Page MenuHomePhabricator

Upgrade the MediaWiki servers to ICU 67
Closed, ResolvedPublic

Description

Note: this is a fallback task, written as more or less a verbatim copy of T264991 on grounds of doubts on the feasibility of the approach adopted in T263437 (see T329491#8895594).

Goal

In order to upgrade for all our MediaWiki clusters (including MW-on-K8s ) to Debian Bullseye, we need to upgrade the current Debian Buster installation to use ICU 67. The reason is that Debian ships Bullseye with version 67. This process requires all servers to be upgraded within a short period of time, and after that running the updateCollation.php script on all wikis with a non-standard collation.

Dependencies

Migration day TBD

The transition plan will roughly be as follows:

  • Rebuild related packages for stretch by linking them to libicu67 and add them to the component/icu67 repo
    • php7.4-bcmath
    • php7.4-bz2
    • php7.4-cli
    • php7.4-common
    • php7.4-curl
    • php7.4-dba
    • php7.4-fpm
    • php7.4-gd
    • php7.4-gmp
    • php7.4-intl
    • php7.4-json
    • php7.4-mbstring
    • php7.4-mysql
    • php7.4-opcache
    • php7.4-phpdbg
    • php7.4-readline
    • php7.4-xml
    • dh-php
    • libxml2
    • php-acpu
    • php-excimer
    • php-geoip
    • php-igbinary
    • php-imagick
    • php-luasandbox
    • php-memcached
    • php-msgpack
    • php-redis
    • php-wmerrors
    • tideways
    • wikidiff2

Process

  • Use a feature flag to enable component/icu67 in puppet
  • Build container base images containing the new packages (https://gerrit.wikimedia.org/r/954700)
  • Define a migration date - 2023-11-02
  • Notify the communities, with commrel's help
  • Test packages on mwdebug servers
  • Update packages on deployment-prep
  • On Migration day:
    • Upgrade to libicu67 everywhere
      • app, api, parsoid, jobrunners
      • snapshot hosts
      • kubernetes deploymens (scap sync-world --k8s-only -D full_image_build:true)
      • deploy hosts (can be done later)
    • Run foreachwikiindblist XX.dblist updateCollation.php --force on all wikis where it's needed (~10 days, this is the point of no return, **use screen/tmux)
      • foreachwikiindblist s1.dblist updateCollation.php --force
      • foreachwikiindblist s2.dblist updateCollation.php --force
      • foreachwikiindblist s3.dblist updateCollation.php --force
      • foreachwikiindblist s5.dblist updateCollation.php --force
      • foreachwikiindblist s6.dblist updateCollation.php --force
      • foreachwikiindblist s7.dblist updateCollation.php --force
  • Include the icu67 upgrade into the general php7.4 images / retag the php7.4-icu67 ones

Notes:
updateCollation.php needs to run for: s1, s2, s3, s5, s6, s7 (according to find_collations.py)

s1:
  enwiki
s2:
  cswiki fiwiki itwiki nlwiki nowiki plwiki ptwiki svwiki thwiki trwiki
s3:
  mediawikiwiki abwiki azwiki bawiki bawikibooks be_x_oldwiki bewiki bewikisource bnwiki bnwikisource bswiki bswiktionary ckbwiki cswiktionary cywiki cywikibooks cywikiquote cywikisource cywiktionary dewikisource eswikiversity etwiki etwikibooks etwikimedia etwikiquote etwikisource etwiktionary fawikisource fawiktionary fawikibooks fawikinews fawikiquote fiwikibooks fiwikimedia fiwikinews fiwikiquote fiwikisource fiwikiversity fiwikivoyage frwikibooks frwikinews frwikiversity gawiki gdwiki gewikimedia glwiki grwikimedia hewikisource hrwiki hsbwiki idwikimedia id_internalwikimedia ilowiki iswiki iswiktionary ltwiki lvwiki mkwiki napwikisource nnwiki nowikimedia olowiki plwikisource plwikivoyage plwiktionary ptwikibooks romdwikimedia rowikibooks rowikinews rowikiquote rowikisource rowikivoyage rowiktionary rswikimedia ruwikibooks ruwikinews ruwikiquote ruwikisource ruwikiversity ruwikivoyage ruwiktionary sewiki simplewiki slwiki slwikibooks slwikiquote slwikisource slwikiversity slwiktionary sqwiki sqwikibooks sqwikinews sqwikiquote srwikibooks srwikinews srwikiquote srwikisource srwiktionary skwiki svwikisource tawiki tawikibooks tawikinews tawikiquote tawikisource tawiktionary testwiki thwikibooks thwikinews thwikiquote thwikisource thwiktionary trwikiquote trwiktionary uawikimedia ukwikibooks ukwikinews ukwikiquote ukwikisource ukwikivoyage ukwiktionary viwikibooks viwikiquote viwikisource viwikivoyage viwiktionary wbwikimedia
s5:
  azwikimedia shwiki srwiki trwikivoyage
s6:
  frwiki ruwiki
s7:
  eswiki fawiki frwiktionary hewiki huwiki rowiki ukwiki viwiki

