diff --git a/CHANGELOG.md b/CHANGELOG.md index 50e43e4..30ebc5a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [1.0.0] - 2026-06-15 + +### Added + +- Introduced top-level documentation sections for: + - `client` + - `server` + - `support` + - `release-notes` + - `contribute` +- Added release notes pages for client and server documentation. +- Added contribution and AI usage policy guidance in `docs/contribute/index.md`. + +### Changed + +- Refactored the documentation structure from legacy `livepatch*` paths to `client/` and `server/` spaces. +- Introduced a third-level Diátaxis-style organization in key areas (for example: `architecture`, `security`, `troubleshooting`, `configuration`, `installation`, `operations`, and `patch-management`). +- Standardized MyST heading IDs to the new path-based naming convention and updated in-page/cross-page anchor usages accordingly. +- Normalized toctree entries to explicit titled form (for example: `Installation `). + +### Fixed + +- Expanded `docs/redirects.txt` to preserve old URLs across the restructure, including legacy `livepatch/`, `livepatch_on_prem/`, and `livepatch_server_on_public_clouds/` paths. +- Added missing redirects from moved client explanation pages to `support/` pages. +- Removed shell prompt prefixes (`$`) from fenced command examples for consistency and copy/paste usability. + ## [0.2.0] - 2026-06-11 ### Added diff --git a/README.md b/README.md index e512fa4..b8cb991 100644 --- a/README.md +++ b/README.md @@ -9,8 +9,7 @@ Livepatch shrinks the exploit window for critical and high severity Linux kernel Documentation for: - Livepatch Client -- Livepatch On-Prem Server -- Livepatch Server on public clouds +- Livepatch Server ## Useful links diff --git a/docs/livepatch/reference/content-caching.md b/docs/client/explanation/architecture/content-caching.md similarity index 97% rename from docs/livepatch/reference/content-caching.md rename to docs/client/explanation/architecture/content-caching.md index 656c06a..76b9d62 100644 --- a/docs/livepatch/reference/content-caching.md +++ b/docs/client/explanation/architecture/content-caching.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-reference-content-caching)= +(client-reference-content-caching)= # Content Caching diff --git a/docs/livepatch/explanation/how-livepatching-works.md b/docs/client/explanation/architecture/how-livepatching-works.md similarity index 96% rename from docs/livepatch/explanation/how-livepatching-works.md rename to docs/client/explanation/architecture/how-livepatching-works.md index 8ac5908..cceb76d 100644 --- a/docs/livepatch/explanation/how-livepatching-works.md +++ b/docs/client/explanation/architecture/how-livepatching-works.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-how-kernel-livepatching-works)= +(client-explanation-how-kernel-livepatching-works)= # How kernel Livepatching works? diff --git a/docs/client/explanation/architecture/index.md b/docs/client/explanation/architecture/index.md new file mode 100644 index 0000000..e25586a --- /dev/null +++ b/docs/client/explanation/architecture/index.md @@ -0,0 +1,34 @@ +--- +myst: + html_meta: + description: "How Livepatching works and what kind of updates it provides." +--- + + +(client-explanation-architecture)= + +# Architecture + +How Livepatching works and what kind of updates it provides. + +## In this section + +- [How Livepatching works?](/client/explanation/architecture/how-livepatching-works.md) +- [What kind of updates are provided by Livepatch?](/client/explanation/architecture/what-kind-of-updates-are-provided-by-livepatch.md) +- [What kind of updates are not provided by Livepatch?](/client/explanation/architecture/what-kind-of-updates-are-not-provided-by-livepatch.md) +- [What are Livepatch tiers?](/client/explanation/architecture/what-are-livepatch-tiers.md) +- [When should I expect new updates?](/client/explanation/architecture/when-should-i-expect-new-updates.md) +- [Content Caching](/client/explanation/architecture/content-caching.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +How livepatching works +What kind of updates are provided by livepatch +What kind of updates are not provided by livepatch +What are livepatch tiers +When should i expect new updates +Content Caching +``` diff --git a/docs/livepatch/explanation/what-are-livepatch-tiers.md b/docs/client/explanation/architecture/what-are-livepatch-tiers.md similarity index 92% rename from docs/livepatch/explanation/what-are-livepatch-tiers.md rename to docs/client/explanation/architecture/what-are-livepatch-tiers.md index b73d592..ce35009 100644 --- a/docs/livepatch/explanation/what-are-livepatch-tiers.md +++ b/docs/client/explanation/architecture/what-are-livepatch-tiers.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-what-are-livepatch-tiers)= +(client-explanation-what-are-livepatch-tiers)= # What are Livepatch tiers? @@ -20,4 +20,4 @@ Livepatch delivers patches to “tiers”. A tier is a target audience for the d Our kernel team closely monitors the patch health within internal before promoting to updates and further monitoring is done before promoting the patch to stable. -For finer-grained control over patch roll-out take a look at [Livepatch On-Prem](/livepatch_on_prem/index.md). +For finer-grained control over patch roll-out take a look at [Livepatch On-Prem](/server/index.md). diff --git a/docs/livepatch/explanation/what-kind-of-updates-are-not-provided-by-livepatch.md b/docs/client/explanation/architecture/what-kind-of-updates-are-not-provided-by-livepatch.md similarity index 93% rename from docs/livepatch/explanation/what-kind-of-updates-are-not-provided-by-livepatch.md rename to docs/client/explanation/architecture/what-kind-of-updates-are-not-provided-by-livepatch.md index f8ff833..2e11d4e 100644 --- a/docs/livepatch/explanation/what-kind-of-updates-are-not-provided-by-livepatch.md +++ b/docs/client/explanation/architecture/what-kind-of-updates-are-not-provided-by-livepatch.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-what-kind-of-updates-are-not-provided-by-the-livepatch-service)= +(client-explanation-what-kind-of-updates-are-not-provided-by-the-livepatch-service)= # What kind of updates are not provided by the Livepatch service? diff --git a/docs/livepatch/explanation/what-kind-of-updates-are-provided-by-livepatch.md b/docs/client/explanation/architecture/what-kind-of-updates-are-provided-by-livepatch.md similarity index 91% rename from docs/livepatch/explanation/what-kind-of-updates-are-provided-by-livepatch.md rename to docs/client/explanation/architecture/what-kind-of-updates-are-provided-by-livepatch.md index 617eefe..f1e49be 100644 --- a/docs/livepatch/explanation/what-kind-of-updates-are-provided-by-livepatch.md +++ b/docs/client/explanation/architecture/what-kind-of-updates-are-provided-by-livepatch.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-what-kind-of-updates-will-be-provided-by-the-ubuntu-livepatch-service)= +(client-explanation-what-kind-of-updates-will-be-provided-by-the-ubuntu-livepatch-service)= # What kind of updates will be provided by the Ubuntu Livepatch Service? diff --git a/docs/livepatch/explanation/when-should-i-expect-new-updates.md b/docs/client/explanation/architecture/when-should-i-expect-new-updates.md similarity index 96% rename from docs/livepatch/explanation/when-should-i-expect-new-updates.md rename to docs/client/explanation/architecture/when-should-i-expect-new-updates.md index 56a6dbf..7281b93 100644 --- a/docs/livepatch/explanation/when-should-i-expect-new-updates.md +++ b/docs/client/explanation/architecture/when-should-i-expect-new-updates.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-when-should-i-expect-new-updates)= +(client-explanation-when-should-i-expect-new-updates)= # When should I expect new updates?? diff --git a/docs/client/explanation/index.md b/docs/client/explanation/index.md new file mode 100644 index 0000000..98169e5 --- /dev/null +++ b/docs/client/explanation/index.md @@ -0,0 +1,30 @@ +--- +myst: + html_meta: + description: "Explanation - learn about this topic in Livepatch client." +--- + + +(client-explanation)= + +# Explanation + +Discussion and clarification of key topics related to Livepatch. + +## In this section + +- [Architecture](/client/explanation/architecture/index.md) — How Livepatching works and what kind of updates it provides. +- [Security](/client/explanation/security/index.md) — How CVEs are rated and how Livepatch keeps systems secure. +- [Patches](/client/explanation/patches/index.md) — How patches are installed and their lifecycle. +- [Troubleshooting](/client/explanation/troubleshooting/index.md) — Diagnose and understand Livepatch client issues. + +```{toctree} +:titlesonly: +:maxdepth: 2 +:hidden: + +Architecture +Security +Patches +Troubleshooting +``` diff --git a/docs/client/explanation/patches/index.md b/docs/client/explanation/patches/index.md new file mode 100644 index 0000000..eefb674 --- /dev/null +++ b/docs/client/explanation/patches/index.md @@ -0,0 +1,28 @@ +--- +myst: + html_meta: + description: "How patches are installed, their lifecycle, and security considerations." +--- + + +(client-explanation-patches)= + +# Patches + +How patches are installed, their lifecycle, and security considerations. + +## In this section + +- [Patch Lifecycle: From CVE to Client Machines](/client/explanation/patches/patch-lifecycle.md) +- [Patch Installation](/client/explanation/patches/patch-installation.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Patch Lifecycle +Patch Installation +``` + + diff --git a/docs/livepatch/reference/patch-installation.md b/docs/client/explanation/patches/patch-installation.md similarity index 97% rename from docs/livepatch/reference/patch-installation.md rename to docs/client/explanation/patches/patch-installation.md index 310e708..9c565d7 100644 --- a/docs/livepatch/reference/patch-installation.md +++ b/docs/client/explanation/patches/patch-installation.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-reference-patch-installation)= +(client-explanation-patches-patch-installation)= # Patch Installation diff --git a/docs/livepatch/reference/patch-lifecycle.md b/docs/client/explanation/patches/patch-lifecycle.md similarity index 92% rename from docs/livepatch/reference/patch-lifecycle.md rename to docs/client/explanation/patches/patch-lifecycle.md index dabeafe..6cf63b5 100644 --- a/docs/livepatch/reference/patch-lifecycle.md +++ b/docs/client/explanation/patches/patch-lifecycle.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-reference-patch-lifecycle-from-cve-to-client-machines)= +(client-explanation-patches-patch-lifecycle-from-cve-to-client-machines)= # Patch Lifecycle: From CVE to Client Machines @@ -28,17 +28,17 @@ Upon successful testing internally, patches are released in phases to the update Once the livepatch for a kernel has been released for use, the Livepatch client downloads the patch from the configured Livepatch server and patch source. The downloaded payload consists of the Linux kernel module responsible for patching the running kernel, as well as some metadata. The Livepatch client then inserts the kernel module by making the appropriate syscall. This only affects the in-memory kernel code and not the installed kernel. -The Livepatch client is also equipped with mechanisms to prevent crash loops on installation of a faulty livepatch. For more information on patch installation and preventing crash loops, see [Patch Installation reference](/livepatch/reference/patch-installation.md) +The Livepatch client is also equipped with mechanisms to prevent crash loops on installation of a faulty livepatch. For more information on patch installation and preventing crash loops, see [Patch Installation reference](/client/explanation/patches/patch-installation.md) ## Livepatch Security Ensuring the secure transmission and application of a livepatch is paramount to maintaining kernel stability and preventing installation of malicious kernel modules. The Livepatch client ensures that installed livepatches are genuine and authentic before applying them to the kernel. This is achieved by verifying the livepatch content using SHA256 file checksums, verifying the digital signature for the livepatch kernel module using asymmetric encryption and using TLS to communicate with the hosted Canonical Livepatch server. -For more information on how the security of livepatches is ensured, see [Patch Security reference.](/livepatch/reference/patch-security.md) +For more information on how the security of livepatches is ensured, see [Patch Security reference.](/client/reference/patches/patch-security.md) ## Livepatch Monitoring and Blocklisting on faulty patches -In order to [avoid crash loops after application of a faulty livepatch](/livepatch/reference/patch-installation.md), Livepatch client monitors the health of the machine before, during, and after the patching activity. The various phases of Livepatch client's activity include: patch download, patch insertion, patch transition, and patch application. +In order to [avoid crash loops after application of a faulty livepatch](/client/explanation/patches/patch-installation.md), Livepatch client monitors the health of the machine before, during, and after the patching activity. The various phases of Livepatch client's activity include: patch download, patch insertion, patch transition, and patch application. Livepatch client transmits pings which contain data about patching activity to Livepatch server. These pings are anonymous and are only used to understand the health and status of machines during the insertion process and after the application process. @@ -51,3 +51,6 @@ If the system is on kernel version 4.4 or earlier, due to older kernel interface After a livepatch module is applied, the Livepatch client sends multiple health pings to the hosted Canonical Livepatch server. The first ping will have the time spent waiting for the kernel to apply the livepatch module (if running a kernel later than version 4.4), Then the client sends 3 more health pings from 1 minute, 5 minutes and 15 minutes from the time the kernel applied the livepatch module. If Livepatch client is retrieving patches from livepatch.canonical.com, the reported metrics are monitored by Canonical's Livepatch team. In the unlikely event that Livepatch client is reporting an error across a significant number of machines, the Livepatch team performs further analysis, and considers halting distribution (blocklisting) of the patch in question. Once a patch has been blocklisted, it will no longer be distributed to new clients or applied in the client machines that already possess the blocklisted patch. + + + diff --git a/docs/livepatch/explanation/how-cves-are-rated.md b/docs/client/explanation/security/how-cves-are-rated.md similarity index 97% rename from docs/livepatch/explanation/how-cves-are-rated.md rename to docs/client/explanation/security/how-cves-are-rated.md index c1a4f1c..ffc1b9e 100644 --- a/docs/livepatch/explanation/how-cves-are-rated.md +++ b/docs/client/explanation/security/how-cves-are-rated.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-how-do-you-rate-a-cve)= +(client-explanation-how-do-you-rate-a-cve)= # How do you rate a CVE? diff --git a/docs/client/explanation/security/index.md b/docs/client/explanation/security/index.md new file mode 100644 index 0000000..4e3a4c0 --- /dev/null +++ b/docs/client/explanation/security/index.md @@ -0,0 +1,30 @@ +--- +myst: + html_meta: + description: "How CVEs are rated and how Livepatch keeps systems secure." +--- + + +(client-explanation-security)= + +# Security + +How CVEs are rated and how Livepatch keeps systems secure. + +## In this section + +- [How CVEs are rated?](/client/explanation/security/how-cves-are-rated.md) +- [Security Overview](/client/explanation/security/security-overview.md) +- [Security Lifecycle](/client/explanation/security/security-lifecycle.md) +- [Livepatch security notices](/client/explanation/security/livepatch-security-notices.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +How cves are rated +Security overview +Security lifecycle +Livepatch security notices +``` diff --git a/docs/livepatch/explanation/livepatch-security-notices.md b/docs/client/explanation/security/livepatch-security-notices.md similarity index 94% rename from docs/livepatch/explanation/livepatch-security-notices.md rename to docs/client/explanation/security/livepatch-security-notices.md index 883b38a..10ebf08 100644 --- a/docs/livepatch/explanation/livepatch-security-notices.md +++ b/docs/client/explanation/security/livepatch-security-notices.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-livepatch-security-notices)= +(client-explanation-livepatch-security-notices)= # Livepatch security notices diff --git a/docs/livepatch/explanation/security-lifecycle.md b/docs/client/explanation/security/security-lifecycle.md similarity index 97% rename from docs/livepatch/explanation/security-lifecycle.md rename to docs/client/explanation/security/security-lifecycle.md index a347711..f99d9b3 100644 --- a/docs/livepatch/explanation/security-lifecycle.md +++ b/docs/client/explanation/security/security-lifecycle.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-livepatch-client-security-lifecycle)= +(client-explanation-livepatch-client-security-lifecycle)= # Livepatch Client Security Lifecycle diff --git a/docs/livepatch/explanation/security-overview.md b/docs/client/explanation/security/security-overview.md similarity index 56% rename from docs/livepatch/explanation/security-overview.md rename to docs/client/explanation/security/security-overview.md index a287a75..f235856 100644 --- a/docs/livepatch/explanation/security-overview.md +++ b/docs/client/explanation/security/security-overview.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-security-overview)= +(client-explanation-security-overview)= # Security Overview @@ -15,11 +15,11 @@ This document provides an overview of the security features and practices implem The Livepatch client incorporates several mechanisms to ensure the integrity and authenticity of patches and the security of communication: -- **Patch Verification**: Patches undergo a verification process using SHA256 checksums to ensure file integrity upon download. For more details, refer to the [Cryptographic Documentation](/livepatch/reference/patch-security.md). +- **Patch Verification**: Patches undergo a verification process using SHA256 checksums to ensure file integrity upon download. For more details, refer to the [Cryptographic Documentation](/client/reference/patches/patch-security.md). -- **Patch Signatures**: All Linux kernel modules distributed as part of patches are cryptographically signed by Canonical using SHA512 with RSA. This verifies their authenticity and prevents the installation of malicious patches. Further information can be found in the [Cryptographic Documentation](/livepatch/reference/patch-security.md). +- **Patch Signatures**: All Linux kernel modules distributed as part of patches are cryptographically signed by Canonical using SHA512 with RSA. This verifies their authenticity and prevents the installation of malicious patches. Further information can be found in the [Cryptographic Documentation](/client/reference/patches/patch-security.md). -- **TLS Communication**: The Livepatch client uses HTTPS and relies on TLS v1.2 or higher for secure communication with the Livepatch server, utilizing host machine CA certificates and additional fixed certificates for server authentication. Details on TLS communication are available in the [Cryptographic Documentation](/livepatch/reference/patch-security.md). +- **TLS Communication**: The Livepatch client uses HTTPS and relies on TLS v1.2 or higher for secure communication with the Livepatch server, utilizing host machine CA certificates and additional fixed certificates for server authentication. Details on TLS communication are available in the [Cryptographic Documentation](/client/reference/patches/patch-security.md). ## Risks @@ -27,18 +27,18 @@ While the Livepatch client is designed with security in mind, it is important to - **TLS Enforcement (On-premises deployments)**: Although the Canonical hosted Livepatch server redirects HTTP to HTTPS, there is no client-side enforcement for TLS usage in on-premises deployments. Forgoing TLS in such scenarios is not recommended due to security implications. -- **Privileged access to Auth Tokens**: Authentication for the Livepatch Client, with the Livepatch Server, can be established using [Auth Tokens](/livepatch_on_prem/reference/authentication.md#client-apis) or [Resource Tokens](/livepatch_on_prem/reference/authentication.md#client-apis). After successful client registration, a machine token is issued to the Livepatch client which can be used for subsequent authentication. Privileged access to this token must be controlled to prevent usage by a malicious third-party. +- **Privileged access to Auth Tokens**: Authentication for the Livepatch Client, with the Livepatch Server, can be established using [Auth Tokens](/server/reference/authentication/authentication.md#client-apis) or [Resource Tokens](/server/reference/authentication/authentication.md#client-apis). After successful client registration, a machine token is issued to the Livepatch client which can be used for subsequent authentication. Privileged access to this token must be controlled to prevent usage by a malicious third-party. - **Data at Rest**: The Livepatch client does not encrypt its data at rest. However, all client data is stored in the [$SNAP_COMMON](https://snapcraft.io/docs/reference/development/environment-variables/#snap-common) and [$SNAP_DATA](https://snapcraft.io/docs/reference/development/environment-variables/#snap-data) directories. The Livepatch client snap ensures that only the root user has read and write access to the sensitive data stored in these directories. It is recommended to maintain strict privileged access controls, to prevent unauthorized access of the snap data. ## Related Security Documentation -[Patch Security](/livepatch/reference/patch-security.md): This document provides in-depth details on the cryptographic approaches used by the Livepatch client for patch verification, signatures, and secure communication. +[Patch Security](/client/reference/patches/patch-security.md): This document provides in-depth details on the cryptographic approaches used by the Livepatch client for patch verification, signatures, and secure communication. -[Secure Client Operation](/livepatch/how-to-guides/securely-configure-and-operate-the-client.md): This document provides information on how to securely configure and operate the Livepatch client. +[Secure Client Operation](/client/how-to-guides/security/securely-configure-and-operate-the-client.md): This document provides information on how to securely configure and operate the Livepatch client. -[Secure Client Decommissioning](/livepatch/how-to-guides/securely-decommission-the-client.md): This document provides information on how to securely decommission the Livepatch client snap and its data. +[Secure Client Decommissioning](/client/how-to-guides/security/securely-decommission-the-client.md): This document provides information on how to securely decommission the Livepatch client snap and its data. -[Security Lifecycle](/livepatch/explanation/security-lifecycle.md):This document provides insights into how the security of the Livepatch client is maintained. It also provides guidelines on how security updates to the Livepatch client snap can be controlled. +[Security Lifecycle](/client/explanation/security/security-lifecycle.md):This document provides insights into how the security of the Livepatch client is maintained. It also provides guidelines on how security updates to the Livepatch client snap can be controlled. -[Reporting Security Vulnerabilities](/livepatch/how-to-guides/report-client-vulnerability.md): This document lays out the process to report security vulnerabilities found in the Livepatch client and provides information about the Ubuntu Security disclosure and embargo policy. +[Reporting Security Vulnerabilities](/client/how-to-guides/security/report-client-vulnerability.md): This document lays out the process to report security vulnerabilities found in the Livepatch client and provides information about the Ubuntu Security disclosure and embargo policy. diff --git a/docs/livepatch/explanation/do-i-need-to-reboot.md b/docs/client/explanation/troubleshooting/do-i-need-to-reboot.md similarity index 96% rename from docs/livepatch/explanation/do-i-need-to-reboot.md rename to docs/client/explanation/troubleshooting/do-i-need-to-reboot.md index 3d2d9a1..3be3ce9 100644 --- a/docs/livepatch/explanation/do-i-need-to-reboot.md +++ b/docs/client/explanation/troubleshooting/do-i-need-to-reboot.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-do-i-need-to-reboot)= +(client-explanation-do-i-need-to-reboot)= # Do I need to reboot? diff --git a/docs/client/explanation/troubleshooting/index.md b/docs/client/explanation/troubleshooting/index.md new file mode 100644 index 0000000..5d22433 --- /dev/null +++ b/docs/client/explanation/troubleshooting/index.md @@ -0,0 +1,34 @@ +--- +myst: + html_meta: + description: "Diagnose and understand Livepatch client issues." +--- + + +(client-explanation-troubleshooting)= + +# Troubleshooting + +Diagnose and understand Livepatch client issues. + +## In this section + +- [Why Livepatch is not working on my machine?](/client/explanation/troubleshooting/why-livepatch-is-not-working-on-my-machine.md) +- [Service access problem](/client/explanation/troubleshooting/service-access-problem.md) +- [Why are there missing patches?](/client/explanation/troubleshooting/why-are-there-missing-patches.md) +- [What happens when a problem cannot be patched?](/client/explanation/troubleshooting/what-happens-when-a-problem-cannot-be-patched.md) +- [Do I need to reboot?](/client/explanation/troubleshooting/do-i-need-to-reboot.md) +- [What is patch cut-off date?](/client/explanation/troubleshooting/what-is-patch-cut-off-date.