Update Java on Greengrass devices - use "Install" lifecicle in manifest?

Question

We are in a position that we need to update the Java version on our greengrass devices running Linux. I'm looking at what is the best method to orchestrate this, or some best practice information

The updated java comes as a requirement of one of our custom compoments, so an option is to use the "Install" lifecycle of the artifact in the manifest. Then use the "onpath" or "exists" method to make sure it only runs once, which is a bit clunky. The benefit is that the update is part of the GG deployment which makes it nice and contained.

We also have System manager client running on these devices, so we could use systems manager to do this to.

I'm leading towards using the install lifecycle in the manifest but I'm interested if there are any better ideas, or if it's not the right tool for the job.

Cheers
J

Accepted Answer

Hi Johan,

Since you have SSM Agent on the device, I would advice on using [SSM Run Command](hhttps://docs.aws.amazon.com/systems-manager/latest/userguide/execute-remote-commands.html) to perform this kind of operations. You can either run the  package manager command directly, or better apply an Ansible Playbook or Chef Recipe.

You could use a component to perform this operation, but you would need to carefully consider all possible failure scenarios that could leave you with an unserviceable device when writing the `install` and `recover` script.

Cheers,
Massimiliano

Answer

To update java, we'd recommend using the `bootstrap` lifecycle script and exit with code 100 in order to restart the Nucleus with the new version of Java.

Answer

In the end I've opted to use SSM Run Command to execute a shell script which updates to Java-11. To make retries easier on failure (i.e. nodes going offline) and account for future nodes coming online I've created an association in SSM to run this daily.

For those interested, SSM Inventory can nicely be used to query which nodes have taken the update or not (using Athena).

I preferred this option as I can make sure all GG devices have Java-11 installed BEFORE I have a deployment which depends on it. Also, this way the deployment does not fail in case the JAva-11 update for some reason fails.

Update Java on Greengrass devices - use "Install" lifecicle in manifest?

関連するコンテンツ