For updating app, api, parsoid, jobrunners, we 'll use this command. For updating snapshot* and deploy* we 'll make sure to remove packages that are not installed there.

cumin mwdebug1001* 'depool; sleep 1; run-puppet-agent -e "upgrading ICU67" ; apt-get -q update; 
export DEBIAN_FRONTEND=noninteractive; apt-get install $PACKAGES -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold"; systemctl
restart php7.4-fpm ; pool'

I've checked all binary packages in the icu67 component with sudo -i reprepro -C component/icu67 -A amd64 list buster-wikimedia | sed 's/.*amd64: //;s/ .*//' | grep -v '\-dbg' and checked if they are installed with cat icu67_packages.txt | while read pkg; do dpkg-query -W --showformat='${db:Status-Status}' "$pkg" 2>&1| grep ^installed -q && echo -n "$pkg "; done; echo

This looks like:

cloudweb1003.wikimedia.org:
libicu67 libxml2 php-common php-ldap php7.4-apcu php7.4-bcmath php7.4-bz2 php7.4-cli php7.4-common php7.4-curl php7.4-dba php7.4-excimer php7.4-fpm php7.4-gd php7.4-geoip php7.4-gmp php7.4-igbinary php7.4-intl php7.4-json php7.4-ldap php7.4-luasandbox php7.4-mbstring php7.4-memcached php7.4-msgpack php7.4-mysql php7.4-opcache php7.4-readline php7.4-redis php7.4-wikidiff2 php7.4-wmerrors php7.4-xml php7.4-yaml 

deploy1002.eqiad.wmnet:
libicu67 libxml2 php-common php-readline php7.4-apcu php7.4-bcmath php7.4-bz2 php7.4-cli php7.4-common php7.4-curl php7.4-dba php7.4-excimer php7.4-gd php7.4-geoip php7.4-gmp php7.4-igbinary php7.4-intl php7.4-json php7.4-luasandbox php7.4-mbstring php7.4-memcached php7.4-msgpack php7.4-mysql php7.4-opcache php7.4-readline php7.4-redis php7.4-wikidiff2 php7.4-xml php7.4-yaml 

dumpsdata1001.eqiad.wmnet:
libicu67 libxml2 

htmldumper1001.eqiad.wmnet:
libicu67 libxml2 

mw1414.eqiad.wmnet (appserver):
libicu67 libxml2 php-common php7.4-apcu php7.4-bcmath php7.4-bz2 php7.4-cli php7.4-common php7.4-curl php7.4-dba php7.4-excimer php7.4-fpm php7.4-gd php7.4-geoip php7.4-gmp php7.4-igbinary php7.4-intl php7.4-json php7.4-luasandbox php7.4-mbstring php7.4-memcached php7.4-msgpack php7.4-mysql php7.4-opcache php7.4-readline php7.4-redis php7.4-wikidiff2 php7.4-wmerrors php7.4-xml php7.4-yaml 