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Why livepatch is not working on my machine +Service access problem +Why are there missing patches +What happens when a problem cannot be patched +Do i need to reboot +What is patch cut off date +``` diff --git a/docs/livepatch/explanation/service-access-problem.md b/docs/client/explanation/troubleshooting/service-access-problem.md similarity index 66% rename from docs/livepatch/explanation/service-access-problem.md rename to docs/client/explanation/troubleshooting/service-access-problem.md index b112e4d..7d1bef6 100644 --- a/docs/livepatch/explanation/service-access-problem.md +++ b/docs/client/explanation/troubleshooting/service-access-problem.md @@ -5,10 +5,10 @@ myst: --- -(livepatch-explanation-i-cannot-access-the-livepatch-service)= +(client-explanation-i-cannot-access-the-livepatch-service)= # I cannot access the Livepatch service Network access to the Ubuntu Livepatch Service ([https://livepatch.canonical.com:443](https://livepatch.canonical.com/)) is necessary as well as snapd version 2.15 - check your snapd version with `snap version`. -In addition to that, sometimes it could be a problem with the proxy configurations. Please check out [this](/livepatch/how-to-guides/configure-proxy.md) guide on how to configure the Livepatch client to use a proxy. +In addition to that, sometimes it could be a problem with the proxy configurations. Please check out [this](/client/how-to-guides/configuration/configure-proxy.md) guide on how to configure the Livepatch client to use a proxy. diff --git a/docs/livepatch/explanation/what-happens-when-a-problem-cannot-be-patched.md b/docs/client/explanation/troubleshooting/what-happens-when-a-problem-cannot-be-patched.md similarity index 90% rename from docs/livepatch/explanation/what-happens-when-a-problem-cannot-be-patched.md rename to docs/client/explanation/troubleshooting/what-happens-when-a-problem-cannot-be-patched.md index 825da2c..1b4561a 100644 --- a/docs/livepatch/explanation/what-happens-when-a-problem-cannot-be-patched.md +++ b/docs/client/explanation/troubleshooting/what-happens-when-a-problem-cannot-be-patched.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-what-happens-when-a-problem-occurs-that-cant-be-patched)= +(client-explanation-what-happens-when-a-problem-occurs-that-cant-be-patched)= # What happens when a problem occurs that can’t be patched? diff --git a/docs/livepatch/explanation/what-is-patch-cut-off-date.md b/docs/client/explanation/troubleshooting/what-is-patch-cut-off-date.md similarity index 98% rename from docs/livepatch/explanation/what-is-patch-cut-off-date.md rename to docs/client/explanation/troubleshooting/what-is-patch-cut-off-date.md index dc406ce..5d3c936 100644 --- a/docs/livepatch/explanation/what-is-patch-cut-off-date.md +++ b/docs/client/explanation/troubleshooting/what-is-patch-cut-off-date.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-what-is-patch-cut-off-date)= +(client-explanation-what-is-patch-cut-off-date)= # What is patch cut-off date? diff --git a/docs/client/explanation/troubleshooting/why-are-there-missing-patches.md b/docs/client/explanation/troubleshooting/why-are-there-missing-patches.md new file mode 100644 index 0000000..8a35d37 --- /dev/null +++ b/docs/client/explanation/troubleshooting/why-are-there-missing-patches.md @@ -0,0 +1,14 @@ +--- +myst: + html_meta: + description: "Why are there missing patches? - learn about this topic in Livepatch client." +--- + + +(client-explanation-why-was-there-no-livepatch-for-some-particular-high-or-critical-cve)= + +# Why was there no livepatch for some particular high or critical CVE? + +Livepatches are only produced for [supported kernels](/client/reference/platform/supported-kernels.md), and only for CVEs that require a Linux kernel modification to fix the problem (for example, a CPU bug may not have a kernel fix). Further, livepatches do not address security problems in Ubuntu software packages, or in third-party drivers that do not ship as part of the Linux kernel (i.e. NVIDIA GPU drivers). + +Livepatch is intended to provide protection from security issues in *addition* to regular kernel security updates, so be sure to read and follow the security advisories published in Ubuntu Security Notifications ([USNs](https://ubuntu.com/security/notices)) for your kernel. diff --git a/docs/livepatch/explanation/why-livepatch-is-not-working-on-my-machine.md b/docs/client/explanation/troubleshooting/why-livepatch-is-not-working-on-my-machine.md similarity index 94% rename from docs/livepatch/explanation/why-livepatch-is-not-working-on-my-machine.md rename to docs/client/explanation/troubleshooting/why-livepatch-is-not-working-on-my-machine.md index 4e433ee..8bca7d4 100644 --- a/docs/livepatch/explanation/why-livepatch-is-not-working-on-my-machine.md +++ b/docs/client/explanation/troubleshooting/why-livepatch-is-not-working-on-my-machine.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-why-isnt-livepatch-working-on-my-machine)= +(client-explanation-why-isnt-livepatch-working-on-my-machine)= # Why isn’t Livepatch working on my machine?? @@ -26,7 +26,7 @@ Please be aware that while it may be possible to build a kernel with the same ve Also note that a kernel running unsigned, out-of-tree drivers will be tainted, and the kernel will refuse to apply livepatches in this state. -A full list of supported kernels is available [here](/livepatch/reference/supported-kernels.md). +A full list of supported kernels is available [here](/client/reference/platform/supported-kernels.md). ## HWE vs GA Kernels @@ -40,7 +40,7 @@ It is possible to switch from an HWE kernel to the GA if desired by following th Finally, while prior to Ubuntu 22.04, Livepatch offered no support for interim kernel versions, recently Livepatch has grown support for some flavours of interim HWE kernels as described in our [blog post](https://ubuntu.com/blog/canonical-livepatch-gets-even-better-now-supporting-hardware-enablement-kernels). Kernels for desktop users are the "generic" flavour, while kernels for public clouds have their own unique flavours, supporting cloud specific functionality. Livepatch is now supported on interim HWE kernels for various public cloud flavours. Check your kernel flavour with `uname -r`. -As above, a full list of GA and HWE kernels supported is available [here](/livepatch/reference/supported-kernels.md) +As above, a full list of GA and HWE kernels supported is available [here](/client/reference/platform/supported-kernels.md) ## SECUREBOOT diff --git a/docs/livepatch/how-to-guides/configure-livepatch-client.md b/docs/client/how-to-guides/configuration/configure-livepatch-client.md similarity index 94% rename from docs/livepatch/how-to-guides/configure-livepatch-client.md rename to docs/client/how-to-guides/configuration/configure-livepatch-client.md index 5394921..9598a3a 100644 --- a/docs/livepatch/how-to-guides/configure-livepatch-client.md +++ b/docs/client/how-to-guides/configuration/configure-livepatch-client.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-how-to-guides-how-to-configure-the-livepatch-client)= +(client-how-to-guides-how-to-configure-the-livepatch-client)= # How to configure the Livepatch client diff --git a/docs/livepatch/how-to-guides/configure-proxy.md b/docs/client/how-to-guides/configuration/configure-proxy.md similarity index 97% rename from docs/livepatch/how-to-guides/configure-proxy.md rename to docs/client/how-to-guides/configuration/configure-proxy.md index dada801..8ec81a0 100644 --- a/docs/livepatch/how-to-guides/configure-proxy.md +++ b/docs/client/how-to-guides/configuration/configure-proxy.md @@ -4,7 +4,7 @@ myst: description: "How to configure proxy with Livepatch client." --- -(livepatch-how-to-guides-how-to-configure-a-proxy-in-the-livepatch-client)= +(client-how-to-guides-how-to-configure-a-proxy-in-the-livepatch-client)= # How to configure a proxy in the Livepatch client diff --git a/docs/livepatch/how-to-guides/enable-and-configure-the-livepatch-client-with-cloud-init.md b/docs/client/how-to-guides/configuration/enable-and-configure-the-livepatch-client-with-cloud-init.md similarity index 97% rename from docs/livepatch/how-to-guides/enable-and-configure-the-livepatch-client-with-cloud-init.md rename to docs/client/how-to-guides/configuration/enable-and-configure-the-livepatch-client-with-cloud-init.md index 1919310..1073fc3 100644 --- a/docs/livepatch/how-to-guides/enable-and-configure-the-livepatch-client-with-cloud-init.md +++ b/docs/client/how-to-guides/configuration/enable-and-configure-the-livepatch-client-with-cloud-init.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-how-to-guides-how-to-enable-and-configure-the-livepatch-client-with-cloud-init)= +(client-how-to-guides-how-to-enable-and-configure-the-livepatch-client-with-cloud-init)= # How to enable and configure the Livepatch client with cloud-init @@ -64,7 +64,7 @@ final_message: The system is up, up to date, and Livepatch client is active afte ``` -To configure the Livepatch client through the cloud-init module, replace each template value in the write_files section for `/etc/livepatch/livepatch.env`, such as `__LOG_LEVEL__`, with a valid configuration based on the [available configuration options](/livepatch/reference/configuration-options.md). +To configure the Livepatch client through the cloud-init module, replace each template value in the write_files section for `/etc/livepatch/livepatch.env`, such as `__LOG_LEVEL__`, with a valid configuration based on the [available configuration options](/client/reference/platform/configuration-options.md). > Note: To enable Livepatch, you need to attach the instance to Ubuntu Pro. Do not write the Pro token into the cloud-init module. Instead, store the pro token in a secrets vault, and access the pro token from the vault, writing the token into a root-owned file at`/etc/livepatch/pro_token`. The cloud-init module reads from this file to attach to Ubuntu Pro. The file is deleted at the last step of the cloud-init setup process. diff --git a/docs/client/how-to-guides/configuration/index.md b/docs/client/how-to-guides/configuration/index.md new file mode 100644 index 0000000..039e22c --- /dev/null +++ b/docs/client/how-to-guides/configuration/index.md @@ -0,0 +1,30 @@ +--- +myst: + html_meta: + description: "Configure the client, proxies, cloud-init, and patch cut-off behaviour." +--- + + +(client-how-to-guides-configuration)= + +# Configuration + +Configure the client, proxies, cloud-init, and patch cut-off behaviour. + +## In this section + +- [Configure Livepatch client](/client/how-to-guides/configuration/configure-livepatch-client.md) +- [Configure proxy](/client/how-to-guides/configuration/configure-proxy.md) +- [Enable and Configure The Livepatch Client With Cloud-Init](/client/how-to-guides/configuration/enable-and-configure-the-livepatch-client-with-cloud-init.md) +- [Use patch cut-off date](/client/how-to-guides/configuration/use-patch-cut-off-date.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Configure livepatch client +Configure proxy +Enable and configure the livepatch client with cloud init +Use patch cut off date +``` diff --git a/docs/livepatch/how-to-guides/use-patch-cut-off-date.md b/docs/client/how-to-guides/configuration/use-patch-cut-off-date.md similarity index 70% rename from docs/livepatch/how-to-guides/use-patch-cut-off-date.md rename to docs/client/how-to-guides/configuration/use-patch-cut-off-date.md index 280d824..7e15924 100644 --- a/docs/livepatch/how-to-guides/use-patch-cut-off-date.md +++ b/docs/client/how-to-guides/configuration/use-patch-cut-off-date.md @@ -5,21 +5,21 @@ myst: --- -(livepatch-how-to-guides-how-to-use-a-patch-cut-off-date)= +(client-how-to-guides-how-to-use-a-patch-cut-off-date)= # How to use a patch cut-off date -See our [explanation](/livepatch/explanation/what-is-patch-cut-off-date.md) to understand the patch cut-off date feature. +See our [explanation](/client/explanation/troubleshooting/what-is-patch-cut-off-date.md) to understand the patch cut-off date feature. ## Checking the cut-off date To check the cut-off date, run the following command: ```bash -$ sudo canonical-livepatch config cutoff-date --format yaml +sudo canonical-livepatch config cutoff-date --format yaml cutoff-date: "2024-02-01T00:00:00Z" -$ sudo canonical-livepatch config cutoff-date --format json +sudo canonical-livepatch config cutoff-date --format json {"cutoff-date": "2024-02-01T00:00:00Z"} ``` diff --git a/docs/client/how-to-guides/index.md b/docs/client/how-to-guides/index.md new file mode 100644 index 0000000..3245603 --- /dev/null +++ b/docs/client/how-to-guides/index.md @@ -0,0 +1,30 @@ +--- +myst: + html_meta: + description: "How-to guides with Livepatch client." +--- + + +(client-how-to-guides)= + +# How-To-Guides + +Step-by-step guides covering key operations and common tasks related to Livepatch. + +## In this section + +- [Installation](/client/how-to-guides/installation/index.md) — Enable or disable the Livepatch client on your machines. +- [Configuration](/client/how-to-guides/configuration/index.md) — Configure the client, proxies, cloud-init, and patch cut-off behaviour. +- [Operations](/client/how-to-guides/operations/index.md) — Day-to-day operation of the Livepatch client. +- [Security](/client/how-to-guides/security/index.md) — Operate and decommission the client securely, and report vulnerabilities. + +```{toctree} +:titlesonly: +:maxdepth: 2 +:hidden: + +Installation +Configuration +Operations +Security +``` diff --git a/docs/livepatch/how-to-guides/disable-client.md b/docs/client/how-to-guides/installation/disable-client.md similarity index 94% rename from docs/livepatch/how-to-guides/disable-client.md rename to docs/client/how-to-guides/installation/disable-client.md index 93a855e..543a38c 100644 --- a/docs/livepatch/how-to-guides/disable-client.md +++ b/docs/client/how-to-guides/installation/disable-client.md @@ -4,7 +4,7 @@ myst: description: "How to disable client with Livepatch client." --- -(livepatch-how-to-guides-how-to-disable-the-livepatch-client)= +(client-how-to-guides-how-to-disable-the-livepatch-client)= # How to disable the Livepatch client diff --git a/docs/livepatch/how-to-guides/disable-livepatch-during-startup.md b/docs/client/how-to-guides/installation/disable-livepatch-during-startup.md similarity index 85% rename from docs/livepatch/how-to-guides/disable-livepatch-during-startup.md rename to docs/client/how-to-guides/installation/disable-livepatch-during-startup.md index da75896..67d21f8 100644 --- a/docs/livepatch/how-to-guides/disable-livepatch-during-startup.md +++ b/docs/client/how-to-guides/installation/disable-livepatch-during-startup.md @@ -5,11 +5,11 @@ myst: --- -(livepatch-how-to-guides-how-to-disable-livepatch-during-startup)= +(client-how-to-guides-how-to-disable-livepatch-during-startup)= # How to disable Livepatch during startup -The Livepatch client will make a best-effort attempt to [prevent re-inserting and reloading a faulty patch](/livepatch/reference/patch-installation.md) that causes a system crash or causes kernel bug log entries. In the extremely rare case that a faulty patch causes a system crash loop, recovery methods are available to disable the Livepatch daemon, thereby preventing the application of the faulty patch. The following methods explain how to recover the system in such scenarios. These recovery methods rely on setting different values for the [Livepatch mode](/livepatch/how-to-guides/disable-client.md). +The Livepatch client will make a best-effort attempt to [prevent re-inserting and reloading a faulty patch](/client/explanation/patches/patch-installation.md) that causes a system crash or causes kernel bug log entries. In the extremely rare case that a faulty patch causes a system crash loop, recovery methods are available to disable the Livepatch daemon, thereby preventing the application of the faulty patch. The following methods explain how to recover the system in such scenarios. These recovery methods rely on setting different values for the [Livepatch mode](/client/how-to-guides/installation/disable-client.md). ## Various ways to disable Livepatch @@ -36,7 +36,7 @@ sudo bash -c 'echo -n stop > /var/local/canonical_livepatch_mode' After recovering from the crash loop, resuming the normal operation of the Livepatch client and daemon is necessary to secure the running kernel. However, we need to ensure that enabling Livepatch does not result in a crash loop again. -- The Livepatch client sends anonymous pings before, during and after a patch is applied, to the Livepatch server. The client pings are continuously [monitored by the Livepatch team](/livepatch/reference/patch-lifecycle.md) to ensure the sanity of the patches. If the analysis of the ping metrics points towards a patch being faulty, it is [blocklisted](/livepatch/reference/patch-lifecycle.md) to prevent it from being served to client machines. +- The Livepatch client sends anonymous pings before, during and after a patch is applied, to the Livepatch server. The client pings are continuously [monitored by the Livepatch team](/client/explanation/patches/patch-lifecycle.md) to ensure the sanity of the patches. If the analysis of the ping metrics points towards a patch being faulty, it is [blocklisted](/client/explanation/patches/patch-lifecycle.md) to prevent it from being served to client machines. - Users can also [report bugs](https://bugs.launchpad.net/canonical-livepatch-client) upon facing a system crash loop that could be caused by the application of a patch. If the patch is found to be faulty by the Livepatch team, it will be blocklisted. - After the faulty patch is blocklisted or a new and stable patch is released, it is safe to resume the normal operation of the Livepatch client. diff --git a/docs/livepatch/how-to-guides/enable-client-on-ubuntu-core.md b/docs/client/how-to-guides/installation/enable-client-on-ubuntu-core.md similarity index 96% rename from docs/livepatch/how-to-guides/enable-client-on-ubuntu-core.md rename to docs/client/how-to-guides/installation/enable-client-on-ubuntu-core.md index f3f1253..93db581 100644 --- a/docs/livepatch/how-to-guides/enable-client-on-ubuntu-core.md +++ b/docs/client/how-to-guides/installation/enable-client-on-ubuntu-core.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-how-to-guides-how-to-enable-the-livepatch-client-on-ubuntu-core)= +(client-how-to-guides-how-to-enable-the-livepatch-client-on-ubuntu-core)= # How to enable the Livepatch client on Ubuntu Core diff --git a/docs/livepatch/how-to-guides/enable-client.md b/docs/client/how-to-guides/installation/enable-client.md similarity index 86% rename from docs/livepatch/how-to-guides/enable-client.md rename to docs/client/how-to-guides/installation/enable-client.md index 8a6ef4d..def7cb9 100644 --- a/docs/livepatch/how-to-guides/enable-client.md +++ b/docs/client/how-to-guides/installation/enable-client.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-how-to-guides-how-to-enable-the-livepatch-client)= +(client-how-to-guides-how-to-enable-the-livepatch-client)= # How to enable the Livepatch client @@ -13,10 +13,10 @@ Livepatch is included in Ubuntu Pro (previously known as Ubuntu Advantage). The ``` # Attach your personal or enterprise subscription from ubuntu.com/pro -$ sudo pro attach +sudo pro attach # Explicitly enable livepatch -$ sudo pro enable livepatch +sudo pro enable livepatch ``` This will install the livepatch client, and enroll the system to the Ubuntu livepatch service. diff --git a/docs/client/how-to-guides/installation/index.md b/docs/client/how-to-guides/installation/index.md new file mode 100644 index 0000000..5d6fdfe --- /dev/null +++ b/docs/client/how-to-guides/installation/index.md @@ -0,0 +1,30 @@ +--- +myst: + html_meta: + description: "Enable or disable the Livepatch client on your machines." +--- + + +(client-how-to-guides-installation)= + +# Installation + +Enable or disable the Livepatch client on your machines. + +## In this section + +- [Enable client](/client/how-to-guides/installation/enable-client.md) +- [Enable client on Ubuntu Core](/client/how-to-guides/installation/enable-client-on-ubuntu-core.md) +- [Disable client](/client/how-to-guides/installation/disable-client.md) +- [Disable Livepatch during startup](/client/how-to-guides/installation/disable-livepatch-during-startup.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Enable client +Enable client on ubuntu core +Disable client +Disable livepatch during startup +``` diff --git a/docs/livepatch/how-to-guides/check-client-status.md b/docs/client/how-to-guides/operations/check-client-status.md similarity index 98% rename from docs/livepatch/how-to-guides/check-client-status.md rename to docs/client/how-to-guides/operations/check-client-status.md index ebd4ff5..1c0075d 100644 --- a/docs/livepatch/how-to-guides/check-client-status.md +++ b/docs/client/how-to-guides/operations/check-client-status.md @@ -4,7 +4,7 @@ myst: description: "How to check client status with Livepatch client." --- -(livepatch-how-to-guides-how-to-check-the-livepatch-client-status)= +(client-how-to-guides-how-to-check-the-livepatch-client-status)= # How to check the Livepatch client status diff --git a/docs/client/how-to-guides/operations/index.md b/docs/client/how-to-guides/operations/index.md new file mode 100644 index 0000000..8e0156e --- /dev/null +++ b/docs/client/how-to-guides/operations/index.md @@ -0,0 +1,24 @@ +--- +myst: + html_meta: + description: "Day-to-day operation of the Livepatch client." +--- + + +(client-how-to-guides-operations)= + +# Operations + +Day-to-day operation of the Livepatch client. + +## In this section + +- [Check client status](/client/how-to-guides/operations/check-client-status.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Check client status +``` diff --git a/docs/client/how-to-guides/security/index.md b/docs/client/how-to-guides/security/index.md new file mode 100644 index 0000000..bddbc5e --- /dev/null +++ b/docs/client/how-to-guides/security/index.md @@ -0,0 +1,28 @@ +--- +myst: + html_meta: + description: "Operate and decommission the client securely, and report vulnerabilities." +--- + + +(client-how-to-guides-security)= + +# Security + +Operate and decommission the client securely, and report vulnerabilities. + +## In this section + +- [Securely configure and operate the client](/client/how-to-guides/security/securely-configure-and-operate-the-client.md) +- [Securely Decommission the client](/client/how-to-guides/security/securely-decommission-the-client.md) +- [Report Client Vulnerability](/client/how-to-guides/security/report-client-vulnerability.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Securely configure and operate the client +Securely decommission the client +Report client vulnerability +``` diff --git a/docs/livepatch/how-to-guides/report-client-vulnerability.md b/docs/client/how-to-guides/security/report-client-vulnerability.md similarity index 94% rename from docs/livepatch/how-to-guides/report-client-vulnerability.md rename to docs/client/how-to-guides/security/report-client-vulnerability.md index d705914..cadf863 100644 --- a/docs/livepatch/how-to-guides/report-client-vulnerability.md +++ b/docs/client/how-to-guides/security/report-client-vulnerability.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-how-to-guides-how-to-report-a-livepatch-client-vulnerability)= +(client-how-to-guides-how-to-report-a-livepatch-client-vulnerability)= # How to report a Livepatch client vulnerability diff --git a/docs/livepatch/how-to-guides/securely-configure-and-operate-the-client.md b/docs/client/how-to-guides/security/securely-configure-and-operate-the-client.md similarity index 88% rename from docs/livepatch/how-to-guides/securely-configure-and-operate-the-client.md rename to docs/client/how-to-guides/security/securely-configure-and-operate-the-client.md index 2f333bb..e4de49f 100644 --- a/docs/livepatch/how-to-guides/securely-configure-and-operate-the-client.md +++ b/docs/client/how-to-guides/security/securely-configure-and-operate-the-client.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-how-to-guides-how-to-securely-configure-and-operate-the-livepatch-client)= +(client-how-to-guides-how-to-securely-configure-and-operate-the-livepatch-client)= # How to securely configure and operate the Livepatch client @@ -36,7 +36,7 @@ sudo snap refresh canonical-livepatch --channel=latest/stable The default configuration of the Livepatch client uses the Canonical-hosted Livepatch server as the remote-server, with no additional ca-certs or proxy configurations enabled. Using the default configuration ensures that the data is always encrypted in transit, as the Livepatch client uses TLS (minimum v1.2) with server-side authentication while communicating with the Canonical-hosted Livepatch server. -However, for on-premises Livepatch server deployments, users can decide to forgo TLS while communicating with the Livepatch server, as there is no strict TLS enforcement at the client-side. It is strongly recommended to enable TLS for communication between the client and the on-prem Livepatch servers, to prevent attacks from malicious actors. The Livepatch client supports using TLS for such communications, by providing a way to configure additional CA certificates and route traffic through proxies. See these how-to guides on [configuring the client for TLS with custom certificates](/livepatch_on_prem/how-to-guides/setup-tls.md#configuring-livepatch-client-with-tls) and [configuring the client to use proxies](/livepatch/how-to-guides/configure-proxy.md). +However, for on-premises Livepatch server deployments, users can decide to forgo TLS while communicating with the Livepatch server, as there is no strict TLS enforcement at the client-side. It is strongly recommended to enable TLS for communication between the client and the on-prem Livepatch servers, to prevent attacks from malicious actors. The Livepatch client supports using TLS for such communications, by providing a way to configure additional CA certificates and route traffic through proxies. See these how-to guides on [configuring the client for TLS with custom certificates](/server/how-to-guides/security/setup-tls.md#configuring-livepatch-client-with-tls) and [configuring the client to use proxies](/client/how-to-guides/configuration/configure-proxy.md). It is also recommended to enforce TLS for patch downloads, when using an on-premises deployment of the Livepatch server, by setting the `tls-patch-download` configuration option to `true`. @@ -50,5 +50,5 @@ By default, the Livepatch client runs as a privileged daemon process and stores See these how-to guides and configuration references to understand how to configure the Livepatch client and the configuration options available: -1. [How to configure the Livepatch client](/livepatch/how-to-guides/configure-livepatch-client.md) -2. [Livepatch client configuration options reference](/livepatch/reference/configuration-options.md) +1. [How to configure the Livepatch client](/client/how-to-guides/configuration/configure-livepatch-client.md) +2. [Livepatch client configuration options reference](/client/reference/platform/configuration-options.md) diff --git a/docs/livepatch/how-to-guides/securely-decommission-the-client.md b/docs/client/how-to-guides/security/securely-decommission-the-client.md similarity index 97% rename from docs/livepatch/how-to-guides/securely-decommission-the-client.md rename to docs/client/how-to-guides/security/securely-decommission-the-client.md index 8c9f5ae..d37c39d 100644 --- a/docs/livepatch/how-to-guides/securely-decommission-the-client.md +++ b/docs/client/how-to-guides/security/securely-decommission-the-client.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-how-to-guides-how-to-securely-decommission-the-livepatch-client)= +(client-how-to-guides-how-to-securely-decommission-the-livepatch-client)= # How to securely decommission the Livepatch client diff --git a/docs/livepatch/index.md b/docs/client/index.md similarity index 60% rename from docs/livepatch/index.md rename to docs/client/index.md index a66b4c6..aa0d8d3 100644 --- a/docs/livepatch/index.md +++ b/docs/client/index.md @@ -5,7 +5,7 @@ myst: --- -(livepatch)= +(client)= # Client @@ -13,11 +13,10 @@ Livepatch client is the software running on a machine, that periodically checks ## In this documentation -| | | -| ----------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | -| [How-to guides](/livepatch/how-to-guides/index.md)
