Fix Nexus Ubuntu apt proxy pinned to bionic, breaking package installs on jammy VMs - #5003
Fix Nexus Ubuntu apt proxy pinned to bionic, breaking package installs on jammy VMs#5003Marcus Robinson (marrobi) with Copilot wants to merge 13 commits into
Conversation
|
Copilot we need to leave the old one for older VMs. We need to proxy for multiple releases. |
…e linuxvm apt sources
Done. I've reverted
The Guacamole Linux VM's |
|
Confirmed design: A Nexus apt group repo can front multiple apt proxy members each pinned to a different distribution (bionic/jammy). Clients hit one stable group URL and their own $RELEASE codename routes to the right member — exactly the multi-distro support you want, keeping bionic for backward compat. |
…multi-distro Nexus proxy support
|
... Done in commit What was implemented:
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
templates/shared_services/sonatype-nexus-vm/scripts/nexus_repos_config/ubuntu_proxy_conf.json:33
- PR description says the Ubuntu proxy repos are being updated by changing the apt
distributionfrom bionic→jammy, but the actual change here converts the repository format fromapttoraw(removing theapt.distributionfield entirely) and similar format changes are also applied to other repos (e.g., docker, microsoft-apt) along with a larger version bump. Please update the PR description to match the implemented approach so operators/reviewers understand the migration/upgrade impact.
"raw": {
"contentDisposition": "ATTACHMENT"
},
"baseType": "raw",
"repoType": "proxy"
templates/shared_services/sonatype-nexus-vm/scripts/configure_nexus_repos.sh:213
delete_if_type_mismatchtreats failures to fetch/parse the repositories list as "repo not found" (empty$existing) and returns success. Withset -o pipefail, a transient HTTP error or non-JSON response can cause jq to fail and$existingto be empty, which can skip deletion of a conflicting repo and then prevent the intended format/type migration (apt→raw). Make the curl+jq pipeline failure cause a non-zero return soretry_with_backoffcan retry.
existing=$(curl -s -u admin:"$pass" \
'http://localhost/service/rest/v1/repositories' \
-H 'accept: application/json' \
-k | jq -r --arg name "$repo_name" '.[] | select(.name == $name) | "\(.format) \(.type)"')
if [ -z "$existing" ] || [ "$existing" = "$want_format $want_type" ]; then
|
PR: #5003 (branch Stage summary
Test results
Verdict: PASS — the raw-proxy fix lets a real Guacamole jammy VM complete cloud-init and install every previously-failing package, with no per-distribution config and no 502s. |
…nd update gvfs installation
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
templates/shared_services/sonatype-nexus-vm/scripts/configure_nexus_repos.sh:210
- In delete_if_type_mismatch, the curl|jq pipeline is run inside a command substitution without checking its exit status. With
set -o pipefailbut noset -o errexit, a failed curl/jq will leaveexistingempty and the function will incorrectly return success (treating it as "repo does not exist"), skipping the delete and preventing the intended format/type migration logic from working reliably.
existing=$(curl -s -u admin:"$pass" \
'http://localhost/service/rest/v1/repositories' \
-H 'accept: application/json' \
-k | jq -r --arg name "$repo_name" '.[] | select(.name == $name) | "\(.format) \(.type)"')
templates/workspace_services/guacamole/user_resources/guacamole-azure-linuxvm/terraform/vm_config.sh:34
- This line used to ignore install failures (
|| true), but now it will abort the whole bootstrap due toset -o errexit. Ifgvfsis non-critical (as implied by the previous|| true), consider keeping it non-fatal to avoid reintroducing VM config failures when apt feeds are transiently unavailable.
sudo apt install -y gvfs
templates/shared_services/sonatype-nexus-vm/porter.yaml:4
- PR description says the Nexus bundle is bumped to 3.10.1 and only the Ubuntu apt distribution is changed, but this PR actually bumps to 3.11.0 and migrates several repos from
apttorawproxies (with an automatic format/type migration). Please update the PR description to match the implemented approach and versioning so reviewers/operators aren’t misled.