mw1437.eqiad.wmnet (jobrunner)
libicu67 libxml2 php-common php7.4-apcu php7.4-bcmath php7.4-bz2 php7.4-cli php7.4-common php7.4-curl php7.4-dba php7.4-excimer php7.4-fpm php7.4-gd php7.4-geoip php7.4-gmp php7.4-igbinary php7.4-intl php7.4-json php7.4-luasandbox php7.4-mbstring php7.4-memcached php7.4-msgpack php7.4-mysql php7.4-opcache php7.4-readline php7.4-redis php7.4-wikidiff2 php7.4-wmerrors php7.4-xml php7.4-yaml 

mwdebug1001.eqiad.wmnet:
libicu67 libxml2 php-common php7.4-apcu php7.4-bcmath php7.4-bz2 php7.4-cli php7.4-common php7.4-curl php7.4-dba php7.4-excimer php7.4-fpm php7.4-gd php7.4-geoip php7.4-gmp php7.4-igbinary php7.4-intl php7.4-json php7.4-luasandbox php7.4-mbstring php7.4-memcached php7.4-msgpack php7.4-mysql php7.4-opcache php7.4-phpdbg php7.4-readline php7.4-redis php7.4-tideways php7.4-wikidiff2 php7.4-wmerrors php7.4-xml php7.4-yaml 

mwmaint1002.eqiad.wmnet:
libicu67 libapache2-mod-php libapache2-mod-php7.4 libxml2 php-common php-readline php7.4-apcu php7.4-bcmath php7.4-bz2 php7.4-cli php7.4-common php7.4-curl php7.4-dba php7.4-excimer php7.4-fpm php7.4-gd php7.4-geoip php7.4-gmp php7.4-igbinary php7.4-intl php7.4-json php7.4-luasandbox php7.4-mbstring php7.4-memcached php7.4-msgpack php7.4-mysql php7.4-opcache php7.4-readline php7.4-redis php7.4-wikidiff2 php7.4-wmerrors php7.4-xml php7.4-yaml

snapshot1008.eqiad.wmnet:
libicu67 libxml2 php-common php7.4-apcu php7.4-bcmath php7.4-bz2 php7.4-cli php7.4-common php7.4-curl php7.4-dba php7.4-excimer php7.4-gd php7.4-geoip php7.4-gmp php7.4-igbinary php7.4-intl php7.4-json php7.4-luasandbox php7.4-mbstring php7.4-memcached php7.4-msgpack php7.4-mysql php7.4-opcache php7.4-readline php7.4-redis php7.4-wikidiff2 php7.4-xml php7.4-yaml

Details

SubjectRepoBranchLines +/-
operations/docker-images/production-imagesmaster+23 -257
operations/puppetproduction+5 -0
operations/puppetproduction+0 -2
operations/puppetproduction+3 -0
operations/puppetproduction+3 -0
operations/puppetproduction+21 -1
operations/puppetproduction+2 -0
operations/puppetproduction+4 -0
operations/docker-images/production-imagesmaster+7 -1
operations/docker-images/production-imagesmaster+12 -0
operations/puppetproduction+3 -1
operations/puppetproduction+2 -0
operations/puppetproduction+0 -26
operations/puppetproduction+11 -0
operations/puppetproduction+1 -1
operations/puppetproduction+2 -2
operations/puppetproduction+2 -2
operations/puppetproduction+2 -2
operations/puppetproduction+2 -2
operations/puppetproduction+2 -2
operations/puppetproduction+2 -2
operations/docker-images/production-imagesmaster+217 -0
Show related patches Customize query in gerrit