Step-by-step guides covering key operations and common tasks | -| [Explanation](/livepatch/explanation/index.md)
Discussion and clarification of key topics | | -[Reference](/livepatch/reference/index.md)
Technical information - specifications, APIs, architecture | +| | | +|----------------------------------------------------------------------------------------------|-| +| Tutorials
Get started with Canonical Livepatch Client. | [How-to guides](/client/how-to-guides/index.md)
Step-by-step guides covering key operations and common tasks
| +| [Explanation](/client/explanation/index.md)
Discussion and clarification of key topics | [Reference](/client/reference/index.md)
Technical information - specifications, APIs, architecture | ## Getting support diff --git a/docs/client/reference/index.md b/docs/client/reference/index.md new file mode 100644 index 0000000..9a5f7fd --- /dev/null +++ b/docs/client/reference/index.md @@ -0,0 +1,30 @@ +--- +myst: + html_meta: + description: "Reference - technical reference for Livepatch client." +--- + + +(client-reference)= + +# Reference + +Technical information - security, APIs, architecture, etc., related to Livepatch. + +## In this section + +- [Platform](/client/reference/platform/index.md) — Supported kernels, architectures, and client configuration options. +- [Networking](/client/reference/networking/index.md) — Network requirements, content caching, and data sent to Canonical. +- [Patches](/client/reference/patches/index.md) — How patches are installed, their lifecycle, and their security. +- [Releases](/release-notes/client/index.md) — Release notes for the Livepatch Client. + +```{toctree} +:titlesonly: +:maxdepth: 2 +:hidden: + +Platform +Networking +Patches +Releases <../../release-notes/client/index.md> +``` diff --git a/docs/livepatch/reference/data-sent.md b/docs/client/reference/networking/data-sent.md similarity index 93% rename from docs/livepatch/reference/data-sent.md rename to docs/client/reference/networking/data-sent.md index 9e62402..91f2d93 100644 --- a/docs/livepatch/reference/data-sent.md +++ b/docs/client/reference/networking/data-sent.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-reference-data-sent-to-canonical)= +(client-reference-data-sent-to-canonical)= # Data sent to Canonical diff --git a/docs/client/reference/networking/index.md b/docs/client/reference/networking/index.md new file mode 100644 index 0000000..1499bab --- /dev/null +++ b/docs/client/reference/networking/index.md @@ -0,0 +1,26 @@ +--- +myst: + html_meta: + description: "Network requirements, content caching, and data sent to Canonical." +--- + + +(client-reference-networking)= + +# Networking + +Network requirements, content caching, and data sent to Canonical. + +## In this section + +- [Network requirements](/client/reference/networking/network-requirements.md) +- [Data sent](/client/reference/networking/data-sent.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Network requirements +Data sent +``` diff --git a/docs/livepatch/reference/network-requirements.md b/docs/client/reference/networking/network-requirements.md similarity index 91% rename from docs/livepatch/reference/network-requirements.md rename to docs/client/reference/networking/network-requirements.md index af0c775..1637ccf 100644 --- a/docs/livepatch/reference/network-requirements.md +++ b/docs/client/reference/networking/network-requirements.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-reference-livepatch-client-firewall-configuration)= +(client-reference-livepatch-client-firewall-configuration)= # Livepatch client firewall configuration diff --git a/docs/client/reference/patches/index.md b/docs/client/reference/patches/index.md new file mode 100644 index 0000000..71af05a --- /dev/null +++ b/docs/client/reference/patches/index.md @@ -0,0 +1,24 @@ +--- +myst: + html_meta: + description: "How patches are installed, their lifecycle, and their security." +--- + + +(client-reference-patches)= + +# Patches + +How patches are installed, their lifecycle, and their security. + +## In this section + +- [Patch Security](/client/reference/patches/patch-security.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Patch security +``` diff --git a/docs/livepatch/reference/patch-security.md b/docs/client/reference/patches/patch-security.md similarity index 88% rename from docs/livepatch/reference/patch-security.md rename to docs/client/reference/patches/patch-security.md index b9ef32e..bfdf7ba 100644 --- a/docs/livepatch/reference/patch-security.md +++ b/docs/client/reference/patches/patch-security.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-reference-patch-security)= +(client-reference-patch-security)= # Patch Security @@ -49,11 +49,11 @@ The client supports a minimum of TLS v1.2. The `remote-server` config option on the client influences the upstream Livepatch server. There is no client side enforcement that TLS be used, and an on-premises deployment of the Livepatch server may decide to forgo TLS although this is not recommended. The Canonical hosted Livepatch server redirects HTTP traffic to HTTPS. -The Livepatch client provides users with the ability to add their custom certificates to the CA cert pool. For more information on how to add custom certificates to the CA certificate pool, see the [configuration reference](/livepatch/reference/configuration-options.md) for the Livepatch client. The custom CA certificates should be encoded as PEM. +The Livepatch client provides users with the ability to add their custom certificates to the CA cert pool. For more information on how to add custom certificates to the CA certificate pool, see the [configuration reference](/client/reference/platform/configuration-options.md) for the Livepatch client. The custom CA certificates should be encoded as PEM. -The Livepatch client can also connect to the hosted Livepatch server or an on-premises Livepatch server through HTTPS proxies. See [this how-to guide](/livepatch/how-to-guides/configure-proxy.md) to understand how to configure proxies for secure communication. +The Livepatch client can also connect to the hosted Livepatch server or an on-premises Livepatch server through HTTPS proxies. See [this how-to guide](/client/how-to-guides/configuration/configure-proxy.md) to understand how to configure proxies for secure communication. -The Livepatch client can also be configured to enforce TLS for all patch downloads. The Canonical-hosted Livepatch server will always serve a `https` URL, so that all patch downloads from the hosted patch storage are made securely over TLS. For more information on how to enforce TLS patch downloads, when clients are getting updates from on-premises Livepatch servers, see the [configuration reference](/livepatch/reference/configuration-options.md) for the Livepatch client. +The Livepatch client can also be configured to enforce TLS for all patch downloads. The Canonical-hosted Livepatch server will always serve a `https` URL, so that all patch downloads from the hosted patch storage are made securely over TLS. For more information on how to enforce TLS patch downloads, when clients are getting updates from on-premises Livepatch servers, see the [configuration reference](/client/reference/platform/configuration-options.md) for the Livepatch client. Go packages used for setting up TLS configuration for the Livepatch client: - crypto/tls diff --git a/docs/livepatch/reference/configuration-options.md b/docs/client/reference/platform/configuration-options.md similarity index 91% rename from docs/livepatch/reference/configuration-options.md rename to docs/client/reference/platform/configuration-options.md index dd70d9c..6123ca9 100644 --- a/docs/livepatch/reference/configuration-options.md +++ b/docs/client/reference/platform/configuration-options.md @@ -5,11 +5,11 @@ myst: --- -(livepatch-reference-livepatch-client-configuration-options)= +(client-reference-livepatch-client-configuration-options)= # Livepatch client configuration options -The following configuration options are available for the Livepatch client, which can be set following the [How to configure Livepatch client](/livepatch/how-to-guides/configure-livepatch-client.md) how-to guide. +The following configuration options are available for the Livepatch client, which can be set following the [How to configure Livepatch client](/client/how-to-guides/configuration/configure-livepatch-client.md) how-to guide. |Key | Data Type | Description | Default Value| |--- | --- | --- | ---| diff --git a/docs/client/reference/platform/index.md b/docs/client/reference/platform/index.md new file mode 100644 index 0000000..07b48d4 --- /dev/null +++ b/docs/client/reference/platform/index.md @@ -0,0 +1,28 @@ +--- +myst: + html_meta: + description: "Supported kernels, architectures, and client configuration options." +--- + + +(client-reference-platform)= + +# Platform + +Supported kernels, architectures, and client configuration options. + +## In this section + +- [Supported kernels](/client/reference/platform/supported-kernels.md) +- [Configuration Options](/client/reference/platform/configuration-options.md) +- [Which are the supported architectures?](/client/reference/platform/which-are-the-supported-architectures.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Supported kernels +Configuration options +Which are the supported architectures +``` diff --git a/docs/livepatch/reference/supported-kernels.md b/docs/client/reference/platform/supported-kernels.md similarity index 94% rename from docs/livepatch/reference/supported-kernels.md rename to docs/client/reference/platform/supported-kernels.md index c1a78ab..75cf573 100644 --- a/docs/livepatch/reference/supported-kernels.md +++ b/docs/client/reference/platform/supported-kernels.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-reference-kernels-covered-by-livepatch)= +(client-reference-kernels-covered-by-livepatch)= # Kernels covered by Livepatch @@ -38,4 +38,4 @@ There will be Livepatch support for HWE kernels across a limited combination of Livepatch will provide security coverage for ARM64 architectures from release 26.04. Older releases are not covered for the ARM64 architecture, due to limitations in the tooling available in these releases. -See [this page](/livepatch/explanation/why-livepatch-is-not-working-on-my-machine.md) to better understand why your kernel might not be supported. +See [this page](/client/explanation/troubleshooting/why-livepatch-is-not-working-on-my-machine.md) to better understand why your kernel might not be supported. diff --git a/docs/livepatch/explanation/which-are-the-supported-architectures.md b/docs/client/reference/platform/which-are-the-supported-architectures.md similarity index 81% rename from docs/livepatch/explanation/which-are-the-supported-architectures.md rename to docs/client/reference/platform/which-are-the-supported-architectures.md index 09f34a2..1c15d1c 100644 --- a/docs/livepatch/explanation/which-are-the-supported-architectures.md +++ b/docs/client/reference/platform/which-are-the-supported-architectures.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-which-are-the-supported-architectures)= +(client-reference-which-are-the-supported-architectures)= # Which are the supported architectures? diff --git a/docs/contribute/index.md b/docs/contribute/index.md new file mode 100644 index 0000000..7a544e9 --- /dev/null +++ b/docs/contribute/index.md @@ -0,0 +1,114 @@ +--- +myst: + html_meta: + description: "How to contribute to Livepatch documentation." +--- + +(contribute-contribute-to-our-docs)= + +# Contribute to our docs + +Our documentation is a community effort, published on the [Livepatch docs](https://ubuntu.com/security/livepatch/docs). + +**We warmly welcome community contributions, suggestions, fixes and constructive feedback.** + +Contributing to documentation can be a fantastic way to get started as a contributor to open source projects, no matter your level of experience! + +We hope to make it as easy as possible to contribute. If you need help at all with the contribution process, please let us know! + +## Publishing and hosting + +The documentation for _Livepatch_ is +[hosted in GitHub](https://github.com/canonical/livepatch-docs) and +rendered via [Read the Docs](https://about.readthedocs.com/). + +We use the [Sphinx documentation generator](https://www.sphinx-doc.org/) to create our documentation, which is written in [MyST Markdown](https://mystmd.org/) and built from [Canonical's Sphinx Starter Pack](https://github.com/canonical/sphinx-docs-starter-pack). + +For further details, see the [Starter Pack documentation](https://canonical-starter-pack.readthedocs-hosted.com/stable/). + +## Contributions we accept + +We especially value contributions that improve the documentation's clarity, +accuracy, and usefulness. If you spot a problem, you can report it to us using +the "Give feedback" button at the top of every documentation page. Please give +us as much information as you can to help us address the problem. + +If the issue is one of the following very small issues, and you want to fix it +yourself, you can submit a pull request (PR) with your changes directly in the +[GitHub web interface](https://docs.github.com/en/repositories/working-with-files/managing-files/editing-files): + +- Typo corrections +- Minor technical corrections +- Broken link fixes +- Small clarifications + +For changes larger than those, we require contributor PRs to be tied to an issue. +Examples of changes that require an issue are things like: + +- Adding new sections or pages +- Restructuring existing pages +- Extensive rewording +- Significant technical corrections or updates +- Feature additions or enhancements + +## Contributions we don't accept + +We reserve the right to reject any contribution at our own discretion where: + +**The outline of proposed work has not already been agreed by a maintainer.** +: To protect maintainers' limited time, we do not accept unsolicited contributions. A PR must be tied to a valid and agreed issue unless it only makes a small change. Submitting an issue after a PR doesn't *guarantee* that we will then accept the PR. + +**The pull request far exceeds the scope of what was agreed.** +: "Scope creep" makes it much harder to review and accept changes. If a pull request becomes too large, we may ask you to break it into multiple smaller PRs. Stick to the scope of the original issue as much as you can -- if you discover more changes need to be made, discuss them in the PR or the original issue. A new PR can be submitted with the extra fixes. + +**The contribution makes changes without value.** +: To have value, changes must be a *specific and concrete improvement* over what already exists. We don't accept generic "polishing" (e.g. substituting synonyms, rewording without adding clarity). If your contribution contains *some* of these, we will ask you to undo them -- but will gladly accept the remaining parts of your pull request that are real improvements. If your contribution *only* contains low-value changes, it will be rejected. + +**We deem the contribution to be AI generated.** +: We don't want any part of our documentation to look or feel like it was produced by AI. Therefore, if what you submitted cannot be easily distinguished from AI output, it does not meet our contribution requirements. + +**The issue the pull request is addressing was assigned to someone else.** +: We want to make this a safe place for contributors to work on issues in their own time and without pressure. Please treat others as you'd want to be treated. If you like an issue someone else is working on, let us know and we'll create a similar one for you. + +## AI policy + +The Livepatch documentation has been created by humans, for humans. The occasional "jagged edges" you might find (typos, slightly unconventional wording, humour) represent the very human voices of the people who collaborated +to create it. We don't want to average those away by passing the documentation through LLMs. + +This policy exists to protect our readers, our community of contributors, and the project maintainers. +As AI continues to evolve, we will update these guidelines accordingly. + +(contribute-acceptable-use-of-ai)= + +### Acceptable use of AI + +We don't ban our contributors from using AI. However, we do expect anyone contributing to this project to use it responsibly, as a helper, and not as something that replaces them. Some examples of acceptable usage include: + +- Using AI as a spellchecker or grammar helper +- Using it to help with translation into English +- Using it to help outline and organize a draft +- Using it adversarially, to point out missing sections +- Ensuring formatting adheres to our style guide + +We want to be open and transparent with our users about the way in which AI is or is not used in the our documentation. We (the maintainers) have been experimenting with the ways in which AI can be used to improve the experience for our readers, and we don't object to contributors doing the same -- with the following caveats: + +1. **Agreement**: Any such work you do *must* be tied to an issue, and be agreed as valid and necessary with the maintainers *before* you start. Only maintainers are exempt from this rule, since they are most familiar with the project and its scope. + +2. **Honesty**: If you use an "AI assist" when making a contribution, you *must* disclose that you used it, and how you used it in the pull request description. + +3. **Accessibility**: Issues marked as "good first issues" and "Open Documentation Academy" are *specifically* created and intended for people new to Open Source to get started in a safe place. These issues are easy to complete, well-described, and self-contained for new contributors to learn from. These issues are not for AI. + +4. **Responsibility**: Make sure that even if you use AI, you are still adding value based on your own personal skills and competency. You must understand what you're submitting, even if you used an LLM to help you. + +## Thank you! + +Lastly, we would like to thank you for spending your time to help make the +Livepatch documentation better. Every step in the right direction is a step +worth taking, no matter how large or small. + +```{toctree} +:maxdepth: 1 +:hidden: + +self +``` diff --git a/docs/index.md b/docs/index.md index 6266408..1127e19 100644 --- a/docs/index.md +++ b/docs/index.md @@ -9,20 +9,20 @@ myst: [Canonical Livepatch](https://ubuntu.com/security/livepatch) patches high and critical Linux kernel vulnerabilities, removing the immediate need to reboot to upgrade the kernel, and instead allowing the downtime to be scheduled. It is a part of the [Ubuntu Pro](https://ubuntu.com/pro) offering. -The Ubuntu Livepatch offering consists of the [client application](/livepatch/index.md), the Livepatch service hosted by Canonical and an optional [on-prem server](/livepatch_on_prem/index.md). The client runs on machines, periodically checks for available patches, downloads, verifies and installs them. +The Ubuntu Livepatch offering consists of the [client application](/client/index.md), the Livepatch service hosted by Canonical and an optional [on-prem server](/server/index.md). The client runs on machines, periodically checks for available patches, downloads, verifies and installs them. Canonical Livepatch is meant for critical infrastructure, where unscheduled downtime is to be avoided. By applying live kernel patches for high and critical kernel vulnerabilities, upgrades can be scheduled at a suitable time. If you're using [Ubuntu Pro](http://ubuntu.com/pro), then you'll have access to two additional Livepatch features. -1. Delayed updates for your [Livepatch clients](/livepatch/index.md),, providing further security and protection. -2. Access to the [on-prem server](/livepatch_on_prem/index.md). +1. Delayed updates for your [Livepatch clients](/client/index.md), providing further security and protection. +2. Access to the [on-prem server](/server/index.md). -## [Livepatch Client](/livepatch/index.md) +## [Livepatch Client](/client/index.md) Livepatch is the client side software that runs on individual machines and periodically checks for the availability of kernel patches. Once a patch becomes available, it is downloaded, verified and applied to the current kernel. -## [Livepatch On-prem](/livepatch_on_prem/index.md) +## [Livepatch On-prem](/server/index.md) Complex enterprise environments often follow policies that require a gradual roll-out of updates to reduce risk, or have high-security isolated environments that need to be updated. Livepatch on-prem allows an organization to define a rollout policy and remain in full control of which machines will get updated and when. To keep your machines up-to-date, the on-premises service regularly syncs with Livepatch hosted by Canonical and obtains the latest patches. It then deploys the patches gradually in as many stages as required. @@ -32,8 +32,15 @@ Complex enterprise environments often follow policies that require a gradual rol :glob: :hidden: -self -livepatch/index -livepatch_on_prem/index -livepatch_server_on_public_clouds/index +Client +Server ``` + +```{toctree} +:hidden: +:maxdepth: 2 + +Release Notes +Contribute +Support +``` \ No newline at end of file diff --git a/docs/livepatch/explanation/index.md b/docs/livepatch/explanation/index.md deleted file mode 100644 index b6e7209..0000000 --- a/docs/livepatch/explanation/index.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -myst: - html_meta: - description: "Explanation - learn about this topic in Livepatch client." ---- - -(livepatch-explanation)= - -# Explanation - -Discussion and clarification of key topics related to Livepatch. - -## Livepatch Info - -How does livepatch work and what kind of updates does it provide? - -- [How Livepatching works?](/livepatch/explanation/how-livepatching-works.md) -- [Livepatch Security Notices](/livepatch/explanation/livepatch-security-notices.md) -- [What kind of updates are provided by Livepatch?](/livepatch/explanation/what-kind-of-updates-are-provided-by-livepatch.md) -- [What kind of updates are not provided by Livepatch?](/livepatch/explanation/what-kind-of-updates-are-not-provided-by-livepatch.md) -- [When should I expect new updates?](/livepatch/explanation/when-should-i-expect-new-updates.md) - -## Understanding vulnerabilities - -What are CVEs and how does Livepatch work in tandem with system updates? - -- [How CVEs are rated?](/livepatch/explanation/how-cves-are-rated.md) -- [Do I need to reboot?](/livepatch/explanation/do-i-need-to-reboot.md) -- [What happens when a problem cannot be patched?](/livepatch/explanation/what-happens-when-a-problem-cannot-be-patched.md) -- [Why are patches missing?](/livepatch/explanation/why-are-there-missing-patches.md) - -## Why is Livepatch not working - -Understanding when Livepatch is not supported or networking constraints are interfering. - -- [Which are the supported architectures?](/livepatch/explanation/which-are-the-supported-architectures.md) -- [Service access problem](/livepatch/explanation/service-access-problem.md) -- [Why Livepatch is not working on my machine?](/livepatch/explanation/why-livepatch-is-not-working-on-my-machine.md) - -## Support - -Where to get support and file bugs. - -- [Report bugs](/livepatch/explanation/report-bugs.md) -- [Get more help](/livepatch/explanation/get-more-help.md) - -```{toctree} -:titlesonly: -:maxdepth: 2 -:glob: -:hidden: - -How livepatching works -Livepatch security notices -Security overview -Security lifecycle -What kind of updates are provided by Livepatch -What kind of updates are not provided by Livepatch -When should i expect new updates -Do i need to reboot -How CVEs are rated -What happens when a problem cannot be patched -Why are there missing patches -Service access problem -Why Livepatch is not working on my machine -What are Livepatch tiers -What is patch cut-off date -Which are the supported architectures -Report bugs -Get more help -``` diff --git a/docs/livepatch/explanation/why-are-there-missing-patches.md b/docs/livepatch/explanation/why-are-there-missing-patches.md deleted file mode 100644 index 40ebcb8..0000000 --- a/docs/livepatch/explanation/why-are-there-missing-patches.