (plan_id) DO UPDATE SET \"group_ci_variables\" = EXCLUDED.\"group_ci_variables\";\n")
main:    -> 0.0009s
main: == 20230221162222 RaiseCiVariableLimitsOnGitlabCom: migrated (0.0220s) ========
 
main: == 20230221214519 RemoveIncorrectlyOnboardedNamespacesFromOnboardingProgress: migrating
main: == 20230221214519 RemoveIncorrectlyOnboardedNamespacesFromOnboardingProgress: migrated (0.0499s)
 
main: == 20230222035805 PrepareAsyncIndexRemovalOfTokenForCiBuilds: migrating =======
main: -- index_exists?(:ci_builds, :token_encrypted, {:name=>:index_ci_builds_on_token_encrypted})
main:    -> 0.0183s
main: -- quote_column_name(:index_ci_builds_on_token_encrypted)
main:    -> 0.0000s
main: == 20230222035805 PrepareAsyncIndexRemovalOfTokenForCiBuilds: migrated (0.0280s)
 
main: == 20230222055510 RemoveConcurrentIndexOnTokenEncryptedForCiBuilds: migrating =
main: -- transaction_open?()
main:    -> 0.0000s
main: -- view_exists?(:postgres_partitions)
main:    -> 0.0008s
main: -- indexes(:ci_builds)
main:    -> 0.0183s
main: -- execute("SET statement_timeout TO 0")
main:    -> 0.0003s
main: -- remove_index(:ci_builds, {:algorithm=>:concurrently, :name=>:index_ci_builds_on_token_encrypted})
main:    -> 0.0067s
main: -- execute("RESET statement_timeout")
main:    -> 0.0003s
main: == 20230222055510 RemoveConcurrentIndexOnTokenEncryptedForCiBuilds: migrated (0.0383s)
 
main: == 20230222101420 RemoveFkToCiBuildCiPendingBuildOnBuildId: migrating =========
main: -- transaction_open?()
main:    -> 0.0000s
main: -- transaction_open?()
main:    -> 0.0000s
main: -- execute("LOCK TABLE ci_builds, ci_pending_builds IN ACCESS EXCLUSIVE MODE")
main:    -> 0.0004s
main: -- remove_foreign_key(:ci_pending_builds, :ci_builds, {:name=>:fk_rails_725a2644a3})
main:    -> 0.0059s
main: == 20230222101420 RemoveFkToCiBuildCiPendingBuildOnBuildId: migrated (0.0177s)
 
main: == 20230222102421 RemoveFkToCiBuildCiRunningBuildOnBuildId: migrating =========
main: -- transaction_open?()
main:    -> 0.0000s
main: -- transaction_open?()
main:    -> 0.0000s
main: -- execute("LOCK TABLE ci_builds, ci_running_builds IN ACCESS EXCLUSIVE MODE")
main:    -> 0.0004s
main: -- remove_foreign_key(:ci_running_builds, :ci_builds, {:name=>:fk_rails_da45cfa165})
main:    -> 0.0058s
main: == 20230222102421 RemoveFkToCiBuildCiRunningBuildOnBuildId: migrated (0.0179s)
 
main: == 20230222153048 AddRegistrySizeEstimatedToNamespaceRootStorageStatistics: migrating
main: -- transaction_open?()
main:    -> 0.0000s
main: -- add_column(:namespace_root_storage_statistics, :registry_size_estimated, :boolean, {:default=>false, :null=>false})
main:    -> 0.0012s
main: -- transaction_open?()
main:    -> 0.0000s
main: -- view_exists?(:postgres_partitions)
main:    -> 0.0008s
main: -- index_exists?(:namespace_root_storage_statistics, :registry_size_estimated, {:name=>"index_ns_root_stor_stats_on_registry_size_estimated", :algorithm=>:concurrently})
main:    -> 0.0024s
main: -- execute("SET statement_timeout TO 0")
main:    -> 0.0002s
main: -- add_index(:namespace_root_storage_statistics, :registry_size_estimated, {:name=>"index_ns_root_stor_stats_on_registry_size_estimated", :algorithm=>:concurrently})
main:    -> 0.0044s
main: -- execute("RESET statement_timeout")
main:    -> 0.0003s
main: == 20230222153048 AddRegistrySizeEstimatedToNamespaceRootStorageStatistics: migrated (0.0215s)
 
