Google Git
Sign in
cos / cos / policymanager / e9161eed875c62694f9048c679b307e027e465b4
commite9161eed875c62694f9048c679b307e027e465b4[log] [tgz]
authorKevin Berry <kpberry@google.com>Wed Jun 12 21:12:58 2024 +0000
committerKevin Berry <kpberry@google.com>Mon Jun 17 22:21:31 2024 +0000
treefce468cb227ab6e6bea637ccccbef008f2adc179
parentced11018ce3ebba204df98c8f3c9737709e8cbbe [diff]
policymanager: Disable auto update by default

Automatic updates are now enabled only if cos-update-strategy is set to
"update_enabled". Any other value will cause auto updates to be
disabled. Additionally, a warning is logged if cos-update-strategy is
set to any value other than "update_enabled", "update_disabled", or "".

BUG=b/343532247
TEST=presubmit, `FEATURES=test emerge-lakitu policymanager`
RELEASE_NOTE=Disabled default automatic updates. Automatic updates must
now be explicitly enabled by setting the cos-update-strategy metadata
to "update_enabled".

Change-Id: Ib82f88851027d65caadae0e460bb991644d18188
6 files changed
tree: fce468cb227ab6e6bea637ccccbef008f2adc179
  1. cmd/
  2. pkg/
  3. protos/
  4. third_party/
  5. .gitignore
  6. CONTRIBUTING.md
  7. gen_proto.sh
  8. go.mod
  9. go.sum
  10. LICENSE
  11. main.go
  12. OWNERS
  13. PRESUBMIT.cfg
  14. README.md
README.md

Policy Manager for COS(Container-Optimized OS) Image

Overview

Policy Manager is the client for the COS control plane. It is responsible for reporting current instance status and fetching device update config.

It is designed to be a system daemon that's started immediately after boot. It sends status update to an update manager, which will respond with the appropriate update config.

Using the update config, it will generate the appropriate update policy blobs to enforce the update strategy set by the user.

How to run

  • Policy Manager must be run with root privileges in order to access update_engine status and control device policy.
  • It continuously reports status and fetches update policy from metadata server under monitor mode.

What's up with update [policy, strategy, config]?

Part of Policy Manager's features is to allow users to control the OS update behavior of their COS instances.

Instances will only receive updates within their major release version. For example, if both 12.1.0 and 13.0.0 are available, an instance running 12.0.0 will only get updated to 12.1.0 if it has this strategy.

The actual enforcement of the strategies are done by the update policy, which is a Chrome OS feature. An update policy is a protobuf blob that contains the parameters that will be used to fetch updates from Omaha. Policy Manager is responsible for deciding when to enable or disable the update engine.

Building

  • To build and test Policy Manager, please run FEATURES=test emerge-lakitu policymanager

Protobufs

  • To compile protobuf definitions, run ./gen_proto.sh.
  • Do NOT submit the generated protobufs into the repo.