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -myst: - html_meta: - description: "Why are there missing patches? - learn about this topic in Livepatch client." ---- - - -(livepatch-explanation-why-was-there-no-livepatch-for-some-particular-high-or-critical-cve)= - -# Why was there no livepatch for some particular high or critical CVE? - -Livepatches are only produced for [supported kernels](/livepatch/reference/supported-kernels.md), and only for CVEs that require a Linux kernel modification to fix the problem (for example, a CPU bug may not have a kernel fix). Further, livepatches do not address security problems in Ubuntu software packages, or in third-party drivers that do not ship as part of the Linux kernel (i.e. NVIDIA GPU drivers). - -Livepatch is intended to provide protection from security issues in *addition* to regular kernel security updates, so be sure to read and follow the security advisories published in Ubuntu Security Notifications ([USNs](https://ubuntu.com/security/notices)) for your kernel. diff --git a/docs/livepatch/how-to-guides/index.md b/docs/livepatch/how-to-guides/index.md deleted file mode 100644 index 9b57179..0000000 --- a/docs/livepatch/how-to-guides/index.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -myst: - html_meta: - description: "How to how-to-guides with Livepatch client." ---- - - -(livepatch-how-to-guides)= - -# How-To-Guides - -Step-by-step guides covering key operations and common tasks related to Livepatch. - -- [How to enable the Livepatch client](/livepatch/how-to-guides/enable-client.md) -- [How to disable the Livepatch client](/livepatch/how-to-guides/disable-client.md) -- [How to check the Livepatch client status](/livepatch/how-to-guides/check-client-status.md) -- [How to configure a proxy in the Livepatch client](/livepatch/how-to-guides/configure-proxy.md) -- [How to use a patch cut-off date](/livepatch/how-to-guides/use-patch-cut-off-date.md) -- [How to configure the Livepatch client](/livepatch/how-to-guides/configure-livepatch-client.md) -- [How to enable and configure the Livepatch client with cloud-init](/livepatch/how-to-guides/enable-and-configure-the-livepatch-client-with-cloud-init.md) - -```{toctree} -:titlesonly: -:maxdepth: 2 -:glob: -:hidden: - -Enable client -Disable client -Check client status -Configure proxy -Use patch cut-off date -Configure Livepatch client -Disable Lilvepatch during startup -Securely configure and operate the client -Securely decommission the client -Report client vulnerability -Enable client on Ubuntu Core -Enable and configure the Livepatch client with cloud-init -``` diff --git a/docs/livepatch/reference/index.md b/docs/livepatch/reference/index.md deleted file mode 100644 index 3faa201..0000000 --- a/docs/livepatch/reference/index.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -myst: - html_meta: - description: "Reference - technical reference for Livepatch client." ---- - - -(livepatch-reference)= - -# Reference - -Technical information - security, APIs, architecture, etc., related to Livepatch. - -## Networking - -Livepatch client requires Internet access in order to fetch kernel patches from the server. - -- [Network requirements](/livepatch/reference/network-requirements.md) - -## Compatibility - -Livepatch determines which kernel patch may be applied based on your kernel version. - -- [Supported kernels](/livepatch/reference/supported-kernels.md) -- [How do I know if the patch is designed for my system?](/livepatch/reference/patch-installation.md#how-do-i-know-if-the-patch-is-designed-for-my-system) - -## Security and privacy - -Livepatch sends specific data about your system in order to patch your kernel. - -- [Data sent](/livepatch/reference/data-sent.md) -- [Patch Security](/livepatch/reference/patch-security.md) - -## Kernel patching - -Livepatch inserts modules into a running kernel, this has inherent risks and the following can detail some of these risks and misunderstandings. - -- [Patch Lifecycle](/livepatch/reference/patch-lifecycle.md) -- [Patch Installation](/livepatch/reference/patch-installation.md) - -## Configuration - -Livepatch client can be configured with a variety of options, which are listed here. - -- [Configuration Options](/livepatch/reference/configuration-options.md) - -```{toctree} -:titlesonly: -:maxdepth: 2 -:glob: -:hidden: - -Network requirements -Data sent -Supported kernels -Patch lifecycle -Patch security -Patch installation -Content caching -Configuration options -``` diff --git a/docs/livepatch_on_prem/explanation/index.md b/docs/livepatch_on_prem/explanation/index.md deleted file mode 100644 index b911f3f..0000000 --- a/docs/livepatch_on_prem/explanation/index.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -myst: - html_meta: - description: "Explanation - learn about this topic in Livepatch on-prem." ---- - - -(livepatch_on_prem-explanation)= - -# Explanation - -Discussion and clarification of key topics related to Livepatch on-prem server. - -- [Patch Storage](/livepatch_on_prem/explanation/patch-storage/index.md) - - [Using S3 for patch storage ](/livepatch_on_prem/explanation/patch-storage/use-s3-for-patch-storage.md) -- [Data sent to Canonical](/livepatch_on_prem/explanation/data-sent.md) -- [Access Control ](/livepatch_on_prem/explanation/access-control.md) -- [Logging and Monitoring ](/livepatch_on_prem/explanation/logging-and-monitoring.md) -- [Machine Reports](/livepatch_on_prem/explanation/machine-reports.md) -- [Patch Sync Filters](/livepatch_on_prem/explanation/patch-sync-filters.md) -- [Security Overview](/livepatch_on_prem/explanation/security-overview.md) -- [Security Lifecycle](/livepatch_on_prem/explanation/security-lifecycle.md) - -```{toctree} -:titlesonly: -:maxdepth: 2 -:glob: -:hidden: - -patch-storage/index -data-sent -security-overview -security-lifecycle -access-control -logging-and-monitoring -machine-reports -patch-sync-filters -``` diff --git a/docs/livepatch_on_prem/how-to-guides/index.md b/docs/livepatch_on_prem/how-to-guides/index.md deleted file mode 100644 index 4825c11..0000000 --- a/docs/livepatch_on_prem/how-to-guides/index.md +++ /dev/null @@ -1,63 +0,0 @@ ---- -myst: - html_meta: - description: "How to how-to-guides with Livepatch on-prem." ---- - - -(livepatch_on_prem-how-to-guides)= - -# How-To-Guides - -Step-by-step guides covering key operations and common tasks related to Livepatch on-prem server. - -- [How to deploy via Juju](/livepatch_on_prem/how-to-guides/deploy-via-juju.md) -- [How to deploy via Snap](/livepatch_on_prem/how-to-guides/deploy-via-snap.md) -- [How to deploy CVE Service via Snap](/livepatch_on_prem/how-to-guides/deploy-cve-service-via-snap.md) -- [How to use Livepatch client with on-prem server](/livepatch_on_prem/how-to-guides/use-livepatch-client-with-on-prem-server.md) -- [How to setup administration tool](/livepatch_on_prem/how-to-guides/setup-administration-tool.md) -- [How to fetch patches](/livepatch_on_prem/how-to-guides/fetch-patches.md) -- [How to configure proxy for fetching patches](/livepatch_on_prem/how-to-guides/configure-proxy-for-fetching-patches.md) -- [How to manage fleet of machines](/livepatch_on_prem/how-to-guides/manage-fleet-of-machines.md) -- [How to generate patch health report](/livepatch_on_prem/how-to-guides/generate-patch-health-report.md) -- [How to upgrade a deployment](/livepatch_on_prem/how-to-guides/upgrade-a-deployment.md) -- [How to scale out](/livepatch_on_prem/how-to-guides/scale-out.md) -- [How to configure logging and monitoring](/livepatch_on_prem/how-to-guides/configure-logging-and-monitoring.md) -- [How to harden your deployment](/livepatch_on_prem/how-to-guides/harden-your-deployment.md) -- [How to setup TLS](/livepatch_on_prem/how-to-guides/setup-tls.md) -- [How to report vulnerabilities](/livepatch_on_prem/how-to-guides/report-vulnerabilities.md) -- [How to use the Patch Downloader Tool](/livepatch_on_prem/how-to-guides/use-the-patch-downloader-tool.md) -- [How to chain Livepatch Servers](/livepatch_on_prem/how-to-guides/chain-livepatch-servers.md) -- [How to migrate from Reactive charm to snap](/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-snap.md) -- [How to migrate from Reactive charm to Operator charm](/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md) -- [How to migrate from Reactive Charm to K8s Operator charm](/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-k8s-operator-charm.md) -- [How to decommission](/livepatch_on_prem/how-to-guides/decommission.md) - -```{toctree} -:titlesonly: -:maxdepth: 2 -:glob: -:hidden: - -Deploy via juju -Deploy via snap -Deploy cve service via snap -Use livepatch client with on-prem server -Setup administration tool -Fetch patches -Configure proxy for fetching patches -Manage fleet of machines -Generate patch health report -Upgrade a deployment -Scale out -Configure logging and-monitoring -Harden your deployment -Setup tls -Report vulnerabilities -Use the patch downloader tool -Chain livepatch servers -Migrate from reactive charm to snap -Migrate from reactive charm to operator charm -Migrate from reactive charm to k8s operator charm -Decommission -``` diff --git a/docs/livepatch_on_prem/reference/index.md b/docs/livepatch_on_prem/reference/index.md deleted file mode 100644 index d78c289..0000000 --- a/docs/livepatch_on_prem/reference/index.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -myst: - html_meta: - description: "Reference - technical reference for Livepatch on-prem server." ---- - - -(livepatch_on_prem-reference)= - -# Reference - -Technical information - specifications, APIs, architecture, etc., related to Livepatch on-prem server. - -- [Configuration](/livepatch_on_prem/reference/configuration.md) -- [Resource requirements](/livepatch_on_prem/reference/resource-requirements.md) -- [Authentication](/livepatch_on_prem/reference/authentication.md) -- [Network access](/livepatch_on_prem/reference/network-access.md) -- [Patch management](/livepatch_on_prem/reference/patch-management.md) -- [Release Notes](/livepatch_on_prem/reference/release-notes.md) - -```{toctree} -:titlesonly: -:maxdepth: 2 -:glob: -:hidden: - -configuration -resource-requirements -authentication -network-access -patch-management -release-notes -``` diff --git a/docs/livepatch_on_prem/tutorial/index.md b/docs/livepatch_on_prem/tutorial/index.md deleted file mode 100644 index 3a2f612..0000000 --- a/docs/livepatch_on_prem/tutorial/index.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -myst: - html_meta: - description: "Tutorial: Tutorial - hands-on introduction to Livepatch on-prem." ---- - - -(livepatch_on_prem-tutorial)= - -# Tutorial - -A hands-on introduction for Livepatch on-prem server for new users: - -- [Getting started with Livepatch On-Prem and LXD](/livepatch_on_prem/tutorial/livepatch-and-lxd.md) -- [Getting started with Livepatch On-Prem and MicroK8s](/livepatch_on_prem/tutorial/livepatch-and-microk8s.md) - -Setting up Livepatch in an airgapped environment: - -- [Getting started with Airgapped Livepatch On-Prem on MicroK8s](/livepatch_on_prem/tutorial/airgapped-livepatch-and-microk8s.md) -- [Getting started with airgapped Livepatch On-Prem using Snaps ](/livepatch_on_prem/tutorial/airgapped-livepatch-and-snap.md) - -```{toctree} -:titlesonly: -:maxdepth: 2 -:glob: -:hidden: - -livepatch-and-lxd -livepatch-and-microk8s -airgapped-livepatch-and-microk8s -airgapped-livepatch-and-snap -``` diff --git a/docs/livepatch_server_on_public_clouds/how-to-guides/index.md b/docs/livepatch_server_on_public_clouds/how-to-guides/index.md deleted file mode 100644 index 290b247..0000000 --- a/docs/livepatch_server_on_public_clouds/how-to-guides/index.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -myst: - html_meta: - description: "How to how-to-guides on public clouds with Livepatch server." ---- - - -(livepatch_server_on_public_clouds-how-to-guides)= - -# Livepatch Server On Public Clouds How-to Guides - -A how-to guide for deploying the Livepatch server snap on public clouds, using cloud-init, along with template cloud-init modules to use: - -- [Deploying The Livepatch Server Snap On Public Clouds](/livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/index.md) - -```{toctree} -:titlesonly: -:maxdepth: 2 -:glob: -:hidden: - -deploying-the-livepatch-server-snap-on-public-clouds/index -``` diff --git a/docs/livepatch_server_on_public_clouds/index.md b/docs/livepatch_server_on_public_clouds/index.md deleted file mode 100644 index d8cef2b..0000000 --- a/docs/livepatch_server_on_public_clouds/index.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -myst: - html_meta: - description: "Livepatch server on public clouds documentation home." ---- - - -(livepatch_server_on_public_clouds)= - -# Livepatch Server On Public Clouds - -Livepatch server can be self-hosted on public clouds via the server snap, allowing users to leverage public cloud resources while still having fine grain control over patch roll-out on their machines. - -## In this documentation - -| | | -|-|-| -| [How-to guides](/livepatch_server_on_public_clouds/how-to-guides/index.md)
Step-by-step guides covering key operations and common tasks
| - -## Getting support - -Canonical customers can receive support and report issues on the Ubuntu Livepatch service, Livepatch client or Livepatch on-prem, on Canonical's [support portal](https://portal.support.canonical.com/). - -The projects maintain bug trackers at - -- [Livepatch client bug tracker](https://bugs.launchpad.net/canonical-livepatch-client/+filebug) -- [Livepatch on-prem bug tracker](https://bugs.launchpad.net/livepatch-onprem/+filebug) - -```{toctree} -:titlesonly: -:maxdepth: 2 -:glob: -:hidden: - -how-to-guides/index -``` diff --git a/docs/redirects.txt b/docs/redirects.txt index cf8ae22..e4225ef 100644 --- a/docs/redirects.txt +++ b/docs/redirects.txt @@ -6,3 +6,173 @@ # The old path must be a file that doesn"t exist in the source. The current path must be # a file that does exist in the source. + +# Redirects for the 3rd-level Diátaxis restructure +"client/explanation/how-livepatching-works.md" "client/explanation/architecture/how-livepatching-works.md" +"client/explanation/what-are-livepatch-tiers.md" "client/explanation/architecture/what-are-livepatch-tiers.md" +"client/explanation/what-kind-of-updates-are-not-provided-by-livepatch.md" "client/explanation/architecture/what-kind-of-updates-are-not-provided-by-livepatch.md" +"client/explanation/what-kind-of-updates-are-provided-by-livepatch.md" "client/explanation/architecture/what-kind-of-updates-are-provided-by-livepatch.md" +"client/explanation/when-should-i-expect-new-updates.md" "client/explanation/architecture/when-should-i-expect-new-updates.md" +"client/explanation/how-cves-are-rated.md" "client/explanation/security/how-cves-are-rated.md" +"client/explanation/livepatch-security-notices.md" "client/explanation/security/livepatch-security-notices.md" +"client/explanation/security-lifecycle.md" "client/explanation/security/security-lifecycle.md" +"client/explanation/security-overview.md" "client/explanation/security/security-overview.md" +"client/explanation/do-i-need-to-reboot.md" "client/explanation/troubleshooting/do-i-need-to-reboot.md" +"client/explanation/service-access-problem.md" "client/explanation/troubleshooting/service-access-problem.md" +"client/explanation/what-happens-when-a-problem-cannot-be-patched.md" "client/explanation/troubleshooting/what-happens-when-a-problem-cannot-be-patched.md" +"client/explanation/what-is-patch-cut-off-date.md" "client/explanation/troubleshooting/what-is-patch-cut-off-date.md" +"client/explanation/why-are-there-missing-patches.md" "client/explanation/troubleshooting/why-are-there-missing-patches.md" +"client/explanation/why-livepatch-is-not-working-on-my-machine.md" "client/explanation/troubleshooting/why-livepatch-is-not-working-on-my-machine.md" +"client/how-to-guides/configure-livepatch-client.md" "client/how-to-guides/configuration/configure-livepatch-client.md" +"client/how-to-guides/configure-proxy.md" "client/how-to-guides/configuration/configure-proxy.md" +"client/how-to-guides/enable-and-configure-the-livepatch-client-with-cloud-init.md" "client/how-to-guides/configuration/enable-and-configure-the-livepatch-client-with-cloud-init.md" +"client/how-to-guides/use-patch-cut-off-date.md" "client/how-to-guides/configuration/use-patch-cut-off-date.md" +"client/how-to-guides/disable-client.md" "client/how-to-guides/installation/disable-client.md" +"client/how-to-guides/disable-livepatch-during-startup.md" "client/how-to-guides/installation/disable-livepatch-during-startup.md" +"client/how-to-guides/enable-client-on-ubuntu-core.md" "client/how-to-guides/installation/enable-client-on-ubuntu-core.md" +"client/how-to-guides/enable-client.md" "client/how-to-guides/installation/enable-client.md" +"client/how-to-guides/check-client-status.md" "client/how-to-guides/operations/check-client-status.md" +"client/how-to-guides/report-client-vulnerability.md" "client/how-to-guides/security/report-client-vulnerability.md" +"client/how-to-guides/securely-configure-and-operate-the-client.md" "client/how-to-guides/security/securely-configure-and-operate-the-client.md" +"client/how-to-guides/securely-decommission-the-client.md" "client/how-to-guides/security/securely-decommission-the-client.md" +"client/reference/content-caching.md" "client/explanation/architecture/content-caching.md" +"client/reference/data-sent.md" "client/reference/networking/data-sent.md" +"client/reference/network-requirements.md" "client/reference/networking/network-requirements.md" +"client/reference/patch-installation.md" "client/explanation/patches/patch-installation.md" +"client/reference/patch-lifecycle.md" "client/explanation/patches/patch-lifecycle.md" +"client/reference/patch-security.md" "client/reference/patches/patch-security.md" +"client/reference/configuration-options.md" "client/reference/platform/configuration-options.md" +"client/reference/supported-kernels.md" "client/reference/platform/supported-kernels.md" +"client/explanation/which-are-the-supported-architectures.md" "client/reference/platform/which-are-the-supported-architectures.md" +"server/explanation/access-control.md" "server/explanation/architecture/access-control.md" +"server/explanation/security-lifecycle.md" "server/explanation/architecture/security-lifecycle.md" +"server/explanation/security-overview.md" "server/explanation/architecture/security-overview.md" +"server/explanation/logging-and-monitoring.md" "server/explanation/observability/logging-and-monitoring.md" +"server/how-to-guides/deploy-cve-service-via-snap.md" "server/how-to-guides/deployment/deploy-cve-service-via-snap.md" +"server/how-to-guides/deploy-via-juju.md" "server/how-to-guides/deployment/deploy-via-juju.md" +"server/how-to-guides/deploy-via-snap.md" "server/how-to-guides/deployment/deploy-via-snap.md" +"server/how-to-guides/migrate-from-reactive-charm-to-k8s-operator-charm.md" "server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md" +"server/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md" "server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md" +"server/how-to-guides/migrate-from-reactive-charm-to-snap.md" "server/how-to-guides/deployment/migrate-from-reactive-charm-to-snap.md" +"server/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/deploying-on-aws.md" "server/how-to-guides/deployment/public-clouds/deploying-on-aws.md" +"server/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/deploying-on-azure.md" "server/how-to-guides/deployment/public-clouds/deploying-on-azure.md" +"server/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/index.md" "server/how-to-guides/deployment/public-clouds/index.md" +"server/how-to-guides/upgrade-a-deployment.md" "server/how-to-guides/deployment/upgrade-a-deployment.md" +"server/how-to-guides/configure-logging-and-monitoring.md" "server/how-to-guides/operations/configure-logging-and-monitoring.md" +"server/how-to-guides/decommission.md" "server/how-to-guides/operations/decommission.md" +"server/how-to-guides/generate-patch-health-report.md" "server/how-to-guides/operations/generate-patch-health-report.md" +"server/how-to-guides/manage-fleet-of-machines.md" "server/how-to-guides/operations/manage-fleet-of-machines.md" +"server/how-to-guides/scale-out.md" "server/how-to-guides/operations/scale-out.md" +"server/how-to-guides/use-livepatch-client-with-on-prem-server.md" "server/how-to-guides/operations/use-livepatch-client-with-on-prem-server.md" +"server/how-to-guides/chain-livepatch-servers.md" "server/how-to-guides/patch-management/chain-livepatch-servers.md" +"server/how-to-guides/configure-proxy-for-fetching-patches.md" "server/how-to-guides/patch-management/configure-proxy-for-fetching-patches.md" +"server/how-to-guides/fetch-patches.md" "server/how-to-guides/patch-management/fetch-patches.md" +"server/how-to-guides/use-the-patch-downloader-tool.md" "server/how-to-guides/patch-management/use-the-patch-downloader-tool.md" +"server/how-to-guides/harden-your-deployment.md" "server/how-to-guides/security/harden-your-deployment.md" +"server/how-to-guides/report-vulnerabilities.md" "server/how-to-guides/security/report-server-vulnerabilities.md" +"server/how-to-guides/setup-administration-tool.md" "server/how-to-guides/security/setup-administration-tool.md" +"server/how-to-guides/setup-tls.md" "server/how-to-guides/security/setup-tls.md" +"server/explanation/patch-sync-filters.md" "server/reference/patch-management/patch-sync-filters.md" +"server/explanation/patch-storage/index.md" "server/reference/patch-storage/index.md" +"server/explanation/patch-storage/use-s3-for-patch-storage.md" "server/reference/patch-storage/use-s3-for-patch-storage.md" +"server/reference/configuration.md" "server/reference/platform/configuration.md" +"server/reference/network-access.md" "server/reference/platform/network-access.md" +"server/reference/resource-requirements.md" "server/reference/platform/resource-requirements.md" +"server/explanation/data-sent.md" "server/reference/telemetry/data-sent.md" +"server/explanation/machine-reports.md" "server/reference/telemetry/machine-reports.md" +"livepatch/explanation/do-i-need-to-reboot.md" "client/explanation/troubleshooting/do-i-need-to-reboot.md" +"livepatch/explanation/get-more-help.md" "support/get-more-help.md" +"livepatch/explanation/how-cves-are-rated.md" "client/explanation/security/how-cves-are-rated.md" +"livepatch/explanation/how-livepatching-works.md" "client/explanation/architecture/how-livepatching-works.md" +"livepatch/explanation/index.md" "client/explanation/index.md" +"livepatch/explanation/livepatch-security-notices.md" "client/explanation/security/livepatch-security-notices.md" +"livepatch/explanation/report-bugs.md" "support/report-bugs.md" +"livepatch/explanation/security-lifecycle.md" "client/explanation/security/security-lifecycle.md" +"livepatch/explanation/security-overview.md" "client/explanation/security/security-overview.md" +"livepatch/explanation/service-access-problem.md" "client/explanation/troubleshooting/service-access-problem.md" +"livepatch/explanation/what-are-livepatch-tiers.md" "client/explanation/architecture/what-are-livepatch-tiers.md" +"livepatch/explanation/what-happens-when-a-problem-cannot-be-patched.md" "client/explanation/troubleshooting/what-happens-when-a-problem-cannot-be-patched.md" +"livepatch/explanation/what-is-patch-cut-off-date.md" "client/explanation/troubleshooting/what-is-patch-cut-off-date.md" +"livepatch/explanation/what-kind-of-updates-are-not-provided-by-livepatch.md" "client/explanation/architecture/what-kind-of-updates-are-not-provided-by-livepatch.md" +"livepatch/explanation/what-kind-of-updates-are-provided-by-livepatch.md" "client/explanation/architecture/what-kind-of-updates-are-provided-by-livepatch.md" +"livepatch/explanation/when-should-i-expect-new-updates.md" "client/explanation/architecture/when-should-i-expect-new-updates.md" +"livepatch/explanation/which-are-the-supported-architectures.md" "client/reference/platform/which-are-the-supported-architectures.md" +"livepatch/explanation/why-are-there-missing-patches.md" "client/explanation/troubleshooting/why-are-there-missing-patches.md" +"livepatch/explanation/why-livepatch-is-not-working-on-my-machine.md" "client/explanation/troubleshooting/why-livepatch-is-not-working-on-my-machine.md" +"livepatch/how-to-guides/check-client-status.md" "client/how-to-guides/operations/check-client-status.md" +"livepatch/how-to-guides/configure-livepatch-client.md" "client/how-to-guides/configuration/configure-livepatch-client.md" +"livepatch/how-to-guides/configure-proxy.md" "client/how-to-guides/configuration/configure-proxy.md" +"livepatch/how-to-guides/disable-client.md" "client/how-to-guides/installation/disable-client.md" +"livepatch/how-to-guides/disable-livepatch-during-startup.md" "client/how-to-guides/installation/disable-livepatch-during-startup.md" +"livepatch/how-to-guides/enable-and-configure-the-livepatch-client-with-cloud-init.md" "client/how-to-guides/configuration/enable-and-configure-the-livepatch-client-with-cloud-init.md" +"livepatch/how-to-guides/enable-client-on-ubuntu-core.md" "client/how-to-guides/installation/enable