main: == 20230222161226 AddCustomJiraRegexToJiraTrackerData: migrating ==============
main: -- add_column(:jira_tracker_data, :jira_issue_prefix, :text)
main:    -> 0.0006s
main: -- add_column(:jira_tracker_data, :jira_issue_regex, :text)
main:    -> 0.0005s
main: == 20230222161226 AddCustomJiraRegexToJiraTrackerData: migrated (0.0056s) =====
 
main: == 20230222161954 AddTextLimitToCustomJiraRegexFields: migrating ==============
main: -- transaction_open?()
main:    -> 0.0000s
main: -- transaction_open?()
main:    -> 0.0000s
main: -- execute("ALTER TABLE jira_tracker_data\nADD CONSTRAINT check_4cc5bbc801\nCHECK ( char_length(jira_issue_prefix) <= 255 )\nNOT VALID;\n")
main:    -> 0.0006s
main: -- execute("SET statement_timeout TO 0")
main:    -> 0.0008s
main: -- execute("ALTER TABLE jira_tracker_data VALIDATE CONSTRAINT check_4cc5bbc801;")
main:    -> 0.0008s
main: -- execute("RESET statement_timeout")
main:    -> 0.0002s
main: -- transaction_open?()
main:    -> 0.0000s
main: -- transaction_open?()
main:    -> 0.0000s
main: -- execute("ALTER TABLE jira_tracker_data\nADD CONSTRAINT check_9863a0a5fd\nCHECK ( char_length(jira_issue_regex) <= 255 )\nNOT VALID;\n")
main:    -> 0.0005s
main: -- execute("SET statement_timeout TO 0")
main:    -> 0.0002s
main: -- execute("ALTER TABLE jira_tracker_data VALIDATE CONSTRAINT check_9863a0a5fd;")
main:    -> 0.0007s
main: -- execute("RESET statement_timeout")
main:    -> 0.0002s
main: == 20230222161954 AddTextLimitToCustomJiraRegexFields: migrated (0.0169s) =====
 
main: == 20230222193845 ChangePublicProjectsMinutesCostFactorDefaultTo1: migrating ==
main: -- transaction_open?()
main:    -> 0.0000s
main: -- change_column_default(:ci_runners, :public_projects_minutes_cost_factor, {:from=>0.0, :to=>1.0})
main:    -> 0.0031s
main: == 20230222193845 ChangePublicProjectsMinutesCostFactorDefaultTo1: migrated (0.0093s)
 
main: == 20230223014251 ValidateNotNullConstraintOnOauthAccessTokensExpiresIn: migrating
main: -- execute("SET statement_timeout TO 0")
main:    -> 0.0002s
main: -- execute("ALTER TABLE oauth_access_tokens VALIDATE CONSTRAINT check_70f294ef54;")
main: -- execute("RESET statement_timeout")
main:    -> 0.0002s
STDERR:
---- End output of "bash"  ----
Ran "bash"  returned 1
Running reconfigure: NOT OK
== Fatal error ==
Something went wrong during final reconfiguration, please check the output
== Reverting ==
ok: down: postgresql: 0s, normally up
Symlink correct version of binaries: OK
ok: run: postgresql: (pid 40162) 0s
== Reverted ==
== Reverted to 12.14. Please check output for what went wrong ==
Toggling deploy page:rm -f /opt/gitlab/embedded/service/gitlab-rails/public/index.html
Toggling deploy page: OK
Toggling services:ok: run: alertmanager: (pid 40177) 0s
ok: run: crond: (pid 40188) 1s
ok: run: gitaly: (pid 40196) 0s
ok: run: gitlab-exporter: (pid 40216) 1s
ok: run: gitlab-kas: (pid 40109) 5s
ok: run: grafana: (pid 40220) 0s
ok: run: logrotate: (pid 40231) 0s
ok: run: node-exporter: (pid 40237) 1s
ok: run: postgres-exporter: (pid 40244) 0s
ok: run: prometheus: (pid 40252) 1s
ok: run: redis-exporter: (pid 40263) 0s
ok: run: registry: (pid 40273) 1s
ok: run: sidekiq: (pid 40283) 0s
Toggling services: OK
Checking if a newer PostgreSQL version is available and attempting automatic upgrade to it: NOT OK
Error ensuring PostgreSQL is updated. Please check the logs
warning: %posttrans(gitlab-ee-15.11.13-ee.0.el7.x86_64) scriptlet failed, exit status 1
Non-fatal POSTTRANS scriptlet failure in rpm package gitlab-ee-15.11.13-ee.0.el7.x86_64
  Verifying  : gitlab-ee-15.11.13-ee.0.el7.x86_64                                                                                                                                  1/2
  Verifying  : gitlab-ee-15.4.6-ee.0.el7.x86_64                                                                                                                                    2/2
 