Event Timeline

Change 954656 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Add a Hiera option to enable ICU67 component

https://gerrit.wikimedia.org/r/954656

Change 954657 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Enable icu67 component on api canary hosts

https://gerrit.wikimedia.org/r/954657

Change 954658 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Enable icu67 component on appserver canary hosts

https://gerrit.wikimedia.org/r/954658

Change 954659 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Enable icu67 component on mwmaint hosts

https://gerrit.wikimedia.org/r/954659

Change 954660 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Enable icu67 component on deploy hosts

https://gerrit.wikimedia.org/r/954660

Change 954661 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Enable icu67 component on dumps hosts

https://gerrit.wikimedia.org/r/954661

Change 954662 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Enable icu67 component on cloudweb hosts

https://gerrit.wikimedia.org/r/954662

Change 954663 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Enable icu67 component on jobrunner hosts

https://gerrit.wikimedia.org/r/954663

Change 954664 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Enable icu67 component on parsoid hosts

https://gerrit.wikimedia.org/r/954664

Change 954665 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Enable icu67 component on api hosts

https://gerrit.wikimedia.org/r/954665

Change 954666 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/puppet@production] Enable icu67 component on appserver hosts

https://gerrit.wikimedia.org/r/954666

Change 954700 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/docker-images/production-images@master] Add temporary buster-based PHP7.4 icu67 images

https://gerrit.wikimedia.org/r/954700

Change 954700 merged by Alexandros Kosiaris:

[operations/docker-images/production-images@master] Add temporary buster-based PHP7.4 icu67 images

https://gerrit.wikimedia.org/r/954700

Change 968616 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[operations/puppet@production] Remove deprecated hiera keys from icu63 upgrade

https://gerrit.wikimedia.org/r/968616

JMeybohm updated the task description. (Show Details)

Change 968658 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[operations/puppet@production] Enable icu67 component on mwdebug1001

https://gerrit.wikimedia.org/r/968658

Change 954666 abandoned by JMeybohm:

[operations/puppet@production] Enable icu67 component on appserver hosts

Reason:

https://gerrit.wikimedia.org/r/954666

Change 954665 abandoned by JMeybohm:

[operations/puppet@production] Enable icu67 component on api hosts

Reason:

https://gerrit.wikimedia.org/r/954665

Change 954664 abandoned by JMeybohm:

[operations/puppet@production] Enable icu67 component on parsoid hosts

Reason:

https://gerrit.wikimedia.org/r/954664

Change 954663 abandoned by JMeybohm:

[operations/puppet@production] Enable icu67 component on jobrunner hosts

Reason:

https://gerrit.wikimedia.org/r/954663

Change 954662 abandoned by JMeybohm:

[operations/puppet@production] Enable icu67 component on cloudweb hosts

Reason:

https://gerrit.wikimedia.org/r/954662

Change 954660 abandoned by JMeybohm:

[operations/puppet@production] Enable icu67 component on deploy hosts

Reason:

https://gerrit.wikimedia.org/r/954660

Change 954658 abandoned by JMeybohm:

[operations/puppet@production] Enable icu67 component on appserver canary hosts

Reason:

https://gerrit.wikimedia.org/r/954658

Change 968660 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[operations/puppet@production] Revert "Enable icu67 component on mwdebug1001"

https://gerrit.wikimedia.org/r/968660

JMeybohm renamed this task from [Fallback Task] Upgrade the MediaWiki servers to ICU 67 to Upgrade the MediaWiki servers to ICU 67.Oct 25 2023, 1:44 PM
JMeybohm triaged this task as High priority.

Change 968993 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[operations/puppet@production] Enable icu67 component on deployment-prep

https://gerrit.wikimedia.org/r/968993

Change 968616 merged by JMeybohm:

[operations/puppet@production] Remove deprecated hiera keys from icu63 upgrade

https://gerrit.wikimedia.org/r/968616

Change 954656 merged by JMeybohm:

[operations/puppet@production] Add a Hiera option to enable ICU67 component

https://gerrit.wikimedia.org/r/954656

Change 968993 merged by JMeybohm:

[operations/puppet@production] Enable icu67 component on deployment-prep

https://gerrit.wikimedia.org/r/968993

libxml2 got a sec update after the packages have been build against icu67 so we need to include that before we can update deployment-prep. @MoritzMuehlenhoff will take care of that, thanks!