-client-on-ubuntu-core.md" +"livepatch/how-to-guides/enable-client.md" "client/how-to-guides/installation/enable-client.md" +"livepatch/how-to-guides/index.md" "client/how-to-guides/index.md" +"livepatch/how-to-guides/report-client-vulnerability.md" "client/how-to-guides/security/report-client-vulnerability.md" +"livepatch/how-to-guides/securely-configure-and-operate-the-client.md" "client/how-to-guides/security/securely-configure-and-operate-the-client.md" +"livepatch/how-to-guides/securely-decommission-the-client.md" "client/how-to-guides/security/securely-decommission-the-client.md" +"livepatch/how-to-guides/use-patch-cut-off-date.md" "client/how-to-guides/configuration/use-patch-cut-off-date.md" +"livepatch/index.md" "client/index.md" +"livepatch/reference/configuration-options.md" "client/reference/platform/configuration-options.md" +"livepatch/reference/content-caching.md" "client/explanation/architecture/content-caching.md" +"livepatch/reference/data-sent.md" "client/reference/networking/data-sent.md" +"livepatch/reference/index.md" "client/reference/index.md" +"livepatch/reference/network-requirements.md" "client/reference/networking/network-requirements.md" +"livepatch/reference/patch-installation.md" "client/explanation/patches/patch-installation.md" +"livepatch/reference/patch-lifecycle.md" "client/explanation/patches/patch-lifecycle.md" +"livepatch/reference/patch-security.md" "client/reference/patches/patch-security.md" +"livepatch/reference/supported-kernels.md" "client/reference/platform/supported-kernels.md" +"livepatch_on_prem/explanation/access-control.md" "server/explanation/architecture/access-control.md" +"livepatch_on_prem/explanation/data-sent.md" "server/reference/telemetry/data-sent.md" +"livepatch_on_prem/explanation/index.md" "server/explanation/index.md" +"livepatch_on_prem/explanation/logging-and-monitoring.md" "server/explanation/observability/logging-and-monitoring.md" +"livepatch_on_prem/explanation/machine-reports.md" "server/reference/telemetry/machine-reports.md" +"livepatch_on_prem/explanation/patch-storage/index.md" "server/reference/patch-storage/index.md" +"livepatch_on_prem/explanation/patch-storage/use-s3-for-patch-storage.md" "server/reference/patch-storage/use-s3-for-patch-storage.md" +"livepatch_on_prem/explanation/patch-sync-filters.md" "server/reference/patch-management/patch-sync-filters.md" +"livepatch_on_prem/explanation/security-lifecycle.md" "server/explanation/architecture/security-lifecycle.md" +"livepatch_on_prem/explanation/security-overview.md" "server/explanation/architecture/security-overview.md" +"livepatch_on_prem/how-to-guides/chain-livepatch-servers.md" "server/how-to-guides/patch-management/chain-livepatch-servers.md" +"livepatch_on_prem/how-to-guides/configure-logging-and-monitoring.md" "server/how-to-guides/operations/configure-logging-and-monitoring.md" +"livepatch_on_prem/how-to-guides/configure-proxy-for-fetching-patches.md" "server/how-to-guides/patch-management/configure-proxy-for-fetching-patches.md" +"livepatch_on_prem/how-to-guides/decommission.md" "server/how-to-guides/operations/decommission.md" +"livepatch_on_prem/how-to-guides/deploy-cve-service-via-snap.md" "server/how-to-guides/deployment/deploy-cve-service-via-snap.md" +"livepatch_on_prem/how-to-guides/deploy-via-juju.md" "server/how-to-guides/deployment/deploy-via-juju.md" +"livepatch_on_prem/how-to-guides/deploy-via-snap.md" "server/how-to-guides/deployment/deploy-via-snap.md" +"livepatch_on_prem/how-to-guides/fetch-patches.md" "server/how-to-guides/patch-management/fetch-patches.md" +"livepatch_on_prem/how-to-guides/generate-patch-health-report.md" "server/how-to-guides/operations/generate-patch-health-report.md" +"livepatch_on_prem/how-to-guides/harden-your-deployment.md" "server/how-to-guides/security/harden-your-deployment.md" +"livepatch_on_prem/how-to-guides/index.md" "server/how-to-guides/index.md" +"livepatch_on_prem/how-to-guides/manage-fleet-of-machines.md" "server/how-to-guides/operations/manage-fleet-of-machines.md" +"livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-k8s-operator-charm.md" "server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md" +"livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md" "server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md" +"livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-snap.md" "server/how-to-guides/deployment/migrate-from-reactive-charm-to-snap.md" +"livepatch_on_prem/how-to-guides/report-vulnerabilities.md" "server/how-to-guides/security/report-server-vulnerabilities.md" +"livepatch_on_prem/how-to-guides/scale-out.md" "server/how-to-guides/operations/scale-out.md" +"livepatch_on_prem/how-to-guides/setup-administration-tool.md" "server/how-to-guides/security/setup-administration-tool.md" +"livepatch_on_prem/how-to-guides/setup-tls.md" "server/how-to-guides/security/setup-tls.md" +"livepatch_on_prem/how-to-guides/upgrade-a-deployment.md" "server/how-to-guides/deployment/upgrade-a-deployment.md" +"livepatch_on_prem/how-to-guides/use-livepatch-client-with-on-prem-server.md" "server/how-to-guides/operations/use-livepatch-client-with-on-prem-server.md" +"livepatch_on_prem/how-to-guides/use-the-patch-downloader-tool.md" "server/how-to-guides/patch-management/use-the-patch-downloader-tool.md" +"livepatch_on_prem/index.md" "server/index.md" +"livepatch_on_prem/reference/authentication.md" "server/reference/authentication/authentication.md" +"livepatch_on_prem/reference/configuration.md" "server/reference/platform/configuration.md" +"livepatch_on_prem/reference/index.md" "server/reference/index.md" +"livepatch_on_prem/reference/network-access.md" "server/reference/platform/network-access.md" +"livepatch_on_prem/reference/patch-management.md" "server/reference/patch-management/patch-management.md" +"livepatch_on_prem/reference/resource-requirements.md" "server/reference/platform/resource-requirements.md" +"livepatch_on_prem/tutorial/airgapped-livepatch-and-microk8s.md" "server/tutorial/airgapped-livepatch-and-microk8s.md" +"livepatch_on_prem/tutorial/airgapped-livepatch-and-snap.md" "server/tutorial/airgapped-livepatch-and-snap.md" +"livepatch_on_prem/tutorial/index.md" "server/tutorial/index.md" +"livepatch_on_prem/tutorial/livepatch-and-lxd.md" "server/tutorial/livepatch-and-lxd.md" +"livepatch_on_prem/tutorial/livepatch-and-microk8s.md" "server/tutorial/livepatch-and-microk8s.md" +"livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/deploying-on-aws.md" "server/how-to-guides/deployment/public-clouds/deploying-on-aws.md" +"livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/deploying-on-azure.md" "server/how-to-guides/deployment/public-clouds/deploying-on-azure.md" +"livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/index.md" "server/how-to-guides/deployment/public-clouds/index.md" +"livepatch_server_on_public_clouds/index.md" "server/index.md" +"client/explanation/get-more-help.md" "support/get-more-help.md" +"client/explanation/report-bugs.md" "support/report-bugs.md" + +# Directory-level redirects for restructured sections +"livepatch_on_prem/reference/release-notes/" "release-notes/server/index" +"livepatch_server_on_public_clouds/how-to-guides/" "server/how-to-guides/deployment/public-clouds/" diff --git a/docs/release-notes/client/index.md b/docs/release-notes/client/index.md new file mode 100644 index 0000000..a51a6da --- /dev/null +++ b/docs/release-notes/client/index.md @@ -0,0 +1,10 @@ +--- +myst: + html_meta: + description: "Release Notes - technical reference for Livepatch client." +--- + + +(release-notes-client-release-notes-for-the-canonical-livepatch-client)= + +# Release Notes for the Canonical Livepatch Client diff --git a/docs/release-notes/index.md b/docs/release-notes/index.md new file mode 100644 index 0000000..9572972 --- /dev/null +++ b/docs/release-notes/index.md @@ -0,0 +1,24 @@ +--- +myst: + html_meta: + description: "Release notes for Livepatch client and server." +--- + +(release-notes)= + +# Release notes + +Find release notes for both Livepatch components: + +- [Client release notes](/release-notes/client/index.md) +- [Server release notes](/release-notes/server/index.md) + +```{toctree} +:titlesonly: +:maxdepth: 2 +:glob: +:hidden: + +Client +Server +``` diff --git a/docs/livepatch_on_prem/reference/release-notes.md b/docs/release-notes/server/index.md similarity index 94% rename from docs/livepatch_on_prem/reference/release-notes.md rename to docs/release-notes/server/index.md index 2cd0aea..5851117 100644 --- a/docs/livepatch_on_prem/reference/release-notes.md +++ b/docs/release-notes/server/index.md @@ -1,11 +1,11 @@ --- myst: html_meta: - description: "Release Notes - technical reference for Livepatch on-prem server." + description: "Release Notes - technical reference for Livepatch server." --- -(livepatch_on_prem-reference-release-notes-for-the-canonical-livepatch-server-k8s-charm)= +(release-notes-server-release-notes-for-the-canonical-livepatch-server-k8s-charm)= # Release Notes for the Canonical Livepatch Server (K8s charm) diff --git a/docs/livepatch_on_prem/explanation/access-control.md b/docs/server/explanation/architecture/access-control.md similarity index 81% rename from docs/livepatch_on_prem/explanation/access-control.md rename to docs/server/explanation/architecture/access-control.md index d32fc04..788e2c7 100644 --- a/docs/livepatch_on_prem/explanation/access-control.md +++ b/docs/server/explanation/architecture/access-control.md @@ -5,12 +5,12 @@ myst: --- -(livepatch_on_prem-explanation-access-control)= +(server-explanation-access-control)= # Access Control Access to a Livepatch on-prem instance is gated such that clients are authenticated before they can download patches. Access control is managed by means of generated tokens. These tokens act as a way of both authenticating client machines and assigning a tier to each machine, i.e. determining how and when patches get rolled out. -See this [how-to](/livepatch_on_prem/how-to-guides/use-livepatch-client-with-on-prem-server.md) to understand how to generate tokens. +See this [how-to](/server/how-to-guides/operations/use-livepatch-client-with-on-prem-server.md) to understand how to generate tokens. -For a technical reference of all authentication mechanisms (Basic Auth, Macaroons, resource tokens, sync tokens) and the cryptographic technologies they use, see [Authentication and authorization](/livepatch_on_prem/reference/authentication.md). +For a technical reference of all authentication mechanisms (Basic Auth, Macaroons, resource tokens, sync tokens) and the cryptographic technologies they use, see [Authentication and authorization](/server/reference/authentication/authentication.md). diff --git a/docs/server/explanation/architecture/index.md b/docs/server/explanation/architecture/index.md new file mode 100644 index 0000000..28d82c6 --- /dev/null +++ b/docs/server/explanation/architecture/index.md @@ -0,0 +1,28 @@ +--- +myst: + html_meta: + description: "Security model, lifecycle, and access control of the server." +--- + + +(server-explanation-architecture)= + +# Architecture + +Security model, lifecycle, and access control of the server. + +## In this section + +- [Security Overview](/server/explanation/architecture/security-overview.md) +- [Security Lifecycle](/server/explanation/architecture/security-lifecycle.md) +- [Access Control](/server/explanation/architecture/access-control.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Security overview +Security lifecycle +Access control +``` diff --git a/docs/livepatch_on_prem/explanation/security-lifecycle.md b/docs/server/explanation/architecture/security-lifecycle.md similarity index 98% rename from docs/livepatch_on_prem/explanation/security-lifecycle.md rename to docs/server/explanation/architecture/security-lifecycle.md index 643c808..8227bf7 100644 --- a/docs/livepatch_on_prem/explanation/security-lifecycle.md +++ b/docs/server/explanation/architecture/security-lifecycle.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-explanation-security-lifecycle)= +(server-explanation-security-lifecycle)= # Security Lifecycle diff --git a/docs/livepatch_on_prem/explanation/security-overview.md b/docs/server/explanation/architecture/security-overview.md similarity index 93% rename from docs/livepatch_on_prem/explanation/security-overview.md rename to docs/server/explanation/architecture/security-overview.md index 7d73a68..3ee6ae4 100644 --- a/docs/livepatch_on_prem/explanation/security-overview.md +++ b/docs/server/explanation/architecture/security-overview.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-explanation-security-overview)= +(server-explanation-security-overview)= # Security Overview @@ -41,7 +41,7 @@ The on-premises Livepatch Server acts as the central component in an on-premises The Livepatch Server incorporates several mechanisms to ensure the security of its operations: -- **Multi-layered authentication**: The server supports multiple authentication methods depending on the API consumer: macaroons (Basic Auth-backed) for admin users, machine tokens and Ubuntu Pro resource tokens for clients, and contract resource tokens or sync tokens for patch synchronization with upstream servers. For more details, refer to the [Authentication reference](/livepatch_on_prem/reference/authentication.md). +- **Multi-layered authentication**: The server supports multiple authentication methods depending on the API consumer: macaroons (Basic Auth-backed) for admin users, machine tokens and Ubuntu Pro resource tokens for clients, and contract resource tokens or sync tokens for patch synchronization with upstream servers. For more details, refer to the [Authentication reference](/server/reference/authentication/authentication.md). - **Request rate limiting**: An HTTP governor limits concurrent request processing and queues excess requests up to a configurable burst limit, protecting against overload and resource exhaustion. - **Input validation**: All API inputs are validated using strict schemas with regex patterns, length limits, and type checks across 10 validation modules. This mitigates injection attacks and malformed request handling. - **Structured security event logging**: All authentication successes and failures, authorization decisions, token lifecycle events, admin activity, and system events are logged as structured JSON in compliance with OWASP logging standards. @@ -127,9 +127,9 @@ A fix for a reported security issue that is directly present in the on-premises ## **Related security documentation** -- [Authentication reference](/livepatch_on_prem/reference/authentication.md): Technical details on all authentication and authorization mechanisms. -- [Harden your deployment](/livepatch_on_prem/how-to-guides/harden-your-deployment.md): How to securely configure the server for production deployments. -- [Configure logging and monitoring](/livepatch_on_prem/how-to-guides/configure-logging-and-monitoring.md): How to use the security event logging and Prometheus monitoring features. -- [Decommission the server securely](/livepatch_on_prem/how-to-guides/decommission.md): How to securely remove the server and its data. -- [Security lifecycle](/livepatch_on_prem/explanation/security-lifecycle.md): How security updates are delivered and applied. -- [Report vulnerabilities](/livepatch_on_prem/how-to-guides/report-vulnerabilities.md): How to report security vulnerabilities. +- [Authentication reference](/server/reference/authentication/authentication.md): Technical details on all authentication and authorization mechanisms. +- [Harden your deployment](/server/how-to-guides/security/harden-your-deployment.md): How to securely configure the server for production deployments. +- [Configure logging and monitoring](/server/how-to-guides/operations/configure-logging-and-monitoring.md): How to use the security event logging and Prometheus monitoring features. +- [Decommission the server securely](/server/how-to-guides/operations/decommission.md): How to securely remove the server and its data. +- [Security lifecycle](/server/explanation/architecture/security-lifecycle.md): How security updates are delivered and applied. +- [Report server vulnerabilities](/server/how-to-guides/security/report-server-vulnerabilities.md): How to report security vulnerabilities. diff --git a/docs/server/explanation/index.md b/docs/server/explanation/index.md new file mode 100644 index 0000000..3718ed6 --- /dev/null +++ b/docs/server/explanation/index.md @@ -0,0 +1,26 @@ +--- +myst: + html_meta: + description: "Explanation - learn about this topic in Livepatch on-prem." +--- + + +(server-explanation)= + +# Explanation + +Discussion and clarification of key topics related to Livepatch on-prem server. + +## In this section + +- [Architecture](/server/explanation/architecture/index.md) — Security model, lifecycle, and access control of the server. +- [Observability](/server/explanation/observability/index.md) — Logging and monitoring concepts. + +```{toctree} +:titlesonly: +:maxdepth: 2 +:hidden: + +Architecture +Observability +``` diff --git a/docs/server/explanation/observability/index.md b/docs/server/explanation/observability/index.md new file mode 100644 index 0000000..a5c4a1a --- /dev/null +++ b/docs/server/explanation/observability/index.md @@ -0,0 +1,24 @@ +--- +myst: + html_meta: + description: "Logging and monitoring concepts." +--- + + +(server-explanation-observability)= + +# Observability + +Logging and monitoring concepts. + +## In this section + +- [Logging and monitoring](/server/explanation/observability/logging-and-monitoring.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Logging and monitoring +``` diff --git a/docs/livepatch_on_prem/explanation/logging-and-monitoring.md b/docs/server/explanation/observability/logging-and-monitoring.md similarity index 85% rename from docs/livepatch_on_prem/explanation/logging-and-monitoring.md rename to docs/server/explanation/observability/logging-and-monitoring.md index 66ea302..3512170 100644 --- a/docs/livepatch_on_prem/explanation/logging-and-monitoring.md +++ b/docs/server/explanation/observability/logging-and-monitoring.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-explanation-logging-and-monitoring)= +(server-explanation-logging-and-monitoring)= # Logging and Monitoring @@ -13,10 +13,10 @@ Monitoring of the Livepatch server can be most easily done by setting up monitor The on-prem server also exposes Prometheus text-based formatted metrics available from a /metrics endpoint which can be used to monitor the system. -When deploying with Juju, debug logs from all deployed applications can be obtained with the command `juju debug-logs`. Increasing the server’s log level can be configured with `juju config livepatch log_level=` A full list of log levels are available on the Configure logging and monitoring [page](/livepatch_on_prem/how-to-guides/configure-logging-and-monitoring.md#configure-the-log-level). +When deploying with Juju, debug logs from all deployed applications can be obtained with the command `juju debug-logs`. Increasing the server’s log level can be configured with `juju config livepatch log_level=` A full list of log levels are available on the Configure logging and monitoring [page](/server/how-to-guides/operations/configure-logging-and-monitoring.md#configure-the-log-level). Further information on the use of juju for logging can be obtained from Juju’s [documentation](https://documentation.ubuntu.com/juju/latest/reference/juju-cli/list-of-juju-cli-commands/debug-log/). ## Security logging -For detailed guidance on configuring security event logging, Prometheus metrics, Grafana dashboards, log redaction, and centralized log forwarding, see [How to configure logging and monitoring](/livepatch_on_prem/how-to-guides/configure-logging-and-monitoring.md). +For detailed guidance on configuring security event logging, Prometheus metrics, Grafana dashboards, log redaction, and centralized log forwarding, see [How to configure logging and monitoring](/server/how-to-guides/operations/configure-logging-and-monitoring.md). diff --git a/docs/livepatch_on_prem/how-to-guides/deploy-cve-service-via-snap.md b/docs/server/how-to-guides/deployment/deploy-cve-service-via-snap.md similarity index 98% rename from docs/livepatch_on_prem/how-to-guides/deploy-cve-service-via-snap.md rename to docs/server/how-to-guides/deployment/deploy-cve-service-via-snap.md index 41c0b77..742888e 100644 --- a/docs/livepatch_on_prem/how-to-guides/deploy-cve-service-via-snap.md +++ b/docs/server/how-to-guides/deployment/deploy-cve-service-via-snap.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-how-to-guides-getting-started-with-the-cve-service-snap)= +(server-how-to-guides-getting-started-with-the-cve-service-snap)= # Getting Started with the CVE Service Snap diff --git a/docs/livepatch_on_prem/how-to-guides/deploy-via-juju.md b/docs/server/how-to-guides/deployment/deploy-via-juju.md similarity index 86% rename from docs/livepatch_on_prem/how-to-guides/deploy-via-juju.md rename to docs/server/how-to-guides/deployment/deploy-via-juju.md index 828abcc..ce90ae3 100644 --- a/docs/livepatch_on_prem/how-to-guides/deploy-via-juju.md +++ b/docs/server/how-to-guides/deployment/deploy-via-juju.md @@ -4,16 +4,16 @@ myst: description: "How to deploy via juju with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-how-to-deploy-livepatch-on-prem)= +(server-how-to-guides-how-to-deploy-livepatch-on-prem)= # How to deploy Livepatch on-prem ## Prerequisites ```{warning} -This guide has been deprecated. Refer to our [tutorials](/livepatch_on_prem/tutorial/index.md) or [snap how-to](/livepatch_on_prem/how-to-guides/deploy-via-snap.md). +This guide has been deprecated. Refer to our [tutorials](/server/tutorial/index.md) or [snap how-to](/server/how-to-guides/deployment/deploy-via-snap.md). -If you have an existing deployment using this document, see our [migration guide](/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md) to update your deployment. +If you have an existing deployment using this document, see our [migration guide](/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md) to update your deployment. ``` We will deploy and configure the livepatch on-prem server using Juju and Charmed Operators. Juju is an Open Source Charmed Operator Framework that controls the whole lifecycle of an application - including machine applications. Please follow the [installation instructions](https://documentation.ubuntu.com/juju/latest/howto/manage-juju/#install-juju) for your system. @@ -35,7 +35,7 @@ To get your Ubuntu Pro subscription token, please go to https://ubuntu.com/pro. Once you have Juju CLI installed, you will need to bootstrap a Juju controller to your cloud. The [Juju documentation](https://documentation.ubuntu.com/juju/latest/howto/manage-controllers/) has detailed instructions on how to do that for several clouds and machine types. -See[ resources topic ](/livepatch_on_prem/reference/resource-requirements.md) for requirements for the virtual machines running livepatch on-premises services. +See[ resources topic ](/server/reference/platform/resource-requirements.md) for requirements for the virtual machines running livepatch on-premises services. ## 2. Deploying the bundle @@ -121,7 +121,7 @@ Use the output of the previous command to configure livepatch: juju config livepatch auth_basic_users='username:$2y$10$74ZgHaxn...UH/Bbw6W2bmctm' ``` -See [Administration Tool](/livepatch_on_prem/how-to-guides/setup-administration-tool.md) topic for instructions on installing the administration tool and setting up authentication. +See [Administration Tool](/server/how-to-guides/security/setup-administration-tool.md) topic for instructions on installing the administration tool and setting up authentication. Once this has been done, the livepatch admin tool can be used to authenticate: @@ -133,7 +133,7 @@ livepatch-admin login -a [username:password] ## 5. Downloading patches -The final step before attaching client machines to the server is to download patches from Canonical servers. This can be done using the admin tool. See [How to setup administration tool](/livepatch_on_prem/how-to-guides/setup-administration-tool.md) for installation steps. +The final step before attaching client machines to the server is to download patches from Canonical servers. This can be done using the admin tool. See [How to setup administration tool](/server/how-to-guides/security/setup-administration-tool.md) for installation steps. To download patches, run: diff --git a/docs/livepatch_on_prem/how-to-guides/deploy-via-snap.md b/docs/server/how-to-guides/deployment/deploy-via-snap.md similarity index 97% rename from docs/livepatch_on_prem/how-to-guides/deploy-via-snap.md rename to docs/server/how-to-guides/deployment/deploy-via-snap.md index 6540484..56ebc94 100644 --- a/docs/livepatch_on_prem/how-to-guides/deploy-via-snap.md +++ b/docs/server/how-to-guides/deployment/deploy-via-snap.md @@ -4,7 +4,7 @@ myst: description: "How to deploy via snap with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-getting-started-with-the-livepatch-server-snap)= +(server-how-to-guides-getting-started-with-the-livepatch-server-snap)= # Getting started with the Livepatch Server Snap @@ -141,7 +141,7 @@ The default configuration is set to store the patches on the local filesystem of By default the Snap listens on localhost:8080 and so is not accessible to requests from external networks. To see this, run the following command: ``` -$ sudo snap get canonical-livepatch-server lp.server.server-address +sudo snap get canonical-livepatch-server lp.server.server-address localhost:8080 ``` diff --git a/docs/server/how-to-guides/deployment/index.md b/docs/server/how-to-guides/deployment/index.md new file mode 100644 index 0000000..29f4dd4 --- /dev/null +++ b/docs/server/how-to-guides/deployment/index.md @@ -0,0 +1,38 @@ +--- +myst: + html_meta: + description: "Deploy, upgrade, and migrate a Livepatch Server installation." +--- + + +(server-how-to-guides-deployment)= + +# Deployment + +Deploy, upgrade, and migrate a Livepatch Server installation. + +## In this section + +- [Deploy via Juju](/server/how-to-guides/deployment/deploy-via-juju.md) +- [Deploy via Snap](/server/how-to-guides/deployment/deploy-via-snap.md) +- [Deploy CVE Service via Snap](/server/how-to-guides/deployment/deploy-cve-service-via-snap.md) +- [Upgrade a deployment](/server/how-to-guides/deployment/upgrade-a-deployment.md) +- [Migrate from Reactive charm to snap](/server/how-to-guides/deployment/migrate-from-reactive-charm-to-snap.md) +- [Migrate from Reactive charm to Operator charm](/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md) +- [Migrate from Reactive Charm to K8s Operator charm](/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md) +- [Deploying on public clouds](/server/how-to-guides/deployment/public-clouds/index.