Updated:
  gitlab-ee.x86_64 0:15.11.13-ee.0.el7                                                                                                                                                
 
Complete!

解决

# 停止数据库连接
gitlab-ctl stop unicorn
gitlab-ctl stop sidekiq
 
gitlab-psql -d gitlabhq_production
gitlabhq_production=# SELECT * FROM oauth_access_tokens WHERE expires_in IS NULL;
 id | resource_owner_id | application_id |                              token                               |                          refresh_token                           | expires_in | revoked_at |         created_at         |  scopes  
----+-------------------+----------------+------------------------------------------------------------------+------------------------------------------------------------------+------------+------------+----------------------------+-----------
  1 |                 4 |              1 | effcc3b35xxxxx909542e6cdfa34b5528 | 75d6c18ffb3a4ba4xxxxxxxxca27f35 |            |            | 2022-02-17 15:01:40.419753 | read_user
(1 row)
 
 
gitlabhq_production=# UPDATE oauth_access_tokens SET expires_in = '86400' WHERE expires_in IS NULL;
UPDATE 1
gitlabhq_production=# select * from oauth_access_tokens where expires_in IS NULL;
 id | resource_owner_id | application_id | token | refresh_token | expires_in | revoked_at | created_at | scopes
----+-------------------+----------------+-------+---------------+------------+------------+------------+--------
(0 rows)

refer
https://docs.gitlab.com/ee/update/versions/gitlab_15_changes.html

pg版本不受支持

解决：升级pg到指定版本13

# 查看当前pg版本
[root@instance-vl1r58a5 ~]# /opt/gitlab/embedded/bin/psql --version
psql (PostgreSQL) 12.14
# 升级至13版本
[root@instance-vl1r58a5 ~]# gitlab-ctl pg-upgrade -V 13
Checking for an omnibus managed postgresql: OK
Checking if postgresql['version'] is set: OK
Checking if we already upgraded: NOT OK
Checking for a newer version of PostgreSQL to install
Upgrading PostgreSQL to 13.11
Checking if disk for directory /var/opt/gitlab/postgresql/data has enough free space for PostgreSQL upgrade: OK
Checking if PostgreSQL bin files are symlinked to the expected location: OK
Waiting 30 seconds to ensure tasks complete before PostgreSQL upgrade.
See https://docs.gitlab.com/omnibus/settings/database.html#upgrade-packaged-postgresql-server for details
If you do not want to upgrade the PostgreSQL server at this time, enter Ctrl-C and see the documentation for details
 