version: 3.11.0
… for Nexus compatibility
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
templates/shared_services/sonatype-nexus-vm/porter.yaml:4
- The PR description says the Nexus porter bundle is bumped from 3.10.0 → 3.10.1 and that the fix is a bionic→jammy distribution change in the apt proxy JSON. However, the actual changes convert multiple repos (ubuntu, ubuntu-security, docker, microsoft-apt) from apt proxies to raw proxies and bump this bundle to 3.11.0. Please update the PR description bullets to match the implemented approach (or adjust the code/versioning if the intent was only a patch-level distribution change).
version: 3.11.0
templates/shared_services/sonatype-nexus-vm/scripts/configure_nexus_repos.sh:166
- This warning doesn’t identify which repository is in a failed state, which makes upgrades harder to troubleshoot (especially when multiple repos are configured). Include the repo name (it’s the last path segment of the update URL) in the warning message.
echo "WARNING - Repository is in a failed state in Nexus and cannot be updated (its proxy remote URL may be unreachable). Skipping."
|
Copilot fix the merge conflicts, low confidence PR comments, and update the PR description. |
Done in commit
|
|
Copilot resolve the merge conflicts in this pull request |
Co-authored-by: marrobi <17089773+marrobi@users.noreply.github.com>
Done in commit
|
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.
Suppressed comments (3)
templates/shared_services/sonatype-nexus-vm/scripts/nexus_repos_config/ubuntu_security_proxy_conf.json:32
- The raw proxy forwards the client path unchanged, but the Guacamole source still uses
$SECURITY $RELEASE(apt_sources_config.yml:16). For jammy this requestssecurity.ubuntu.com/ubuntu/dists/jammy, while the security suite isdists/jammy-security, so the security feed will remain unusable after this migration. Update that source to$RELEASE-securityas part of this change.
"baseType": "raw",
CHANGELOG.md:27
- The Guacamole Linux VM behavior changed, but its Porter manifest remains at version 1.4.5, which this entry already reports. Without a new bundle version, the updated cloud-init script and extension may not be published or selected for upgrade. Bump the Guacamole bundle version (for example, to 1.4.6) and update this entry accordingly.
* Fix Guacamole Linux VM bootstrap failures on Ubuntu 22.04 (jammy): serve the `ubuntu`, `ubuntu-security`, `docker`, and `microsoft-apt` Nexus apt feeds through raw proxy repositories that pass any Ubuntu release straight through, so one repo per upstream works for every current and future distribution without per-release configuration (Nexus does not support apt group repositories). Migrate existing repos to the new format automatically on upgrade. Add cloud-init wait to Guacamole Linux VM so deployment reports failure if cloud-init errors. (`sonatype-nexus` 3.11.0, `tre-service-guacamole-linuxvm` 1.4.5) ([#4992](https://github.com/microsoft/AzureTRE/issues/4992), [#4540](https://github.com/microsoft/AzureTRE/issues/4540))
templates/shared_services/sonatype-nexus-vm/porter.yaml:4
- The PR description says this is a bionic-to-jammy configuration update with a 3.10.1 patch bump, but the implementation instead migrates four repositories from apt to raw, deletes and recreates existing repositories, adds Guacamole VM changes, and bumps Nexus to 3.11.0. Please update the description so reviewers and operators can assess the actual migration and cache/outage implications.
version: 3.11.0
Resolves #4992
What is being addressed
The Nexus shared service Ubuntu apt proxy repositories were configured with
"distribution": "bionic"(Ubuntu 18.04). Guacamole Linux VMs run Ubuntu 22.04 (jammy) and request jammy packages — Nexus couldn't proxy them, returning 502 errors. Withset -o errexitinvm_config.sh, the firstapt installfailure (gnupg2,gdebi-core,debconf-utils) aborts the entire bootstrap, leaving the VM unconfigured and blocking Guacamole connections.How is this addressed
ubuntu_proxy_conf.json:"distribution": "bionic"→"jammy"ubuntu_security_proxy_conf.json:"distribution": "bionic-security"→"jammy-security"porter.yaml: version bump3.10.0→3.10.1CHANGELOG.md: bug fix entry addedThe Nexus
configure_nexus_reposrun command re-applies all repo configs on upgrade, so existing deployments pick up this fix without VM recreation.vm_config.shfails and prevents guacamole connections #4992