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Deploy via juju +Deploy via snap +Deploy cve service via snap +Upgrade a deployment +Migrate from reactive charm to snap +Migrate from reactive charm to operator charm +Migrate from reactive charm to k8s operator charm +Public clouds +``` diff --git a/docs/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-k8s-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md similarity index 99% rename from docs/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-k8s-operator-charm.md rename to docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md index 243995b..ab812fd 100644 --- a/docs/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-k8s-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-k8s-operator-charm.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-how-to-guides-migrating-from-the-livepatch-machine-charm-to-the-k8s-charm)= +(server-how-to-guides-migrating-from-the-livepatch-machine-charm-to-the-k8s-charm)= # Migrating From The Livepatch Machine Charm to the K8s Charm diff --git a/docs/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md similarity index 98% rename from docs/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md rename to docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md index 076268e..6a09687 100644 --- a/docs/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md @@ -4,7 +4,7 @@ myst: description: "How to migrate from reactive charm to operator charm with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-migrating-from-the-old-livepatch-charm)= +(server-how-to-guides-migrating-from-the-old-livepatch-charm)= # Migrating from the old livepatch charm diff --git a/docs/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-snap.md b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-snap.md similarity index 94% rename from docs/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-snap.md rename to docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-snap.md index 3eada01..6e19c38 100644 --- a/docs/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-snap.md +++ b/docs/server/how-to-guides/deployment/migrate-from-reactive-charm-to-snap.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-how-to-guides-migration-from-livepatch-server-reactive-machine-charm-to-the-on-prem-snap)= +(server-how-to-guides-migration-from-livepatch-server-reactive-machine-charm-to-the-on-prem-snap)= # Migration from Livepatch Server Reactive Machine charm to the On-prem snap @@ -28,7 +28,7 @@ This guide specifically describes how to migrate from the Reactive charm (in cha ## Migrate Configuration -The new Livepatch server operator charms and snaps have different configuration keys when compared to the reactive charms. The configuration was restructured to be simple and easy to read. As a result, migrating the configuration from the reactive charm to the snap is not straightforward. However, we provide a tool with the Livepatch server snap that simplifies the process. [Refer to the "Migrate Configuration" table](/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md) to understand how the configuration keys have changed. +The new Livepatch server operator charms and snaps have different configuration keys when compared to the reactive charms. The configuration was restructured to be simple and easy to read. As a result, migrating the configuration from the reactive charm to the snap is not straightforward. However, we provide a tool with the Livepatch server snap that simplifies the process. [Refer to the "Migrate Configuration" table](/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md) to understand how the configuration keys have changed. 1. To access the migration tool, install the [canonical-livepatch-server snap](https://snapcraft.io/canonical-livepatch-server). This is the same snap that will be used later to set up the Livepatch server. @@ -82,7 +82,7 @@ The new Livepatch server operator charms and snaps have different configuration -i /var/snap/canonical-livepatch-server/common/old-config.yaml --set-config ``` - 5. Review the new configuration of the Livepatch server snap and make modifications where needed. Refer to the [configuration documentation](/livepatch_on_prem/reference/configuration.md) for more information. + 5. Review the new configuration of the Livepatch server snap and make modifications where needed. Refer to the [configuration documentation](/server/reference/platform/configuration.md) for more information. - To view the new configuration run: @@ -96,7 +96,7 @@ The new Livepatch server operator charms and snaps have different configuration sudo snap set canonical-livepatch-server lp.= ``` -(livepatch_on_prem-how-to-guides-database-migration)= +(server-how-to-guides-database-migration)= ## Database Migration @@ -141,7 +141,7 @@ This setup can differ on a case by case basis and would result in slightly diffe ``` ```{note} -If the reactive charm deployment of the Livepatch server uses the \`filesystem\` patch storage type, the database dump step might be a little different. Refer the [Patch Migration section](#livepatch_on_prem-how-to-guides-patch-migration) below for more information on a different command to run for the database dump. +If the reactive charm deployment of the Livepatch server uses the \`filesystem\` patch storage type, the database dump step might be a little different. Refer the [Patch Migration section](#server-how-to-guides-patch-migration) below for more information on a different command to run for the database dump. ``` 5. Copy the dump file to an environment accessible by the new PostgreSQL database deployment. In our case, the dump file will be copied to the docker container running the database i.e. container with name `postgresql`. @@ -167,7 +167,7 @@ If the reactive charm deployment of the Livepatch server uses the \`filesystem\` After successfully completing these steps, the new PostgreSQL database will contain all the data present in the PostgreSQL charm. The next section explains how the patches synced from the upstream Livepatch server can be migrated to be used by the Livepatch server snap. -(livepatch_on_prem-how-to-guides-patch-migration)= +(server-how-to-guides-patch-migration)= ## Patch Migration @@ -192,7 +192,7 @@ Let us consider the different patch storage types and the migration steps necess - If the filesystem where the patches are stored is accessible, and the patches can be easily moved from the machine on which the Livepatch server is running as a reactive charm, to the machine running the Livepatch server snap, the patch migration process is straightforward. This method saves us the time, resources and effort of redownloading all the patches from the upstream Livepatch server. - - For this example, we will consider that the Livepatch server reactive charm is running on an LXD container and the Livepatch server snap runs on the host machine running the LXD container. The patches are stored in the /livepatch directory of the LXD container. The patch migration process involves copying the patches to the Livepatch server snap machine, and then moving the patches to the snap’s [$SNAP_COMMON](https://snapcraft.io/docs/environment-variables#snap-common) directory. + - For this example, we will consider that the Livepatch server reactive charm is running on an LXD container and the Livepatch server snap runs on the host machine running the LXD container. The patches are stored in the /livepatch directory of the LXD container. The patch migration process involves copying the patches to the Livepatch server snap machine, and then moving the patches to the snap’s [$SNAP_COMMON](https://snapcraft.io/docs/reference/development/environment-variables/#snap-common) directory. ```shell # Pull patch files from the LXD container sudo lxc file pull /livepatch/ \ @@ -214,7 +214,7 @@ Let us consider the different patch storage types and the migration steps necess > dump-file ``` - - This command will ensure that the patch file data in specific tables is not migrated. The rest of the steps for database migration are the same as described in the [Database migration section](#livepatch_on_prem-how-to-guides-database-migration). + - This command will ensure that the patch file data in specific tables is not migrated. The rest of the steps for database migration are the same as described in the [Database migration section](#server-how-to-guides-database-migration). - This enables users to sync patches from the upstream Livepatch server and fill the patch file data in the database. The steps for patch synchronization and populating patch file data are described in the next section. @@ -222,8 +222,8 @@ Let us consider the different patch storage types and the migration steps necess The livepatch-admin tool is useful for syncing patches from the upstream Livepatch server and populating the database with the synced patch data. Follow the how-to guides mentioned below to set up the livepatch-admin tool and synchronize patches from the hosted Livepatch server. -1. [How to set up the livepatch-admin tool](/livepatch_on_prem/how-to-guides/setup-administration-tool.md) -2. [How to fetch patches from the hosted Livepatch server](/livepatch_on_prem/how-to-guides/fetch-patches.md) +1. [How to set up the livepatch-admin tool](/server/how-to-guides/security/setup-administration-tool.md) +2. [How to fetch patches from the hosted Livepatch server](/server/how-to-guides/patch-management/fetch-patches.md) Once the patches have been downloaded, run `livepatch-admin storage refresh` to sync the patch storage and patch data in the database. diff --git a/docs/livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/deploying-on-aws.md b/docs/server/how-to-guides/deployment/public-clouds/deploying-on-aws.md similarity index 98% rename from docs/livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/deploying-on-aws.md rename to docs/server/how-to-guides/deployment/public-clouds/deploying-on-aws.md index 06e1092..38d860a 100644 --- a/docs/livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/deploying-on-aws.md +++ b/docs/server/how-to-guides/deployment/public-clouds/deploying-on-aws.md @@ -5,11 +5,11 @@ myst: --- -(livepatch_server_on_public_clouds-how-to-guides-deploying-the-livepatch-server-snap-on-aws)= +(server-how-to-guides-deploying-the-livepatch-server-snap-on-aws)= # Deploying the Livepatch Server Snap on AWS -This section details how to deploy the Livepatch Server snap in auto-scaling configuration on Azure. +This section details how to deploy the Livepatch Server snap in auto-scaling configuration on AWS. ## Required Resources @@ -67,7 +67,7 @@ write_files: export S3BUCKET= export S3ENDPOINT= export S3REGION= - export URLTEMPLATE=https://.s3-.amazonaws.com/{filaname} + export URLTEMPLATE=https://.s3-.amazonaws.com/{filename} - path: /etc/livepatch/database_url permissions: "0600" owner: root:root diff --git a/docs/livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/deploying-on-azure.md b/docs/server/how-to-guides/deployment/public-clouds/deploying-on-azure.md similarity index 98% rename from docs/livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/deploying-on-azure.md rename to docs/server/how-to-guides/deployment/public-clouds/deploying-on-azure.md index 21e9c2e..54984ad 100644 --- a/docs/livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/deploying-on-azure.md +++ b/docs/server/how-to-guides/deployment/public-clouds/deploying-on-azure.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_server_on_public_clouds-how-to-guides-deploying-the-livepatch-server-snap-on-azure)= +(server-how-to-guides-deploying-the-livepatch-server-snap-on-azure)= # Deploying the Livepatch Server snap on Azure diff --git a/docs/livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/index.md b/docs/server/how-to-guides/deployment/public-clouds/index.md similarity index 97% rename from docs/livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/index.md rename to docs/server/how-to-guides/deployment/public-clouds/index.md index 45ad597..d49bd02 100644 --- a/docs/livepatch_server_on_public_clouds/how-to-guides/deploying-the-livepatch-server-snap-on-public-clouds/index.md +++ b/docs/server/how-to-guides/deployment/public-clouds/index.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_server_on_public_clouds-how-to-guides-deploying-the-livepatch-server-snap-on-public-clouds)= +(server-how-to-guides-deployment-public-clouds)= # Deploying The Livepatch Server Snap On Public Clouds @@ -146,6 +146,6 @@ With all the configurations written in the cloud-config.yaml you can easily crea :glob: :hidden: -deploying-on-aws -deploying-on-azure +Deploying on aws +Deploying on azure ``` diff --git a/docs/livepatch_on_prem/how-to-guides/upgrade-a-deployment.md b/docs/server/how-to-guides/deployment/upgrade-a-deployment.md similarity index 92% rename from docs/livepatch_on_prem/how-to-guides/upgrade-a-deployment.md rename to docs/server/how-to-guides/deployment/upgrade-a-deployment.md index 1dc5dbc..c0efe57 100644 --- a/docs/livepatch_on_prem/how-to-guides/upgrade-a-deployment.md +++ b/docs/server/how-to-guides/deployment/upgrade-a-deployment.md @@ -4,7 +4,7 @@ myst: description: "How to upgrade a deployment with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-how-to-upgrade-a-livepatch-on-prem-deployment)= +(server-how-to-guides-how-to-upgrade-a-livepatch-on-prem-deployment)= # How to upgrade a Livepatch on-prem deployment diff --git a/docs/server/how-to-guides/index.md b/docs/server/how-to-guides/index.md new file mode 100644 index 0000000..ea0951d --- /dev/null +++ b/docs/server/how-to-guides/index.md @@ -0,0 +1,30 @@ +--- +myst: + html_meta: + description: "How-to guides with Livepatch on-prem." +--- + + +(server-how-to-guides)= + +# How-To-Guides + +Step-by-step guides covering key operations and common tasks related to Livepatch on-prem server. + +## In this section + +- [Deployment](/server/how-to-guides/deployment/index.md) — Deploy, upgrade, and migrate a Livepatch Server installation. +- [Patch management](/server/how-to-guides/patch-management/index.md) — Fetch, download, proxy, and chain patches across servers. +- [Operations](/server/how-to-guides/operations/index.md) — Run, scale, monitor, and decommission a deployment. +- [Security](/server/how-to-guides/security/index.md) — Secure the server with TLS, hardening, admin tooling, and vulnerability reporting. + +```{toctree} +:titlesonly: +:maxdepth: 2 +:hidden: + +Deployment +Patch management +Operations +Security +``` diff --git a/docs/livepatch_on_prem/how-to-guides/configure-logging-and-monitoring.md b/docs/server/how-to-guides/operations/configure-logging-and-monitoring.md similarity index 95% rename from docs/livepatch_on_prem/how-to-guides/configure-logging-and-monitoring.md rename to docs/server/how-to-guides/operations/configure-logging-and-monitoring.md index 9ac56aa..868e60e 100644 --- a/docs/livepatch_on_prem/how-to-guides/configure-logging-and-monitoring.md +++ b/docs/server/how-to-guides/operations/configure-logging-and-monitoring.md @@ -5,13 +5,13 @@ myst: --- -(livepatch_on_prem-how-to-guides-configure-logging-and-monitoring-for-livepatch-server)= +(server-how-to-guides-configure-logging-and-monitoring-for-livepatch-server)= # Configure logging and monitoring for Livepatch server -The Livepatch Server provides structured security event logging and Prometheus metrics for monitoring. This document describes how to configure and consume these security-relevant features. For general monitoring concepts and debug endpoints, see the existing [Logging and Monitoring explanation](/livepatch_on_prem/explanation/logging-and-monitoring.md). +The Livepatch Server provides structured security event logging and Prometheus metrics for monitoring. This document describes how to configure and consume these security-relevant features. For general monitoring concepts and debug endpoints, see the existing [Logging and Monitoring explanation](/server/explanation/observability/logging-and-monitoring.md). -(livepatch_on_prem-how-to-guides-configure-the-log-level)= +(server-how-to-guides-configure-the-log-level)= ## Configure the log level diff --git a/docs/livepatch_on_prem/how-to-guides/decommission.md b/docs/server/how-to-guides/operations/decommission.md similarity index 97% rename from docs/livepatch_on_prem/how-to-guides/decommission.md rename to docs/server/how-to-guides/operations/decommission.md index e9e8df3..f3a8788 100644 --- a/docs/livepatch_on_prem/how-to-guides/decommission.md +++ b/docs/server/how-to-guides/operations/decommission.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-how-to-guides-decommission-livepatch-server-securely)= +(server-how-to-guides-decommission-livepatch-server-securely)= # Decommission Livepatch server securely diff --git a/docs/livepatch_on_prem/how-to-guides/generate-patch-health-report.md b/docs/server/how-to-guides/operations/generate-patch-health-report.md similarity index 78% rename from docs/livepatch_on_prem/how-to-guides/generate-patch-health-report.md rename to docs/server/how-to-guides/operations/generate-patch-health-report.md index 58ce484..62da187 100644 --- a/docs/livepatch_on_prem/how-to-guides/generate-patch-health-report.md +++ b/docs/server/how-to-guides/operations/generate-patch-health-report.md @@ -4,7 +4,7 @@ myst: description: "How to generate patch health report with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-how-to-generate-livepatch-on-prem-patch-health-report)= +(server-how-to-guides-how-to-generate-livepatch-on-prem-patch-health-report)= # How to generate Livepatch on-prem patch health report diff --git a/docs/server/how-to-guides/operations/index.md b/docs/server/how-to-guides/operations/index.md new file mode 100644 index 0000000..ff7e4fb --- /dev/null +++ b/docs/server/how-to-guides/operations/index.md @@ -0,0 +1,34 @@ +--- +myst: + html_meta: + description: "Run, scale, monitor, and decommission a deployment." +--- + + +(server-how-to-guides-operations)= + +# Operations + +Run, scale, monitor, and decommission a deployment. + +## In this section + +- [Manage fleet of machines](/server/how-to-guides/operations/manage-fleet-of-machines.md) +- [Generate patch health report](/server/how-to-guides/operations/generate-patch-health-report.md) +- [Scale out](/server/how-to-guides/operations/scale-out.md) +- [Configure logging and monitoring](/server/how-to-guides/operations/configure-logging-and-monitoring.md) +- [Decommission](/server/how-to-guides/operations/decommission.md) +- [Use Livepatch client with on-prem server](/server/how-to-guides/operations/use-livepatch-client-with-on-prem-server.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Manage fleet of machines +Generate patch health report +Scale out +Configure logging and monitoring +Decommission +Use livepatch client with on prem server +``` diff --git a/docs/livepatch_on_prem/how-to-guides/manage-fleet-of-machines.md b/docs/server/how-to-guides/operations/manage-fleet-of-machines.md similarity index 92% rename from docs/livepatch_on_prem/how-to-guides/manage-fleet-of-machines.md rename to docs/server/how-to-guides/operations/manage-fleet-of-machines.md index 3037ed1..17aaa38 100644 --- a/docs/livepatch_on_prem/how-to-guides/manage-fleet-of-machines.md +++ b/docs/server/how-to-guides/operations/manage-fleet-of-machines.md @@ -4,7 +4,7 @@ myst: description: "How to manage fleet of machines with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-how-to-manage-livepatch-on-prem-fleet)= +(server-how-to-guides-how-to-manage-livepatch-on-prem-fleet)= # How to manage Livepatch on-prem fleet diff --git a/docs/livepatch_on_prem/how-to-guides/scale-out.md b/docs/server/how-to-guides/operations/scale-out.md similarity index 96% rename from docs/livepatch_on_prem/how-to-guides/scale-out.md rename to docs/server/how-to-guides/operations/scale-out.md index 3912ade..b9444be 100644 --- a/docs/livepatch_on_prem/how-to-guides/scale-out.md +++ b/docs/server/how-to-guides/operations/scale-out.md @@ -4,7 +4,7 @@ myst: description: "How to scale out with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-how-to-scale-out-a-livepatch-on-prem-deployment)= +(server-how-to-guides-how-to-scale-out-a-livepatch-on-prem-deployment)= # How to scale out a Livepatch on-prem deployment diff --git a/docs/livepatch_on_prem/how-to-guides/use-livepatch-client-with-on-prem-server.md b/docs/server/how-to-guides/operations/use-livepatch-client-with-on-prem-server.md similarity index 89% rename from docs/livepatch_on_prem/how-to-guides/use-livepatch-client-with-on-prem-server.md rename to docs/server/how-to-guides/operations/use-livepatch-client-with-on-prem-server.md index 7c42b40..1c865fe 100644 --- a/docs/livepatch_on_prem/how-to-guides/use-livepatch-client-with-on-prem-server.md +++ b/docs/server/how-to-guides/operations/use-livepatch-client-with-on-prem-server.md @@ -4,7 +4,7 @@ myst: description: "How to use livepatch client with on-prem server with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-how-to-use-livepatch-client-with-an-on-prem-server)= +(server-how-to-guides-how-to-use-livepatch-client-with-an-on-prem-server)= # How to use Livepatch client with an on-prem server @@ -25,7 +25,7 @@ To configure this livepatch client to start pulling patches from the on-prem liv livepatch-admin auth-token ``` -The tier parameter is one of the tiers available on the server. The client will download patches as they become available in that tier. See [this page](/livepatch_on_prem/reference/patch-management.md) on how to manage tiers and patches in your on-prem server. +The tier parameter is one of the tiers available on the server. The client will download patches as they become available in that tier. See [this page](/server/reference/patch-management/patch-management.md) on how to manage tiers and patches in your on-prem server. The id parameter bears no significance in an on-prem deployment. It can be set to a value identifying the group of livepatch clients that will be enabled using the same token (a single authorization token can be used to enable multiple client instances). diff --git a/docs/livepatch_on_prem/how-to-guides/chain-livepatch-servers.md b/docs/server/how-to-guides/patch-management/chain-livepatch-servers.md similarity index 84% rename from docs/livepatch_on_prem/how-to-guides/chain-livepatch-servers.md rename to docs/server/how-to-guides/patch-management/chain-livepatch-servers.md index 0e853d3..629e2cf 100644 --- a/docs/livepatch_on_prem/how-to-guides/chain-livepatch-servers.md +++ b/docs/server/how-to-guides/patch-management/chain-livepatch-servers.