Please hit Ctrl-C now if you want to cancel the operation.
Toggling deploy page:cp /opt/gitlab/embedded/service/gitlab-rails/public/deploy.html /opt/gitlab/embedded/service/gitlab-rails/public/index.html
Toggling deploy page: OK
Toggling services:ok: down: alertmanager: 0s, normally up
ok: down: crond: 1s, normally up
ok: down: gitaly: 1s, normally up
ok: down: gitlab-exporter: 1s, normally up
ok: down: gitlab-kas: 0s, normally up
ok: down: grafana: 0s, normally up
ok: down: logrotate: 0s, normally up
ok: down: node-exporter: 1s, normally up
ok: down: postgres-exporter: 0s, normally up
ok: down: prometheus: 1s, normally up
ok: down: redis-exporter: 0s, normally up
ok: down: registry: 1s, normally up
ok: down: sidekiq: 0s, normally up
Toggling services: OK
Running stop on postgresql:ok: down: postgresql: 1s, normally up
Running stop on postgresql: OK
Symlink correct version of binaries: OK
Creating temporary data directory: OK
Initializing the new database: OK
Upgrading the data: OK
Move the old data directory out of the way: OK
Rename the new data directory: OK
Saving the old version information: OK
Configuring PostgreSQL
[2024-05-31T23:33:40+08:00] INFO: Started Cinc Zero at chefzero://localhost:1 with repository at /opt/gitlab/embedded (One version per cookbook)
Cinc Client, version 17.10.0
Patents: https://www.chef.io/patents
Infra Phase starting
[2024-05-31T23:33:40+08:00] INFO: *** Cinc Client 17.10.0 ***
[2024-05-31T23:33:40+08:00] INFO: Platform: x86_64-linux
[2024-05-31T23:33:40+08:00] INFO: Cinc-client pid: 3541
[2024-05-31T23:33:42+08:00] INFO: Setting the run_list to ["recipe[gitlab-ee::config]", "recipe[postgresql::enable]"] from CLI options
[2024-05-31T23:33:42+08:00] INFO: Run List is [recipe[gitlab-ee::config], recipe[postgresql::enable]]
[2024-05-31T23:33:42+08:00] INFO: Run List expands to [gitlab-ee::config, postgresql::enable]
[2024-05-31T23:33:42+08:00] INFO: Starting Cinc Client Run for instance-vl1r58a5
[2024-05-31T23:33:42+08:00] INFO: Running start handlers
[2024-05-31T23:33:42+08:00] INFO: Start handlers complete.
Resolving cookbooks for run list: ["gitlab-ee::config", "postgresql::enable"]
[2024-05-31T23:33:43+08:00] INFO: Loading cookbooks [gitlab-ee@0.0.1, postgresql@0.1.0, package@0.1.0, gitlab@0.0.1, consul@0.1.0, patroni@0.1.0, pgbouncer@0.1.0, spamcheck@0.1.0, runit@5.1.7, logrotate@0.1.0, redis@0.1.0, monitoring@0.1.0, registry@0.1.0, mattermost@0.1.0, gitaly@0.1.0, praefect@0.1.0, gitlab-kas@0.1.0, gitlab-pages@0.1.0, letsencrypt@0.1.0, nginx@0.1.0, acme@4.1.6, crond@0.1.0]
Synchronizing cookbooks:
  - gitlab-ee (0.0.1)
  - postgresql (0.1.0)
  - package (0.1.0)
  - gitlab (0.0.1)
  - consul (0.1.0)
  - patroni (0.1.0)
  - pgbouncer (0.1.0)
  - spamcheck (0.1.0)
  - runit (5.1.7)
  - logrotate (0.1.0)
  - redis (0.1.0)
  - monitoring (0.1.0)
  - registry (0.1.0)
  - mattermost (0.1.0)
  - gitaly (0.1.0)
  - praefect (0.1.0)
  - gitlab-kas (0.1.0)
  - gitlab-pages (0.1.0)
  - letsencrypt (0.1.0)
  - nginx (0.1.0)
  - crond (0.1.0)
  - acme (4.1.6)
Installing cookbook gem dependencies:
Compiling cookbooks...
Loading Cinc Auditor profile files:
 
Running handlers:
[2024-05-31T23:34:07+08:00] INFO: Running report handlers
Running handlers complete
[2024-05-31T23:34:07+08:00] INFO: Report handlers complete
Infra Phase complete, 8/964 resources updated in 15 seconds
[2024-05-31T23:34:07+08:00] WARN: This release of Cinc Client became end of life (EOL) on May 1st 2023. Please update to a supported release to receive new features, bug fixes, and security updates.
Running reconfigure: OK
Waiting for Database to be running.
Database upgrade is complete, running vacuumdb analyze
Toggling deploy page:rm -f /opt/gitlab/embedded/service/gitlab-rails/public/index.html
Toggling deploy page: OK
Toggling services:ok: run: alertmanager: (pid 4287) 1s
ok: run: crond: (pid 4297) 0s
ok: run: gitaly: (pid 4306) 1s
ok: run: gitlab-exporter: (pid 4325) 0s
ok: run: gitlab-kas: (pid 4328) 0s
ok: run: grafana: (pid 4339) 1s
ok: run: logrotate: (pid 4350) 0s
ok: run: node-exporter: (pid 4359) 1s
ok: run: postgres-exporter: (pid 4366) 0s
ok: run: prometheus: (pid 4378) 1s
ok: run: redis-exporter: (pid 4389) 0s
ok: run: registry: (pid 4397) 0s
ok: run: sidekiq: (pid 4407) 1s
Toggling services: OK
==== Upgrade has completed ====
Please verify everything is working and run the following if so
sudo rm -rf /var/opt/gitlab/postgresql/data.12
sudo rm -f /var/opt/gitlab/postgresql-version.old
 
