This session was presented at Oracle OpenWorld 2013, and covers some of the best practices for the new packaging system in Oracle Solaris 11, IPS.

1. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.1

2. Oracle Solaris 11
Best Practices for Software
Lifecycle Management
Bart Smaalders, Solaris Engineering
Glynn Foster, Solaris Product Management

3. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.3
Program Agenda
 Administrative Challenges
 Package Management Overview & Demo
 Best Practices With IPS
 Looking Towards The Future

4. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.4
Administrative Challenges
 Manage more with less
 Lower operating costs
 Reduce complexity and avoid
error prone processes
 Avoid / constrain virtualization
sprawl
 Reduced planned and
unplanned system downtime
Preventing You From Focusing On Your Business

5. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.5
Image Packaging System (IPS)
 Seamless package and package
update management – no
separate patches anymore!
 Streamlined software delivery
through networked repositories
 Failsafe system updates
 Integrated with Oracle Solaris
Zones
A New Way To Manage Software In Oracle Solaris 11

6. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.6
ZFS Boot Environments
 Zero initial investment
 Easy to use, fast and reliable
 Fast reboot lowers planned and
unplanned maintenance windows
 Integrated with Oracle Solaris
Zones
Safety Net For Your Data Center Operations
Active BE
Active BE
New BE
Active BE
Updated BE

7. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.7
Failsafe System Update
Reduce Your Risk In Applying Critical Updates
6:00 Start UpdateMaintenance window
6-7pm
6:04 reboot
System up and
running again
New
Security
Update
6:01-6:02 New ZFS Boot
Environment created,
updates downloaded and
applied
6:00-6:01 Dependency
checks, update planning
– including virtualized
environments
Fail safe system update
Administrators can revert into an
older boot environment if
something goes wrong

8. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.8
Dr Martin Haller
System Management Director,
City of Nuremberg
“Updating is so easy that we’ve even
made the systems automatically
update every week”
TECHNOLOGY DIFFERENTIATORS
• IPS
• Oracle Solaris Zones
• Oracle Solaris Cluster
• Service Management Facility

9. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.9
Anonymous Customer
Solaris Community Advisory Board
“With Solaris 10, it took 2 months to roll out
a new patchset across the enterprise. With
Solaris 11, it takes 10 days.”
TECHNOLOGY DIFFERENTIATORS
• IPS
• ZFS Boot Environments

10. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.10
Demo Time

11. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.11
Best Practices With IPS #1
 Enforces best practice
 Kernel changes will automatically
create a new boot environment
 It doesn’t cost anything (disk or time)
 Can be used for every administrative
change – not just software updates!
Always Use ZFS Boot Environments

12. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.12
Support Repository Updates
 Consolidated update of bug fixes for
customers on Oracle Premier Support
 Issued on a monthly basis
 Incorporations constrain software to be
well tested by Oracle
 5 digit versioning scheme
– release.update.sru.build.respin
For example, Oracle Solaris 11.1.6.4.0
Applying Updates To Your System

13. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.13
Critical Patch Updates
 Every 3rd SRU is called an official
Oracle Critical Patch Update (CPU)
 Cumulative security fixes
 See My Oracle Support (MOS)
Document ID 1547593.1
Applying Updates To Your System

14. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.14
Interim Diagnostic Relief
 Fixes to provide point relief for, or help
further diagnoses of, critical issues
 Delivered using package archives
– Sync to a local repository if necessary
 Fixes get rolled into a future SRU release
 Must be within 24 months of latest release
 See MOS Document ID 1452392.1
Temporary Relief When You Need It

15. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.15
Best Practices With IPS #2
 Perform a dry run of your update to see
what will change
# pkg update -nv
 Don’t try to pick and choose what fixes
you want to apply from an SRU
– We do hundreds of hours of testing so
you don’t have to!
 Update your baseline with SRUs and
Oracle Solaris Updates regularly
Know What’s In Your SRU But Don’t Try To Be Clever

16. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.16
Best Practices With IPS #3
 When updating a system,
sometimes it is not obvious why
it won’t work
 Be more explicit about what
version of Oracle Solaris you are
trying to update to
E.g., Updating to Oracle Solaris 11.1.10.5.0
# pkg update entire@0.5.11-0.175.1.10.0.5.0
Troubleshooting A System Update

17. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.17
Best Practices With IPS #3
 Review the history of successful and
unsuccessful package operations
# pkg history -l
 Review any facets that have been locked
or unlocked
 Verify the contents of the repository you’re
updating from to make sure the package version
exists!
# pkg list -afpackagename
Troubleshooting A System Update

18. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.18
Oracle Hosted Package Repositories
 Oracle Solaris Release Repository
http://pkg.oracle.com/solaris/release
 Oracle Solaris Support Repository
https://pkg.oracle.com/solaris/support
 Oracle Solaris Repository Certificate Request
https://pkg-register.oracle.com
Ready For You To Connect Your Systems To, 24/7

19. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.19

20. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.20

21. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.21
Local Package Repositories
 Needed for network restricted
environments
 Better change control management
 Required if you’re applying IDRs to
Oracle Solaris Zones (using AI manifests)
 Sync directly from Oracle’s package
repositories or from ISO images
available in MOS
Typical Use Case For Most Customers

22. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.22
Best Practices With IPS #4
 Create separate repositories for dev, test, and prod
– One repository per ZFS dataset
 Construct the repository in two ways
– Use repository ISOs, but keep fully populated!
– Sync a complete repository using pkgrecv
 Use Apache proxies to consolidate the repository URLs
Proxypass /prod http://example.com:10080 nocanon max=200
Proxypass /test http://example.com:10081 nocanon max=200
Proxypass /dev http://example.com:10082 nocanon max=200
Use ZFS To Quickly Clone Repositories

23. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.23
Best Practices With IPS #4
 Use SSL enabled Apache for secure access to the repository
 Create a Certificate Authority (CA) - self sign or 3rd party
 Create client certificates
 Configure Apache
SSLEngine On
SSLCertificateFile /path/to/server.cert
SSLCertificateKeyFile /path/to/server.key
SSLCertificateChainFile /path/to/ca_intermediate.pem
SSLCertificateFile /path/to/certs/repo_cas.pem
Use ZFS To Quickly Clone Repositories

24. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.24
Package Publishing
 IPS contains a full suite of tools to
create and publish packages to a
repository – including best effort
conversion of SVR4 and tarballs
 Publish to package archives, p5p, if you
want disconnected operations
 Fully integrated into Automated Installer
provisioning environments
Provide A Better Management Lifecycle For Your In-House Applications

25. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.25
Best Practices With IPS #5
 Keep cloned repositories from
Oracle free of local customizations
 Don’t include system defined directories
in your manifests
 If delivering configuration changes, take
advantage of preserve and overlay
attributes on the file action
Create Separate Repositories For Republishing Content

26. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.26
Looking Towards The Future
 Simplified repository management
– Easy repository mirroring
– Apache serving packages without proxy
configuration
 Firmware dependencies
 Minimal server group package
 Intelligent release notes metadata
Some Projects Coming Down The Line

27. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.27
Looking Towards The Future
 Security package that includes CVE
metadata
 User images
 Remote administration (RAD) interfaces
 Ksplice – kernel hot fixes
Some Projects Coming Down The Line

28. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.28
Further Resources
 Oracle Technology Network
http://www.oracle.com/technetwork/server-
storage/solaris11/technologies/ips-323421.html
 Oracle Solaris 11 Product Documentation
http://docs.oracle.com/cd/E26502_01/index.html
 Oracle Solaris 11 Developer Documentation
http://docs.oracle.com/cd/E26502_01/html/E21383/index.html
 My Oracle Support (MOS) – Oracle Solaris 11 Support Center
Document ID 1559480.2
Where To Get More Information About IPS

29. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.29
More Oracle Solaris Events
 General Sessions
 Breakout Sessions
 Hands-on Labs
 Demos
http://bit.ly/OOW13-Solaris

30. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.30
Learn More
@ORCL_Solaris
facebook.com/oraclesolaris
Oracle Solaris Insider
blogs.oracle.com/solaris
youtube.com/oraclesolaris
oracle.com/solaris

31. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.31
Graphic Section Divider

32. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.32

33. Copyright© 2013, Oracle and/or its affiliates. All rights reserved.33