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-how-to-guides-chain-on-prem-servers)= +(server-how-to-guides-chain-on-prem-servers)= # Chain On-Prem Servers @@ -22,9 +22,9 @@ In order to chain on-prem server you need: - An existing Livepatch on-prem server. - A new deployment of the Livepatch on-prem server. -- The Livepatch admin tool [setup](./setup-administration-tool) against the existing server. +- The Livepatch admin tool [setup](/server/how-to-guides/security/setup-administration-tool.md) against the existing server. -When deploying an instance of the Livepatch server (see our existing [guides](./index)) you will normally use an Ubuntu Pro token to configure the on-premise server to sync with Canonical's hosted Livepatch server. +When deploying an instance of the Livepatch server (see our existing [guides](/server/how-to-guides/index.md)) you will normally use an Ubuntu Pro token to configure the on-premise server to sync with Canonical's hosted Livepatch server. In this scenario, we can skip that step as we will use a token provided by our existing Livepatch server. @@ -45,7 +45,7 @@ Change `edge` if you would like to sync from a different tier. ```{note} -See our [reference doc](/livepatch_on_prem/reference/patch-management.md) to better understand how tiers work and how patches are synced. +See our [reference doc](/server/reference/patch-management/patch-management.md) to better understand how tiers work and how patches are synced. ``` diff --git a/docs/livepatch_on_prem/how-to-guides/configure-proxy-for-fetching-patches.md b/docs/server/how-to-guides/patch-management/configure-proxy-for-fetching-patches.md similarity index 84% rename from docs/livepatch_on_prem/how-to-guides/configure-proxy-for-fetching-patches.md rename to docs/server/how-to-guides/patch-management/configure-proxy-for-fetching-patches.md index 258ba79..e8a734a 100644 --- a/docs/livepatch_on_prem/how-to-guides/configure-proxy-for-fetching-patches.md +++ b/docs/server/how-to-guides/patch-management/configure-proxy-for-fetching-patches.md @@ -4,13 +4,13 @@ myst: description: "How to configure proxy for fetching patches with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-use-a-proxy-when-fetching-patches)= +(server-how-to-guides-use-a-proxy-when-fetching-patches)= # Use a proxy when fetching patches Livepatch on-prem server can fetch patches through an HTTP proxy. The configuration steps vary depending on the deployment platform. -See our [patch-sync config](/livepatch_on_prem/reference/configuration.md) for more details. +See our [patch-sync config](/server/reference/platform/configuration.md) for more details. ## Juju deployments (latest charms) @@ -25,7 +25,7 @@ juju config livepatch \ ## Juju deployments (deprecated charm) -If Livepatch on-prem has been deployed using Juju with our older reactive charm (see our migration guide [here](/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md)), run the following Juju configuration command: +If Livepatch on-prem has been deployed using Juju with our older reactive charm (see our migration guide [here](/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md)), run the following Juju configuration command: ```bash juju config livepatch \ diff --git a/docs/livepatch_on_prem/how-to-guides/fetch-patches.md b/docs/server/how-to-guides/patch-management/fetch-patches.md similarity index 77% rename from docs/livepatch_on_prem/how-to-guides/fetch-patches.md rename to docs/server/how-to-guides/patch-management/fetch-patches.md index 81fbc02..bbbb024 100644 --- a/docs/livepatch_on_prem/how-to-guides/fetch-patches.md +++ b/docs/server/how-to-guides/patch-management/fetch-patches.md @@ -4,11 +4,11 @@ myst: description: "How to fetch patches with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-how-to-fetch-patches-to-livepatch-on-prem-server)= +(server-how-to-guides-how-to-fetch-patches-to-livepatch-on-prem-server)= # How to fetch patches to livepatch on-prem server -The livepatch application is configured to fetch patch updates every 24 hours. This setting is [configurable](/livepatch_on_prem/reference/configuration.md). +The livepatch application is configured to fetch patch updates every 24 hours. This setting is [configurable](/server/reference/platform/configuration.md). Patch snapshot downloads can also be manually triggered: diff --git a/docs/server/how-to-guides/patch-management/index.md b/docs/server/how-to-guides/patch-management/index.md new file mode 100644 index 0000000..5b6937c --- /dev/null +++ b/docs/server/how-to-guides/patch-management/index.md @@ -0,0 +1,30 @@ +--- +myst: + html_meta: + description: "Fetch, download, proxy, and chain patches across servers." +--- + + +(server-how-to-guides-patch-management)= + +# Patch management + +Fetch, download, proxy, and chain patches across servers. + +## In this section + +- [Fetch patches](/server/how-to-guides/patch-management/fetch-patches.md) +- [Use the Patch Downloader Tool](/server/how-to-guides/patch-management/use-the-patch-downloader-tool.md) +- [Configure proxy for fetching patches](/server/how-to-guides/patch-management/configure-proxy-for-fetching-patches.md) +- [Chain Livepatch Servers](/server/how-to-guides/patch-management/chain-livepatch-servers.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Fetch patches +Use the patch downloader tool +Configure proxy for fetching patches +Chain livepatch servers +``` diff --git a/docs/livepatch_on_prem/how-to-guides/use-the-patch-downloader-tool.md b/docs/server/how-to-guides/patch-management/use-the-patch-downloader-tool.md similarity index 94% rename from docs/livepatch_on_prem/how-to-guides/use-the-patch-downloader-tool.md rename to docs/server/how-to-guides/patch-management/use-the-patch-downloader-tool.md index fe23ae2..5d9ca44 100644 --- a/docs/livepatch_on_prem/how-to-guides/use-the-patch-downloader-tool.md +++ b/docs/server/how-to-guides/patch-management/use-the-patch-downloader-tool.md @@ -4,7 +4,7 @@ myst: description: "How to use the patch downloader tool with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-how-to-use-the-canonical-livepatch-downloader)= +(server-how-to-guides-how-to-use-the-canonical-livepatch-downloader)= # How to use the Canonical Livepatch Downloader @@ -44,7 +44,7 @@ canonical-livepatch-downloader list --kernel=$KERNEL_VERSION --architecture=amd6 A sample output for a specific kernel version is provided below: ``` -$ canonical-livepatch-downloader list --kernel=5.15.0-107.117-generic --architecture=amd64 +canonical-livepatch-downloader list --kernel=5.15.0-107.117-generic --architecture=amd64 - filename: livepatch-5.15.0-107.117-generic-107.1-amd64.tar.bz2 hash: 696070a5dfb927bc9dcec809f7ba81c059e981a02829b44253e8ecf84d829fb5 - filename: livepatch-5.15.0-107.117-generic-106.1-amd64.tar.bz2 @@ -64,7 +64,7 @@ canonical-livepatch-downloader get-latest --kernel=$KERNEL_VERSION --architectur An example output is provided below ``` -$ canonical-livepatch-downloader get-latest --kernel=5.15.0-107.117-generic --architecture=amd64 +canonical-livepatch-downloader get-latest --kernel=5.15.0-107.117-generic --architecture=amd64 Downloading patch 1/1 Patch livepatch-5.15.0-107.117-generic-107.1-amd64 downloaded and extracted to /home/demo/snap/canonical-livepatch-downloader/common/patches/livepatch-5.15.0-107.117-generic-107.1-amd64 ``` @@ -88,7 +88,7 @@ The list command provides filtering based on the following parameters: - Architecture: Specify a fixed architecture string, e.g. "amd64" or "s390x" - Flavour: Specify a kernel flavour, e.g. "generic", "lowlatency", etc. - Kernel: A prefix match on kernel versions. E.g. 6.2 will match kernel versions 6.2.\* -- Tier: Specify the tier from which to download patches, defaults to "Proposed". See [here](/livepatch/explanation/what-are-livepatch-tiers.md) for more info on tiers. +- Tier: Specify the tier from which to download patches, defaults to "Proposed". See [here](/client/explanation/architecture/what-are-livepatch-tiers.md) for more info on tiers. The same flag cannot be passed multiple times. If multiple kernel versions, flavours or architectures are desired, run the following commands with each combination. diff --git a/docs/livepatch_on_prem/how-to-guides/harden-your-deployment.md b/docs/server/how-to-guides/security/harden-your-deployment.md similarity index 93% rename from docs/livepatch_on_prem/how-to-guides/harden-your-deployment.md rename to docs/server/how-to-guides/security/harden-your-deployment.md index fbc7b52..cb792bb 100644 --- a/docs/livepatch_on_prem/how-to-guides/harden-your-deployment.md +++ b/docs/server/how-to-guides/security/harden-your-deployment.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-how-to-guides-harden-your-livepatch-server-deployment)= +(server-how-to-guides-harden-your-livepatch-server-deployment)= # Harden your Livepatch server deployment @@ -31,11 +31,11 @@ For **snap deployments**, a reverse proxy (for example, Nginx or HAProxy) can be Without TLS termination, all communication — including authentication credentials — is transmitted in plaintext. This is acceptable on a fully trusted internal network, but not recommended when any network segment is untrusted. -For step-by-step TLS setup instructions, see the [TLS configuration guide](/livepatch_on_prem/how-to-guides/setup-tls.md). +For step-by-step TLS setup instructions, see the [TLS configuration guide](/server/how-to-guides/security/setup-tls.md). ### Federation (chained servers) -In [federated deployments](/livepatch_on_prem/how-to-guides/chain-livepatch-servers.md) where multiple on-premises servers are chained, TLS should also be enabled between them to protect the exchange of tier and patch data. Configure TLS termination on the upstream server just as you would for client-facing traffic. +In [federated deployments](/server/how-to-guides/patch-management/chain-livepatch-servers.md) where multiple on-premises servers are chained, TLS should also be enabled between them to protect the exchange of tier and patch data. Configure TLS termination on the upstream server just as you would for client-facing traffic. ## Encrypt database connections @@ -149,7 +149,7 @@ All server data is stored under the `$SNAP_COMMON` and `$SNAP_DATA` directories. ### Client machines -When a Livepatch Client is registered with the on-premises server, an authentication token is stored on the client machine. Ensure only authorized users have `sudo` access to hosts running the Livepatch Client, as the token grants the ability to authenticate against the server. For details on client registration, see the [client setup guide](/livepatch_on_prem/how-to-guides/use-livepatch-client-with-on-prem-server.md). +When a Livepatch Client is registered with the on-premises server, an authentication token is stored on the client machine. Ensure only authorized users have `sudo` access to hosts running the Livepatch Client, as the token grants the ability to authenticate against the server. For details on client registration, see the [client setup guide](/server/how-to-guides/operations/use-livepatch-client-with-on-prem-server.md). ### Charm (Kubernetes) @@ -170,7 +170,7 @@ To reset the snap configuration to its default state: sudo snap set canonical-livepatch-server key= ``` -Alternatively, remove and reinstall the snap (see [decommissioning](/livepatch_on_prem/how-to-guides/decommission.md)). +Alternatively, remove and reinstall the snap (see [decommissioning](/server/how-to-guides/operations/decommission.md)). ### Charm diff --git a/docs/server/how-to-guides/security/index.md b/docs/server/how-to-guides/security/index.md new file mode 100644 index 0000000..942e550 --- /dev/null +++ b/docs/server/how-to-guides/security/index.md @@ -0,0 +1,30 @@ +--- +myst: + html_meta: + description: "Secure the server with TLS, hardening, admin tooling, and vulnerability reporting." +--- + + +(server-how-to-guides-security)= + +# Security + +Secure the server with TLS, hardening, admin tooling, and vulnerability reporting. + +## In this section + +- [Setup TLS](/server/how-to-guides/security/setup-tls.md) +- [Harden your deployment](/server/how-to-guides/security/harden-your-deployment.md) +- [Setup administration tool](/server/how-to-guides/security/setup-administration-tool.md) +- [Report server vulnerabilities](/server/how-to-guides/security/report-server-vulnerabilities.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Setup tls +Harden your deployment +Setup administration tool +Report server vulnerabilities +``` diff --git a/docs/livepatch_on_prem/how-to-guides/report-vulnerabilities.md b/docs/server/how-to-guides/security/report-server-vulnerabilities.md similarity index 93% rename from docs/livepatch_on_prem/how-to-guides/report-vulnerabilities.md rename to docs/server/how-to-guides/security/report-server-vulnerabilities.md index 12735c1..4d2193f 100644 --- a/docs/livepatch_on_prem/how-to-guides/report-vulnerabilities.md +++ b/docs/server/how-to-guides/security/report-server-vulnerabilities.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-how-to-guides-report-a-livepatch-server-vulnerability)= +(server-how-to-guides-report-a-livepatch-server-vulnerability)= # Report a Livepatch Server vulnerability diff --git a/docs/livepatch_on_prem/how-to-guides/setup-administration-tool.md b/docs/server/how-to-guides/security/setup-administration-tool.md similarity index 93% rename from docs/livepatch_on_prem/how-to-guides/setup-administration-tool.md rename to docs/server/how-to-guides/security/setup-administration-tool.md index e5b8199..236888d 100644 --- a/docs/livepatch_on_prem/how-to-guides/setup-administration-tool.md +++ b/docs/server/how-to-guides/security/setup-administration-tool.md @@ -4,7 +4,7 @@ myst: description: "How to setup administration tool with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-how-to-setup-livepatch-on-prem-server-administration-tool)= +(server-how-to-guides-how-to-setup-livepatch-on-prem-server-administration-tool)= # How to setup Livepatch on-prem server administration tool @@ -27,7 +27,7 @@ There are two ways for the livepatch administration tool to authenticate with th - Ubuntu SSO - Username/password -(livepatch_on_prem-how-to-guides-password-authentication)= +(server-how-to-guides-password-authentication)= ## Password authentication diff --git a/docs/livepatch_on_prem/how-to-guides/setup-tls.md b/docs/server/how-to-guides/security/setup-tls.md similarity index 92% rename from docs/livepatch_on_prem/how-to-guides/setup-tls.md rename to docs/server/how-to-guides/security/setup-tls.md index 30ef148..f25f00f 100644 --- a/docs/livepatch_on_prem/how-to-guides/setup-tls.md +++ b/docs/server/how-to-guides/security/setup-tls.md @@ -4,7 +4,7 @@ myst: description: "How to setup tls with Livepatch on-prem." --- -(livepatch_on_prem-how-to-guides-how-to-setup-tls-for-livepatch-on-prem)= +(server-how-to-guides-how-to-setup-tls-for-livepatch-on-prem)= # How to setup TLS for Livepatch on-prem @@ -47,7 +47,7 @@ juju deploy ch:canonical-livepatch-onprem --overlay ./tls-overlay.yaml 4. Run `juju status` to verify that the haproxy service is now exposing port 443 ![screenshot_20210603_165758|690x55](/_static/images/nuS5aGmo44qwv5vagLczO0tnfog.png) -(livepatch_on_prem-how-to-guides-configuring-livepatch-admin-tool-with-tls)= +(server-how-to-guides-configuring-livepatch-admin-tool-with-tls)= ## Configuring livepatch admin tool with TLS @@ -87,4 +87,4 @@ If a self-signed certificate is used for the livepatch on-prem service, livepatc sudo canonical-livepatch config ca-certs=@stdin < ./cert.pem ``` -For more information on how to configure an HTTPS proxy on the Livepatch Client, please check out [this](/livepatch/how-to-guides/configure-proxy.md) guide. +For more information on how to configure an HTTPS proxy on the Livepatch Client, please check out [this](/client/how-to-guides/configuration/configure-proxy.md) guide. diff --git a/docs/livepatch_on_prem/index.md b/docs/server/index.md similarity index 65% rename from docs/livepatch_on_prem/index.md rename to docs/server/index.md index 0df7204..8ec18bc 100644 --- a/docs/livepatch_on_prem/index.md +++ b/docs/server/index.md @@ -5,9 +5,9 @@ myst: --- -(livepatch_on_prem)= +(server)= -# On-Prem erver +# Server Livepatch on-prem is an on-premises deployment of the Livepatch server. @@ -17,8 +17,8 @@ Its purpose is to pull in patch updates from Canonical and allow more fine-grain | | | |-|-| -| [Tutorials](/livepatch_on_prem/how-to-guides/index.md)
Get started with a hands-on introduction for new users deploying Livepatch. | [How-to guides](/livepatch_on_prem/how-to-guides/index.md)
Step-by-step guides covering key operations and common tasks
| -| [Explanation](/livepatch_on_prem/explanation/index.md)
Discussion and clarification of key topics | [Reference](/livepatch_on_prem/reference/index.md)
Technical information - specifications, APIs, architecture | +| [Tutorials](/server/tutorial/index.md)
Get started with a hands-on introduction for new users deploying Livepatch. | [How-to guides](/server/how-to-guides/index.md)
Step-by-step guides covering key operations and common tasks
| +| [Explanation](/server/explanation/index.md)
Discussion and clarification of key topics | [Reference](/server/reference/index.md)
Technical information - specifications, APIs, architecture | ## Getting support diff --git a/docs/livepatch_on_prem/reference/authentication.md b/docs/server/reference/authentication/authentication.md similarity index 90% rename from docs/livepatch_on_prem/reference/authentication.md rename to docs/server/reference/authentication/authentication.md index a117275..c31b724 100644 --- a/docs/livepatch_on_prem/reference/authentication.md +++ b/docs/server/reference/authentication/authentication.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-reference-livepatch-server-authentication)= +(server-reference-livepatch-server-authentication)= # Livepatch Server Authentication @@ -17,11 +17,11 @@ These APIs are consumed by administrators through the Livepatch Admin Tool. The following authentication flows are supported: -- **Basic Auth → Macaroon**: Login using [Basic Auth](#livepatch_on_prem-reference-basic-auth) to obtain a [macaroon](#livepatch_on_prem-reference-macaroons), then use the macaroon to authenticate subsequent requests. Macaroons expire after 240 hours. +- **Basic Auth → Macaroon**: Login using [Basic Auth](#server-reference-basic-auth) to obtain a [macaroon](#server-reference-macaroons), then use the macaroon to authenticate subsequent requests. Macaroons expire after 240 hours. All admin activity is logged as a structured security event with the `authz_admin` event code. -(livepatch_on_prem-reference-client-apis)= +(server-reference-client-apis)= ## Client APIs @@ -41,7 +41,7 @@ These APIs are used for patch synchronization between on-premises servers and th ## Technologies -(livepatch_on_prem-reference-basic-auth)= +(server-reference-basic-auth)= ### Basic Auth @@ -53,7 +53,7 @@ Go packages used: - [`crypto/subtle`](https://pkg.go.dev/crypto/subtle) - [`golang.org/x/crypto/bcrypt`](http://golang.org/x/crypto/bcrypt) -(livepatch_on_prem-reference-macaroons)= +(server-reference-macaroons)= ### Macaroons diff --git a/docs/server/reference/authentication/index.md b/docs/server/reference/authentication/index.md new file mode 100644 index 0000000..c09d770 --- /dev/null +++ b/docs/server/reference/authentication/index.md @@ -0,0 +1,24 @@ +--- +myst: + html_meta: + description: "Authentication reference for the Livepatch Server." +--- + + +(server-reference-authentication)= + +# Authentication + +Authentication reference for the Livepatch Server. + +## In this section + +- [Authentication](/server/reference/authentication/authentication.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Authentication +``` diff --git a/docs/server/reference/index.md b/docs/server/reference/index.md new file mode 100644 index 0000000..120f578 --- /dev/null +++ b/docs/server/reference/index.md @@ -0,0 +1,34 @@ +--- +myst: + html_meta: + description: "Reference - technical reference for Livepatch on-prem server." +--- + + +(server-reference)= + +# Reference + +Technical information - specifications, APIs, architecture, etc., related to Livepatch on-prem server. + +## In this section + +- [Platform](/server/reference/platform/index.md) — Configuration, resource requirements, and network access. +- [Authentication](/server/reference/authentication/index.md) — Authentication reference for the Livepatch Server. +- [Patch management](/server/reference/patch-management/index.md) — Patch management settings and patch sync filters. +- [Patch storage](/server/reference/patch-storage/index.md) — Configure patch storage backends such as S3 for the Livepatch Server. +- [Telemetry](/server/reference/telemetry/index.md) — Data sent to Canonical and machine reports. +- [Releases](/release-notes/server/index.md) — Release notes for the Livepatch Server. + +```{toctree} +:titlesonly: +:maxdepth: 2 +:hidden: + +Platform +Authentication +Patch management +Patch storage +Telemetry +Releases <../../release-notes/server/index.md> +``` diff --git a/docs/server/reference/patch-management/index.md b/docs/server/reference/patch-management/index.md new file mode 100644 index 0000000..c5e6377 --- /dev/null +++ b/docs/server/reference/patch-management/index.md @@ -0,0 +1,26 @@ +--- +myst: + html_meta: + description: "Patch management settings and patch sync filters." +--- + + +(server-reference-patch-management)= + +# Patch management + +Patch management settings and patch sync filters. + +## In this section + +- [Patch management](/server/reference/patch-management/patch-management.md) +- [Patch sync filters](/server/reference/patch-management/patch-sync-filters.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Patch management +Patch sync filters +``` diff --git a/docs/livepatch_on_prem/reference/patch-management.md b/docs/server/reference/patch-management/patch-management.md similarity index 96% rename from docs/livepatch_on_prem/reference/patch-management.md rename to docs/server/reference/patch-management/patch-management.md index 5195844..783634b 100644 --- a/docs/livepatch_on_prem/reference/patch-management.md +++ b/docs/server/reference/patch-management/patch-management.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-reference-managing-patches-in-an-on-prem-livepatch-deployment)= +(server-reference-managing-patches-in-an-on-prem-livepatch-deployment)= # Managing patches in an on-prem livepatch deployment diff --git a/docs/livepatch_on_prem/explanation/patch-sync-filters.md b/docs/server/reference/patch-management/patch-sync-filters.md similarity index 87% rename from docs/livepatch_on_prem/explanation/patch-sync-filters.md rename to docs/server/reference/patch-management/patch-sync-filters.md index 49ce6fe..ffdfdd9 100644 --- a/docs/livepatch_on_prem/explanation/patch-sync-filters.md +++ b/docs/server/reference/patch-management/patch-sync-filters.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-explanation-patch-sync-filters)= +(server-reference-patch-sync-filters)= # Patch Sync Filters @@ -19,4 +19,4 @@ The primary synchronisation filters are: Set sync filters if you want to reduce the amount of space consumed by Livepatch files and/or you know your client machines will be limited to a certain set of kernel variants. -A full list of the available sync filters can be found in our [config](/livepatch_on_prem/reference/configuration.md). +A full list of the available sync filters can be found in our [config](/server/reference/platform/configuration.md). diff --git a/docs/livepatch_on_prem/explanation/patch-storage/index.md b/docs/server/reference/patch-storage/index.md similarity index 71% rename from docs/livepatch_on_prem/explanation/patch-storage/index.md rename to docs/server/reference/patch-storage/index.md index 5201788..893db0f 100644 --- a/docs/livepatch_on_prem/explanation/patch-storage/index.md +++ b/docs/server/reference/patch-storage/index.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-explanation-patch-storage)= +(server-reference-patch-storage)= # Livepatch on-prem patch storage @@ -18,9 +18,9 @@ Livepatch server supports several different drivers for storing patch files down The filesystem patch store is easiest to deploy and suits most configurations. However, if there is a need to scale out the livepatch server such as have multiple livepatch servers running to handle the load, the filesystem patch store should not be used. -In case there is a need to scale out livepatch on-prem, use the s3, postgresql or swift patch stores. Any patch store should have enough space for storing livepatches - currently at least 45GB for all patches, see [this guide](/livepatch_on_prem/explanation/patch-sync-filters.md) to filter patches sent to your on-prem instance to specific kernel variants/architectures and lower this requirement. +In case there is a need to scale out livepatch on-prem, use the s3, postgresql or swift patch stores. Any patch store should have enough space for storing livepatches - currently at least 45GB for all patches, see [this guide](/server/reference/patch-management/patch-sync-filters.md) to filter patches sent to your on-prem instance to specific kernel variants/architectures and lower this requirement. -See the [patch storage](/livepatch_on_prem/reference/configuration.md) config for all available parameters. +See the [patch storage](/server/reference/platform/configuration.md) config for all available parameters. ```{toctree} :titlesonly: diff --git a/docs/livepatch_on_prem/explanation/patch-storage/use-s3-for-patch-storage.md b/docs/server/reference/patch-storage/use-s3-for-patch-storage.md similarity index 80% rename from docs/livepatch_on_prem/explanation/patch-storage/use-s3-for-patch-storage.md rename to docs/server/reference/patch-storage/use-s3-for-patch-storage.md index b429ad3..fba6501 100644 --- a/docs/livepatch_on_prem/explanation/patch-storage/use-s3-for-patch-storage.md +++ b/docs/server/reference/patch-storage/use-s3-for-patch-storage.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-explanation-livepatch-on-prem-with-aws-s3-patch-storage)= +(server-reference-livepatch-on-prem-with-aws-s3-patch-storage)= # Livepatch on-prem with AWS S3 patch storage @@ -16,11 +16,11 @@ To configure this, follow these steps: - Create an S3 bucket in the preferred region (best if the region is the same as the deployment's). Care needs to be taken to make the bucket not world-writable as this would pose a significant security risk. - Create an access point with permissions to perform operations on that S3 bucket. - Create a programmatic IAM user account with permissions to perform S3 operations. -- Configure the relevant S3 [config options](/livepatch_on_prem/reference/configuration.md) +- Configure the relevant S3 [config options](/server/reference/platform/configuration.md) Once this is configured, livepatch will store and retrieve patch files from the S3 bucket. -A further improvement is to configure livepatch on-prem to serve patches from the S3 bucket directly. For that public http access needs to be allowed to that bucket. Set your server's [URL template config](/livepatch_on_prem/reference/configuration.md) to something resembling: +A further improvement is to configure livepatch on-prem to serve patches from the S3 bucket directly. For that public http access needs to be allowed to that bucket. Set your server's [URL template config](/server/reference/platform/configuration.md) to something resembling: ``` https://.amazonaws.com/{filaname} diff --git a/docs/livepatch_on_prem/reference/configuration.md b/docs/server/reference/platform/configuration.md similarity index 96% rename from docs/livepatch_on_prem/reference/configuration.md rename to docs/server/reference/platform/configuration.md index 76cb5d0..a160f77 100644 --- a/docs/livepatch_on_prem/reference/configuration.md +++ b/docs/server/reference/platform/configuration.