 
# 验证
[root@instance-vl1r58a5 ~]# /opt/gitlab/embedded/bin/psql --version
psql (PostgreSQL) 13.11

升级之后要手工合并一下数据，完成数据库迁移

# 合并
[root@instance-vl1r58a5 ~]# gitlab-rake db:migrate
# 在此检查状态ok
[root@instance-vl1r58a5 ~]# gitlab-rake db:migrate:status
# 所有的status状态为up即正常
# 重新加载gitlab配置
gitlab-ctl reconfigure

refer
https://docs.gitlab.com/ee/update/versions/gitlab_15_changes.html
https://docs.gitlab.com/ee/administration/raketasks/maintenance.html#run-incomplete-database-migrations
继续升级，后续升级无报错

yum install -y gitlab-ee-16.3.7
yum install -y gitlab-ee-16.7.7
yum install -y gitlab-ee-16.11.3

其他命令

# 恢复备份命令
gitlab-rake gitlab:backup:restore BACKUP=1621908711
# 查看gitlab版本
cat /opt/gitlab/embedded/service/gitlab-rails/VERSION
gitlab-rake gitlab:env:info

gitlab如果在web端禁用了root用户登录，如下命令启用root用户

gitlabhq_production=# UPDATE users SET state='active' WHERE username='root';
UPDATE 1

修改用户密码
https://docs.gitlab.cn/jh/security/reset_user_password.html
rails控制台

gitlab-rails console
irb(main):006:0> user = User.find_by(username: 'root')
=> #<User id:1 @root>
irb(main):007:0> user.password = 'xxx'
irb(main):008:0> user.password_confirmation = 'xxxx'
irb(main):009:0> user.save
=> true
irb(main):010:0> exit

refer

漏洞信息
https://about.gitlab.com/releases/2024/05/22/patch-release-gitlab-17-0-1-released/
https://gbe0.com/posts/linux/server/gitlab-acme-account-does-not-exist/
https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6610
https://forum.gitlab.com/t/gitlab-letsencrypt-issue/63737
https://docs.gitlab.com/ee/update/versions/gitlab_15_changes.html
https://docs.gitlab.com/ee/update/versions/gitlab_15_changes.html
https://docs.gitlab.com/ee/administration/raketasks/maintenance.html#run-incomplete-database-migrations

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.coloradmin.cn/o/1848624.html

如若内容造成侵权/违法违规/事实不符，请联系多彩编程网进行投诉反馈，一经查实，立即删除！

相关文章

HarmonyOS父子组件传递参数

HarmonyOS父子组件传递参数

HarmonyOS父子组件传递参数 1. 使用State和Prop进行父子组件传递———注意是单向同步 Prop装饰器&#xff1a;父子单向同步 注意&#xff1a;只支持单向同步&#xff0c;同时也只能支持string\number\boolean\enum比较简单的类型。 代码 // 使用 props 进行父子组件传值…
阅读更多...
Android翻转动画（卡片翻转效果）

Android翻转动画（卡片翻转效果）

前言 最近好友问计蒙翻转动画&#xff0c;恰好在大二那年看Android Api Demo时记了笔记&#xff0c;由此写一篇文章。 需求 屏幕右滑事件触发卡片的翻转效果 &#xff0c;为了方便&#xff0c;在例子中将右滑事件改成按钮点击事件 老规矩&#xff0c;最后有源码 一、先介绍三…
阅读更多...
从 Hadoop 迁移，无需淘汰和替换