Mentioned in SAL (#wikimedia-operations) [2023-10-27T08:49:49Z] <moritzm> uploaded libxml2 2.9.4+dfsg1-7+deb10u6+icu67+wmf1 to component/icu67 for buster-wikimedia (rebase of the ICU compat patches on top of the latest buster security update for libxml2) T345561

Change 968658 merged by JMeybohm:

[operations/puppet@production] Enable icu67 component on mwdebug1001

https://gerrit.wikimedia.org/r/968658

Mentioned in SAL (#wikimedia-operations) [2023-10-27T12:41:45Z] <jayme> updated mwdebug1001 to icu67 - T345561

Change 971057 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[operations/docker-images/production-images@master] Rebuild php icu67 images to include libxml2 sec updates

https://gerrit.wikimedia.org/r/971057

Change 971058 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[operations/docker-images/production-images@master] php7.4-fpm-multiversion-base: Switch to icu67

https://gerrit.wikimedia.org/r/971058

Change 971057 merged by JMeybohm:

[operations/docker-images/production-images@master] Rebuild php icu67 images to include libxml2 sec updates

https://gerrit.wikimedia.org/r/971057

Change 971058 merged by JMeybohm:

[operations/docker-images/production-images@master] php7.4-fpm-multiversion-base: Switch to icu67

https://gerrit.wikimedia.org/r/971058

Mentioned in SAL (#wikimedia-operations) [2023-11-02T09:13:21Z] <jayme> published image php7.4-fpm-multiversion-base:7.4.33-6 now based on icu67 php packages - T345561

Change 954659 merged by JMeybohm:

[operations/puppet@production] Enable icu67 component on mwmaint hosts

https://gerrit.wikimedia.org/r/954659

Change 954657 merged by JMeybohm:

[operations/puppet@production] Enable icu67 component on canary hosts

https://gerrit.wikimedia.org/r/954657

Change 954661 merged by JMeybohm:

[operations/puppet@production] Enable icu67 fleet wide

https://gerrit.wikimedia.org/r/954661

Mentioned in SAL (#wikimedia-operations) [2023-11-02T12:31:42Z] <moritzm> upgrading cloudweb to ICU67 T345561

Mentioned in SAL (#wikimedia-operations) [2023-11-02T12:38:06Z] <moritzm> upgrading snapshot* to ICU67 T345561

Mentioned in SAL (#wikimedia-operations) [2023-11-02T12:46:36Z] <jayme> running fleet wide php upgrades - T345561

Mentioned in SAL (#wikimedia-operations) [2023-11-02T12:59:34Z] <moritzm> upgrading deployment servers to ICU67 T345561

Change 971189 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Also enable icu67 on cloudweb/codfw1dev

https://gerrit.wikimedia.org/r/971189

Change 971189 merged by Muehlenhoff:

[operations/puppet@production] Also enable icu67 on cloudweb/codfw1dev

https://gerrit.wikimedia.org/r/971189

Change 971191 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Enable icu67 for parsoid::testing

https://gerrit.wikimedia.org/r/971191

Change 971191 merged by Muehlenhoff:

[operations/puppet@production] Enable icu67 for parsoid::testing

https://gerrit.wikimedia.org/r/971191

Change 971195 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] profile::ci::php Also add the icu67 component following what was done for prod

https://gerrit.wikimedia.org/r/971195

Change 971223 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[operations/docker-images/production-images@master] Build php7.4 images with icu67 packages

https://gerrit.wikimedia.org/r/971223

Change 968660 merged by JMeybohm:

[operations/puppet@production] Revert "Enable icu67 component on mwdebug1001"

https://gerrit.wikimedia.org/r/968660

Change 971195 merged by Muehlenhoff:

[operations/puppet@production] profile::ci::php Also add the icu67 component following what was done for prod

https://gerrit.wikimedia.org/r/971195

Change 971223 merged by JMeybohm:

[operations/docker-images/production-images@master] Build php7.4 images with icu67 packages

https://gerrit.wikimedia.org/r/971223

JMeybohm updated the task description. (Show Details)

updateCollation.php has finished for all relevant wikis, resolving this