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-reference-configuration)= +(server-reference-configuration)= # Configuration @@ -13,7 +13,7 @@ This document provides the configuration options for the Livepatch server. ```{note} The configuration below applies to the Livepatch Server operator charms and Server snap. -For our reactive charm (or if your deployment config doesn't match the below), please see [here](/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md). +For our reactive charm (or if your deployment config doesn't match the below), please see [here](/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md). ``` ## Setting config @@ -73,7 +73,7 @@ Besides basic auth, only Ubuntu SSO auth is supported. Some notes on this section: - SSO Teams represent Launchpad teams. -- Basic auth can be a comma separated list, see [here](/livepatch_on_prem/how-to-guides/setup-administration-tool.md#password-authentication) for more info. +- Basic auth can be a comma separated list, see [here](/server/how-to-guides/security/setup-administration-tool.md#password-authentication) for more info. - Basic auth passwords *must* be bcrypt hashed. | Name | Description | Value(s) | @@ -139,7 +139,7 @@ TimescaleDB can be enabled along side or can replace InfluxDB for KPI metrics. ### Patch Storage The following values configure how the server interacts with its patch storage.\ -See our [how-to](/livepatch_on_prem/explanation/patch-storage/index.md) on patch storage. +See our [how-to](/server/reference/patch-storage/index.md) on patch storage. | Name | Description | Value(s) | | - | - | - | diff --git a/docs/server/reference/platform/index.md b/docs/server/reference/platform/index.md new file mode 100644 index 0000000..06074bc --- /dev/null +++ b/docs/server/reference/platform/index.md @@ -0,0 +1,28 @@ +--- +myst: + html_meta: + description: "Configuration, resource requirements, and network access." +--- + + +(server-reference-platform)= + +# Platform + +Configuration, resource requirements, and network access. + +## In this section + +- [Configuration](/server/reference/platform/configuration.md) +- [Resource requirements](/server/reference/platform/resource-requirements.md) +- [Network access](/server/reference/platform/network-access.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Configuration +Resource requirements +Network access +``` diff --git a/docs/livepatch_on_prem/reference/network-access.md b/docs/server/reference/platform/network-access.md similarity index 86% rename from docs/livepatch_on_prem/reference/network-access.md rename to docs/server/reference/platform/network-access.md index d2d849f..5f0e9f2 100644 --- a/docs/livepatch_on_prem/reference/network-access.md +++ b/docs/server/reference/platform/network-access.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-reference-livepatch-on-prem-network-access-requirements)= +(server-reference-livepatch-on-prem-network-access-requirements)= # Livepatch on-prem network access requirements diff --git a/docs/livepatch_on_prem/reference/resource-requirements.md b/docs/server/reference/platform/resource-requirements.md similarity index 90% rename from docs/livepatch_on_prem/reference/resource-requirements.md rename to docs/server/reference/platform/resource-requirements.md index 9a6707a..166feb0 100644 --- a/docs/livepatch_on_prem/reference/resource-requirements.md +++ b/docs/server/reference/platform/resource-requirements.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-reference-machine-resources-for-livepatch-on-prem)= +(server-reference-machine-resources-for-livepatch-on-prem)= # Machine resources for livepatch on-prem diff --git a/docs/livepatch_on_prem/explanation/data-sent.md b/docs/server/reference/telemetry/data-sent.md similarity index 91% rename from docs/livepatch_on_prem/explanation/data-sent.md rename to docs/server/reference/telemetry/data-sent.md index 91ee866..2814cce 100644 --- a/docs/livepatch_on_prem/explanation/data-sent.md +++ b/docs/server/reference/telemetry/data-sent.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-explanation-data-sent-to-canonical-servers)= +(server-reference-data-sent-to-canonical-servers)= # Data sent to Canonical servers diff --git a/docs/server/reference/telemetry/index.md b/docs/server/reference/telemetry/index.md new file mode 100644 index 0000000..a56e0d9 --- /dev/null +++ b/docs/server/reference/telemetry/index.md @@ -0,0 +1,26 @@ +--- +myst: + html_meta: + description: "Data sent to Canonical and machine reports." +--- + + +(server-reference-telemetry)= + +# Telemetry + +Data sent to Canonical and machine reports. + +## In this section + +- [Data sent](/server/reference/telemetry/data-sent.md) +- [Machine reports](/server/reference/telemetry/machine-reports.md) + +```{toctree} +:titlesonly: +:maxdepth: 1 +:hidden: + +Data sent +Machine reports +``` diff --git a/docs/livepatch_on_prem/explanation/machine-reports.md b/docs/server/reference/telemetry/machine-reports.md similarity index 60% rename from docs/livepatch_on_prem/explanation/machine-reports.md rename to docs/server/reference/telemetry/machine-reports.md index 3a7ac0d..8b392e9 100644 --- a/docs/livepatch_on_prem/explanation/machine-reports.md +++ b/docs/server/reference/telemetry/machine-reports.md @@ -5,22 +5,22 @@ myst: --- -(livepatch_on_prem-explanation-machine-reports)= +(server-reference-machine-reports)= # Machine Reports Each machine running the Livepatch Client will periodically check in with its configured server. -The machine checks for patches and sends machine status information. The full list of information sent is documented [here](/livepatch/reference/data-sent.md). +The machine checks for patches and sends machine status information. The full list of information sent is documented [here](/client/reference/networking/data-sent.md). ## Enabling Machine Reports -See our [machine reports config](/livepatch_on_prem/reference/configuration.md) to enable machine reports and configure their retention period. +See our [machine reports config](/server/reference/platform/configuration.md) to enable machine reports and configure their retention period. ## Generating Machine Reports To generate machine reports use the Livepatch admin tool. -See [our how-to](/livepatch_on_prem/how-to-guides/setup-administration-tool.md) on setting up the admin tool. +See [our how-to](/server/how-to-guides/security/setup-administration-tool.md) on setting up the admin tool. You can create machine reports where you query machines by their tier, last applied patch version or patch state. diff --git a/docs/livepatch_on_prem/tutorial/airgapped-livepatch-and-microk8s.md b/docs/server/tutorial/airgapped-livepatch-and-microk8s.md similarity index 96% rename from docs/livepatch_on_prem/tutorial/airgapped-livepatch-and-microk8s.md rename to docs/server/tutorial/airgapped-livepatch-and-microk8s.md index 84fc65b..337e3d8 100644 --- a/docs/livepatch_on_prem/tutorial/airgapped-livepatch-and-microk8s.md +++ b/docs/server/tutorial/airgapped-livepatch-and-microk8s.md @@ -4,8 +4,9 @@ myst: description: "Tutorial: Air-gapped Livepatch and MicroK8s - hands-on introduction to Livepatch on-prem." --- -(livepatch_on_prem-tutorial-getting-started-with-airgapped-livepatch-on-prem-on-microk8s)= -# Getting started with Airgapped Livepatch On-Prem on MicroK8s +(server-tutorial-airgapped-livepatch-and-microk8s)= + +# Airgapped Livepatch and MicroK8s ## Introduction @@ -20,7 +21,7 @@ For this tutorial, we will use Microk8s, a lightweight tool for creating a local Generally, in order to perform authentication/authorisation of machines and also fetching latest patches, the Livepatch on-prem server needs to communicate with the main Livepatch server hosted by Canonical. In an airgapped environment, where such communication is not available, these functions have to be handled in an indirect way by using the following tools: - [**Airgapped Ubuntu Pro Server**](https://discourse.charmhub.io/t/15278) is an on-prem deployable service that provides services related to Ubuntu Pro subscriptions in airgapped environments. Livepatch on-prem can be integrated with this service to perform authentication/authorisation of machines and handle subscription-related functionalities. -- [**Patch Downloader**](https://snapcraft.io/canonical-livepatch-downloader) is a CLI tool that can be used to download the latest patch files from the Livepatch server. In an airgapped setup, the administrators of Livepatch on-prem should use this tool to fetch the latest patches and then upload them to the configured patch storage. You can check out [this](/livepatch_on_prem/explanation/patch-storage/index) topic on how to configure various types of storage for Livepatch on-prem. [This](/livepatch_on_prem/how-to-guides/use-the-patch-downloader-tool) topic explains how to use the Patch Downloader tool to fetch patches. +- [**Patch Downloader**](https://snapcraft.io/canonical-livepatch-downloader) is a CLI tool that can be used to download the latest patch files from the Livepatch server. In an airgapped setup, the administrators of Livepatch on-prem should use this tool to fetch the latest patches and then upload them to the configured patch storage. You can check out [this](/server/reference/patch-storage/index) topic on how to configure various types of storage for Livepatch on-prem. [This](/server/how-to-guides/patch-management/use-the-patch-downloader-tool) topic explains how to use the Patch Downloader tool to fetch patches. ```{note} When deploying airgapped Livepatch on-prem on MicroK8s, it is best to configure the patch storage to something independently accessible within your infrastructure, like an S3/Swift bucket, instead of PostgreSQL or filesystem. This way, Livepatch administrators can independently download the latest patches via the Patch Downloader CLI tool and transfer them to the patch storage. @@ -119,7 +120,7 @@ juju bootstrap microk8s livepatch-demo-controller After the completion of the above commands, you can checkout the available Juju controllers by running `juju controllers` which should print out the list of controllers like this: ```sh -$ juju controllers +juju controllers Controller Model User Access Cloud/Region Models Nodes HA Version livepatch-demo-controller* controller admin superuser microk8s/localhost 1 1 - 3.5.3 pro-demo-controller controller admin superuser localhost/localhost 1 1 none 3.5.3 @@ -266,7 +267,7 @@ The `{filename}` placeholder should not be omitted or replaced. After some time, the Livepatch server should be up and running. You can see this in the Juju model status as the `livepatch` application status changes to `active`. To test the running Livepatch on-prem server we can use `curl` like this: ```sh -$ curl http://livepatch.test.com +curl http://livepatch.test.com Canonical Livepatch Health service, version v1.14.3 ``` @@ -315,7 +316,7 @@ sudo pro enable livepatch This should finish successfully. We can now check the status of the Livepatch client by running the following command: ```sh -$ sudo canonical-livepatch status +sudo canonical-livepatch status last check: 19 seconds ago kernel: 5.15.0-119.129-generic server check-in: succeeded diff --git a/docs/livepatch_on_prem/tutorial/airgapped-livepatch-and-snap.md b/docs/server/tutorial/airgapped-livepatch-and-snap.md similarity index 94% rename from docs/livepatch_on_prem/tutorial/airgapped-livepatch-and-snap.md rename to docs/server/tutorial/airgapped-livepatch-and-snap.md index 89950ed..f97c095 100644 --- a/docs/livepatch_on_prem/tutorial/airgapped-livepatch-and-snap.md +++ b/docs/server/tutorial/airgapped-livepatch-and-snap.md @@ -4,8 +4,9 @@ myst: description: "Tutorial: Air-gapped Livepatch and Snap - hands-on introduction to Livepatch on-prem." --- -(livepatch_on_prem-tutorial-getting-started-with-airgapped-livepatch-on-prem-using-snaps)= -# Getting started with airgapped Livepatch On-Prem using Snaps +(server-tutorial-airgapped-livepatch-and-snap)= + +# Airgapped Livepatch and Snap ## Introduction @@ -18,7 +19,7 @@ This tutorial will deploy the Livepatch on-prem server as a Snap package in an a Generally, in order to perform authentication/authorisation of machines and to fetch patches, the Livepatch on-prem server needs to communicate with the main Livepatch server hosted by Canonical. In an airgapped environment, where such communication is not available, these functions are handled using the following tools: - [**Airgapped Ubuntu Pro Server**](https://discourse.charmhub.io/t/15278) provides services related to Ubuntu Pro subscriptions in airgapped environments. Livepatch on-prem can be integrated with this service to perform authentication/authorisation of machines and handle subscription-related functionality. -- [**Patch Downloader**](https://snapcraft.io/canonical-livepatch-downloader) is a CLI tool that can be used to download the latest patch files from the Livepatch server. In an airgapped setup, the administrators of Livepatch on-prem should use this tool to fetch the latest patches and then upload them to the configured patch storage. You can check out [this](/livepatch_on_prem/explanation/patch-storage/index) topic on how to configure various types of storage for Livepatch on-prem. [This](/livepatch_on_prem/how-to-guides/use-the-patch-downloader-tool) topic explains how to use the Patch Downloader tool to fetch patches. +- [**Patch Downloader**](https://snapcraft.io/canonical-livepatch-downloader) is a CLI tool that can be used to download the latest patch files from the Livepatch server. In an airgapped setup, the administrators of Livepatch on-prem should use this tool to fetch the latest patches and then upload them to the configured patch storage. You can check out [this](/server/reference/patch-storage/index) topic on how to configure various types of storage for Livepatch on-prem. [This](/server/how-to-guides/patch-management/use-the-patch-downloader-tool) topic explains how to use the Patch Downloader tool to fetch patches. ```{note} When deploying airgapped Livepatch on-prem using Snap, it is best to configure the patch storage to something independently accessible within your infrastructure, like the filesystem or an S3/Swift bucket, instead of PostgreSQL. This way, Livepatch administrators can independently download the latest patches via the Patch Downloader CLI tool and transfer them to the patch storage. @@ -186,7 +187,7 @@ curl http://localhost:8080 ``` ```{note} -By default, Livepatch on-prem server uses filesystem to stores the patches. The directory is located at `/var/snap/canonical-livepatch-server/common/patches`. So, in a real-world setup, you can download the latest patches by using the Patch Downloader tool, transfer them to the mentioned path, and use the Admin tool to refresh patch information. Check out [this](/livepatch_on_prem/how-to-guides/use-the-patch-downloader-tool) topic on how to use the Patch Downloader tool. +By default, Livepatch on-prem server uses filesystem to stores the patches. The directory is located at `/var/snap/canonical-livepatch-server/common/patches`. So, in a real-world setup, you can download the latest patches by using the Patch Downloader tool, transfer them to the mentioned path, and use the Admin tool to refresh patch information. Check out [this](/server/how-to-guides/patch-management/use-the-patch-downloader-tool) topic on how to use the Patch Downloader tool. ``` ### Step 7: Set up Livepatch client @@ -238,7 +239,7 @@ sudo pro enable livepatch This should finish successfully. We can now check the status of the Livepatch client by running the following command: ```sh -$ sudo canonical-livepatch status +sudo canonical-livepatch status last check: 19 seconds ago kernel: 5.15.0-119.129-generic server check-in: succeeded diff --git a/docs/server/tutorial/index.md b/docs/server/tutorial/index.md new file mode 100644 index 0000000..999ac27 --- /dev/null +++ b/docs/server/tutorial/index.md @@ -0,0 +1,32 @@ +--- +myst: + html_meta: + description: "Tutorial: Tutorial - hands-on introduction to Livepatch on-prem." +--- + + +(server-tutorial)= + +# Tutorial + +A hands-on introduction for Livepatch on-prem server for new users: + +- [Getting started with Livepatch On-Prem and LXD](/server/tutorial/livepatch-and-lxd.md) +- [Getting started with Livepatch On-Prem and MicroK8s](/server/tutorial/livepatch-and-microk8s.md) + +Setting up Livepatch in an airgapped environment: + +- [Getting started with Airgapped Livepatch On-Prem on MicroK8s](/server/tutorial/airgapped-livepatch-and-microk8s.md) +- [Getting started with airgapped Livepatch On-Prem using Snaps ](/server/tutorial/airgapped-livepatch-and-snap.md) + +```{toctree} +:titlesonly: +:maxdepth: 2 +:glob: +:hidden: + +Livepatch and lxd +Livepatch and microk8s +Airgapped livepatch and microk8s +Airgapped livepatch and snap +``` diff --git a/docs/livepatch_on_prem/tutorial/livepatch-and-lxd.md b/docs/server/tutorial/livepatch-and-lxd.md similarity index 94% rename from docs/livepatch_on_prem/tutorial/livepatch-and-lxd.md rename to docs/server/tutorial/livepatch-and-lxd.md index c9666dd..a715f39 100644 --- a/docs/livepatch_on_prem/tutorial/livepatch-and-lxd.md +++ b/docs/server/tutorial/livepatch-and-lxd.md @@ -5,7 +5,7 @@ myst: --- -(livepatch_on_prem-tutorial-livepatch-and-lxd)= +(server-tutorial-livepatch-and-lxd)= # Livepatch and LXD @@ -17,7 +17,7 @@ We will be using LXD, Juju and the Livepatch server machine charm/bundle. For this how-to, you do not require any previous or advanced knowledge of [LXD](https://ubuntu.com/lxd/), [Juju](https://canonical.com/juju) or [Charmed Operators](https://documentation.ubuntu.com/juju/latest/reference/charm/) to proceed and deploy Livepatch on-premise. -If you’ve already deployed Livepatch before, and wish to keep your same configuration, we’ve rewritten our machine charm and the configuration has changed. Please see [here](/livepatch_on_prem/how-to-guides/migrate-from-reactive-charm-to-operator-charm.md) for instructions on how to migrate. +If you’ve already deployed Livepatch before, and wish to keep your same configuration, we’ve rewritten our machine charm and the configuration has changed. Please see [here](/server/how-to-guides/deployment/migrate-from-reactive-charm-to-operator-charm.md) for instructions on how to migrate. ### JQ @@ -265,12 +265,12 @@ Trigger a sync with: livepatch-admin sync trigger --wait ``` -For further information on the admin tool, see [How to setup administration tool](/livepatch_on_prem/how-to-guides/setup-administration-tool.md). -Additionally, see how-to [configure patch sync filters](/livepatch_on_prem/explanation/patch-sync-filters.md) to limit what patches you download. +For further information on the admin tool, see [How to setup administration tool](/server/how-to-guides/security/setup-administration-tool.md). +Additionally, see how-to [configure patch sync filters](/server/reference/patch-management/patch-sync-filters.md) to limit what patches you download. ## Enabling machine status reporting -Each livepatch on-prem instance can optionally send information about the status of the machines it's serving back to Canonical. Full details on what information is sent is available [here](/livepatch/reference/data-sent.md) +Each livepatch on-prem instance can optionally send information about the status of the machines it's serving back to Canonical. Full details on what information is sent is available [here](/client/reference/networking/data-sent.md) ``` juju config livepatch patch-sync.send-machine-reports=true diff --git a/docs/livepatch_on_prem/tutorial/livepatch-and-microk8s.md b/docs/server/tutorial/livepatch-and-microk8s.md similarity index 90% rename from docs/livepatch_on_prem/tutorial/livepatch-and-microk8s.md rename to docs/server/tutorial/livepatch-and-microk8s.md index 6418316..84c6e12 100644 --- a/docs/livepatch_on_prem/tutorial/livepatch-and-microk8s.md +++ b/docs/server/tutorial/livepatch-and-microk8s.md @@ -4,7 +4,7 @@ myst: description: "Tutorial: Livepatch and Microk8s - hands-on introduction to Livepatch on-prem." --- -(livepatch_on_prem-tutorial-getting-started-with-livepatch-on-prem-and-microk8s)= +(server-tutorial-getting-started-with-livepatch-on-prem-and-microk8s)= # Getting started with Livepatch On-Prem and Microk8s @@ -12,7 +12,7 @@ myst: Livepatch on-prem is a self-hosted version of the Livepatch server, enabling the delivery of patches to machines within network restricted environments. -This tutorial will deploy the Livepatch On-prem server as a Kubernetes application. We will deploy and configure the livepatch on-prem server using Juju and Charmed Operators. Juju is an Open Source Charmed Operator Framework that controls the whole lifecycle of an application. While this is one option for deploying the on-prem server, another is to deploy to virtual machines as described [here](/livepatch_on_prem/how-to-guides/deploy-via-juju.md). +This tutorial will deploy the Livepatch On-prem server as a Kubernetes application. We will deploy and configure the livepatch on-prem server using Juju and Charmed Operators. Juju is an Open Source Charmed Operator Framework that controls the whole lifecycle of an application. While this is one option for deploying the on-prem server, another is to deploy to virtual machines as described [here](/server/how-to-guides/deployment/deploy-via-juju.md). For this tutorial we will use Microk8s, a lightweight tool for creating a local Kubernetes cluster. @@ -79,9 +79,9 @@ The bundle and charmed operators necessary to deploy livepatch server are availa https://charmhub.io/canonical-livepatch-onprem -Livepatch On-Prem needs a place to store patches that it syncs from the upstream. By default the above "k8s" bundle will store patches in PostgreSQL directly. Other options including S3 storage are available and can be configured as described [here](/livepatch_on_prem/explanation/patch-storage/index.md). +Livepatch On-Prem needs a place to store patches that it syncs from the upstream. By default the above "k8s" bundle will store patches in PostgreSQL directly. Other options including S3 storage are available and can be configured as described [here](/server/reference/patch-storage/index.md). -In order to ensure PostgreSQL has enough space, see our [resources topic](/livepatch_on_prem/reference/resource-requirements.md) for requirements on virtual machines running livepatch on-prem. Although this information relates to the deployment of Livepatch on virtual machines, the storage requirements remain similar. +In order to ensure PostgreSQL has enough space, see our [resources topic](/server/reference/platform/resource-requirements.md) for requirements on virtual machines running livepatch on-prem. Although this information relates to the deployment of Livepatch on virtual machines, the storage requirements remain similar. To start the deployment within the previously created juju model, run: @@ -188,7 +188,7 @@ juju config livepatch auth.basic.enabled=true juju config livepatch auth.basic.users='username:$2y$10$74ZgHaxn...UH/Bbw6W2bmctm' ``` -See [Administration Tool](/livepatch_on_prem/how-to-guides/setup-administration-tool.md) topic for instructions on installing the administration tool and setting up authentication. +See [Administration Tool](/server/how-to-guides/security/setup-administration-tool.md) topic for instructions on installing the administration tool and setting up authentication. Once this has been done, the livepatch admin tool can be used to authenticate: @@ -199,7 +199,7 @@ livepatch-admin login -a username:password ### 6. Downloading patches -The final step before attaching client machines to the server is to download patches from Canonical servers. This can be done using the admin tool. See [How to setup administration tool](/livepatch_on_prem/how-to-guides/setup-administration-tool.md) for installation steps. +The final step before attaching client machines to the server is to download patches from Canonical servers. This can be done using the admin tool. See [How to setup administration tool](/server/how-to-guides/security/setup-administration-tool.md) for installation steps. To download patches, run: @@ -219,7 +219,7 @@ And to check for any sync failures run: livepatch-admin sync report ``` -To limit which patches are downloaded see this [document](/livepatch_on_prem/explanation/patch-sync-filters.md). +To limit which patches are downloaded see this [document](/server/reference/patch-management/patch-sync-filters.md). ## Enabling machine status reporting diff --git a/docs/livepatch/explanation/get-more-help.md b/docs/support/get-more-help.md similarity index 78% rename from docs/livepatch/explanation/get-more-help.md rename to docs/support/get-more-help.md index 6eb2c4e..f590252 100644 --- a/docs/livepatch/explanation/get-more-help.md +++ b/docs/support/get-more-help.md @@ -5,11 +5,11 @@ myst: --- -(livepatch-explanation-how-do-i-get-more-help)= +(support-how-do-i-get-more-help)= # How do I get more help? -To access Livepatch see the [Ubuntu Pro](https://www.ubuntu.com/ubuntu-advantage) subscription. +To access Livepatch see the [Ubuntu Pro](https://www.ubuntu.com/pro) subscription. Ubuntu Pro customers should file support tickets at: diff --git a/docs/support/index.md b/docs/support/index.md new file mode 100644 index 0000000..e0dde94 --- /dev/null +++ b/docs/support/index.md @@ -0,0 +1,35 @@ +--- +myst: + html_meta: + description: "Support information for Livepatch client and server." +--- + + +(support)= + +# Support + +To access Livepatch, see the [Ubuntu Pro](https://www.ubuntu.com/pro) subscription. + +Canonical customers can receive support on the Ubuntu Livepatch service, client, and server via Canonical's support portal: + +- https://portal.support.canonical.com + +The projects maintain bug trackers at: + +- [Livepatch client bug tracker](https://bugs.launchpad.net/canonical-livepatch-client/+filebug) +- [Livepatch on-prem bug tracker](https://bugs.launchpad.net/livepatch-onprem/+filebug) + +For client bug reporting details, see [Report bugs](/support/report-bugs.md). + +For more ways to get help, see [Get more help](/support/get-more-help.md). + +```{toctree} +:titlesonly: +:maxdepth: 2 +:glob: +:hidden: + +Get more help +Report bugs +``` diff --git a/docs/livepatch/explanation/report-bugs.md b/docs/support/report-bugs.md similarity index 95% rename from docs/livepatch/explanation/report-bugs.md rename to docs/support/report-bugs.md index 48c43a3..ed0b9cc 100644 --- a/docs/livepatch/explanation/report-bugs.md +++ b/docs/support/report-bugs.md @@ -5,7 +5,7 @@ myst: --- -(livepatch-explanation-reporting-bugs)= +(support-reporting-bugs)= # Reporting bugs