从 Hadoop 迁移，无需淘汰和替换

我们仍然惊讶于有如此多的客户来找我们&#xff0c;希望从HDFS迁移到现代对象存储&#xff0c;如MinIO。我们现在以为每个人都已经完成了过渡&#xff0c;但每周&#xff0c;我们都会与一个决定进行过渡的主要、高技术性组织交谈。 很多时候&#xff0c;在这些讨论中&#xff…
阅读更多...
mac 常用工具命令集合

mac 常用工具命令集合

一、vim 快捷键 1、移动光标 h j k l 左 下 上 右 箭头上 上移一行 箭头下 下移一行 0 跳至行首&#xff0c;不管有无缩进&#xff0c;就是跳到第0个字符 ^ 跳至行首的第一个字符 $ 跳至行尾 gg 跳至文首 G 调至文尾 5gg/5G 调至第5行w 跳到下一个字首&#xff0c;按标点或…
阅读更多...
Android修行手册-ImageView的adjustViewBounds和设置透明度

Android修行手册-ImageView的adjustViewBounds和设置透明度

点击跳转>GameFramework文档系列&#xff08;二&#xff09;- 场景相关 点击跳转>GameFramework文档系列&#xff08;三&#xff09;- 日志管理和UI 点击跳转>GameFramework文档系列&#xff08;四&#xff09;- 事件订阅 点击跳转>保姆式Cocos合成大西瓜案例 …
阅读更多...
基于LangChain-Chatchat实现的RAG-本地知识库的问答应用[3]-参数配置详细版

基于LangChain-Chatchat实现的RAG-本地知识库的问答应用[3]-参数配置详细版

基于LangChain-Chatchat实现的RAG-本地知识库的问答应用[3]-参数配置详细版 在开始参数配置之前，先执行以下脚本 python copy_config_example.py该脚本将会将所有config目录下的配置文件样例复制一份到config目录下，方便开发者进行配置。 接着，开发者可以根据自己的需求，对…
阅读更多...
LeetCode---402周赛

LeetCode---402周赛

题目列表 3184. 构成整天的下标对数目 I 3185. 构成整天的下标对数目 II 3186. 施咒的最大总伤害 3187. 数组中的峰值 一、构成整天的下标对数目 I & II 可以直接二重for循环暴力遍历出所有的下标对&#xff0c;然后统计符合条件的下标对数目返回。代码如下 class So…
阅读更多...
graalvm jdk和openjdk

graalvm jdk和openjdk

下载地址:https://github.com/graalvm/graalvm-ce-builds/releases 官网: https://www.graalvm.org
阅读更多...
【AI作曲】毁掉音乐？早该来了！一个网易音乐人对于 AI 大模型音乐创作的思辨

【AI作曲】毁掉音乐？早该来了！一个网易音乐人对于 AI 大模型音乐创作的思辨

引言&#xff1a;AI在创造还是毁掉音乐&#xff1f; 正如当初 midjourney 和 StableDiffusion 在绘画圈掀起的风波一样&#xff0c;suno 和 各大音乐大模型的来临&#xff0c;其实早该来了。 AI 在毁掉绘画&#xff1f;或者毁掉音乐&#xff1f; 没错&#xff0c;但也错了。…
阅读更多...
Android网络收集和ping封装库

Android网络收集和ping封装库

功能Stetho 是 Facebook 开源的一个 Android 调试工具。是一个 Chrome Developer Tools 的扩展&#xff0c;可用来检测应用的网络、数据库、WebKit 、SharePreference等方面的功能。开发者也可通过它的 dumpapp 工具提供强大的命令行接口来访问应用内部。 02.stetho大概流程 …
阅读更多...
学校图书借阅管理系统（数据库课设）PS：有前端界面

学校图书借阅管理系统（数据库课设）PS：有前端界面

1.课设要求描述 ●实现图书信息、类别、出版社等信息的管理; ●实现读者信息、借阅证信息的管理; ●实现图书的借阅、续借、归还管理; ●实现超期罚款管理、收款管理; ●创建触发器&#xff0c;分别实现借书和还书时自动更新图书信息的在册数量; ●创建视图查询各种图书…
阅读更多...
谷歌手机刷机教学

谷歌手机刷机教学

注意&#xff1a;手机已经解开了oem锁和bl 1、adb基础命令 连接设备adb devices&#xff1a;列出当前连接的所有设备。 adb connect <设备IP>&#xff1a;通过IP地址连接设备&#xff08;用于无线连接&#xff09;。 设备信息adb shell getprop&#xff1a;获取设备的所…
阅读更多...
数据结构 —— 线索二叉树

数据结构 —— 线索二叉树

数据结构 —— 线索二叉树 线索二叉树结构定义结点类树类 线索化找线索二叉树的后继找线索二叉树的前驱 我们今天来看看线索二叉树。 线索二叉树 线索二叉树&#xff08;Threaded Binary Tree&#xff09;是一种特殊的二叉树结构&#xff0c;它是在二叉树的基础上进行改良的数…
阅读更多...
前端 CSS 经典：旋转边框效果

前端 CSS 经典：旋转边框效果

效果&#xff1a; 思路&#xff1a;使用伪元素&#xff0c;给伪元素设置背景色&#xff0c;然后定位&#xff0c;遮盖&#xff0c;旋转。就可以实现旋转边框效果。 实现代码&#xff1a; <!DOCTYPE html> <html lang"en"><head><meta chars…
阅读更多...
[FlareOn5]Ultimate Minesweeper

[FlareOn5]Ultimate Minesweeper

一切题目&#xff0c;可以运行的&#xff0c;首先就要自己运行一次 运行完毕你会发现这是个扫雷游戏 net dnspy打开 一般没有特别的 我们都是点这花括号 这有个getkey 一眼加加密 然后可以三个方向&#xff1a;动调&#xff0c;改文件&#xff0c;静态找数据写加密脚本 简…
阅读更多...
软件工程学系统设计

软件工程学系统设计

一、概述 软件设计阶段用比较抽象概括的方式确定目标系统如何完成预定的任务&#xff0c;即确定系统的物理模型。 回答系统 “做什么”。 软件设计是将需求转化为最终产品的唯一途径&#xff0c;是后续开发和维护工作的基础。 1、软件设计过程 从工程管理角度&#xff0c;…
阅读更多...
STM32通过SPI软件读写W25Q64

STM32通过SPI软件读写W25Q64

文章目录 1. W25Q64 2. 硬件电路 3. W25Q64框架图 4. 软件/硬件波形对比 5. 代码实现 5.1 MyI2C.c 5.2 MyI2C.h 5.3 W25Q64.c 5.4 W25Q64.h 5.5 W25Q64_Ins.h 5.6 main.c 1. W25Q64 对于SPI通信和W25Q64的详细解析可以看下面这篇文章 STM32单片机SPI通信详解-CSDN博…
阅读更多...
手撕排序2--选择排序(直接选择+堆排序

手撕排序2--选择排序(直接选择+堆排序

目录&#xff1a; 1.直接选择排序 的实现及分析 2.堆排序 的实现及分析 1.直接选择排序 1.1基本思想&#xff1a; 每一次从待排序的数据元素中选出最小&#xff08;或最大&#xff09;的一个元素&#xff0c;存放在序列的起始位置&#xff0c;直到全部待排序的数据元素排完…
阅读更多...
BP神经网络-入门到理解-长文讲述

BP神经网络-入门到理解-长文讲述

本文来自&#xff1a;老饼讲解-BP神经网络 https://www.bbbdata.com 目录 一、BP神经网络的仿生意义 二、BP神经网络的结构 三、BP神经网络的前馈与后馈 3.1 BP神经网络的前馈 3.2 什么是BP神经网络的后馈 四、BP神经网络的训练 4.1 BP神经网络归一化 4.2 梯度下降算法…
阅读更多...
Django使用

Django使用

一、安装Django 可以在创建好的虚拟环境中下载包 pip install Django3.2.20 -i https://pypi.tuna.tsinghua.edu.cn/simple 查看对应的下载好的内容 1、在Lib的site-packages第三方包里&#xff1a;这就是django框架源码 2、在scripts中有个 这是个工具&#xff0c;帮助创建d…
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023