Inconsistent Kong OSS 2.8.X packages available in gateway-28 APT repository for Ubuntu codenames and architectures

[gchristidis]

The documentation indicates that Kong 2.8 is available for Ubuntu Bionic, Focal, and Xenial and whilst there are versions in the repo for all those, not all patch versions are available for all codenames. In addition the versions available for arm and amd for some codenames are also different with some codename/architecture marking older versions as latest when there are newer versions in the repo.

This is a summary of the Kong debs in the gateway-28 repo

Jammy: Has only 2.8.4 & 2.8.5(latest) for amd64 but only 2.8.4(latest) for arm64
Focal: Has all versions from 2.8.0 to 2.8.5(latest) for amd64 but only 2.8.1 to 2.8.4 for arm64 but 2.8.3 is marked as latest for arm64
Bionic: Has versions from 2.8.0 to 2,8.4(latest) for amd64 but only 2.8.2 to 2.8.4 for arm64 but 2.8.3 is marked as latest for arm64
Xenial: Only has versions 2.8.0 and 2.8.1(latest) for both amd64 and arm64

I can understand not building for older distros but I would expect all versions to be available for newer distros (ie Jammy). We have a templated deployment structure for our applications that make use of Kong and it does make it difficult to manage. For example one of our customers is running Kong 2.8.3 on a arm based instance running Ubuntu 20 (Focal) and is looking to upgrade the instance to Jammy (driven by their SecOps governance) and cant do this now without also updating Kong. Yes i understand we should be running the latest patch release anyway but we are governed by customer constraints and are not always in control of these.

I ask the question here as I did not want to raise this as a Bug ticket, should all 2.8 versions be available for all supported distros/architectures.

Thanks

[chobits]

@Water-Melon Do you know that

I ask the question here as I did not want to raise this as a Bug ticket, should all 2.8 versions be available for all supported distros/architectures.

I guess the answer is no, we only support some common distros.

CC @Water-Melon @fffonion @curiositycasualty Do you have any additional thoughts or suggestions regarding the support for our distribution?

[gchristidis]

Thanks for the reply, however the question is not about supporting common distros its about the fact that not all 2.8 versions and architectures are available for all supported distros, its this inconsistency that makes it difficult for upgrade paths.

[gchristidis]

It also appears that the 2.8.5 version which is only available for Ubuntu releases Jammy and Focal with amd64 architecture has packaging issues, they are missing the systemd startup files in the debian package.

[curiositycasualty]

@gchristidis Hey there. I can shed some light on the inconsistencies around package versions and architectures, but I don't have any fixes for you.

For OSS, We (Kong Inc.) don't make any commitments to producing packages for specific architectures or platforms. We do not, for instance, have an OSS / Community Edition analogue to this page about the architectures and platforms supported, at which versions of Kong, for Kong Enterprise: https://docs.konghq.com/gateway/latest/support-policy/

We generally don't backport changes or fixes for OSS. But the inconsistencies you are seeing in OSS/CE Ubuntu 2.8 package architectures are the result of some work we recently undertook to backport our Bazel-based build system in order allow us (Kong Inc.) to be able to patch OSS/CE versions of 2.8 as a courtesy to our OSS users. It just so happened that with that build system, came along the fact that we've deprecated arm64 packages for 2.8-- a decision made to better align the platforms available as OSS Kong with the platforms available as Kong Enterprise. An unhappily made decision far exceeding my pay grade, but one that sets up Kong to better cater to future emergencies and vulnerabilities in OSS.

I hate to be /that/ vendor, but I'd recommend upgrading to newer versions of Kong, where we do offer arm64 packages.

Generally, we deprecate OS support as the distributions go EOL. The last patch of Xenial, for example, went EOL in April, 2021. As did Bionic in April, 2023. In that context, Focal & Jammy as the 2 Ubuntu versions for which we offer 2.8.5 packages, makes sense, since they were produced 3-months ago. So the absence of packages for specific Ubuntu versions is, in part, just the unpleasant conflagration of OS EOL timing and emergency preparedness.

I am taking steps to rectify the issues you noted w/ regards to the systemd unit file going missing from 2.8 packages here: #13778 -- I think this too was a consequence of the bazel build system backport mentioned above. I'm in the process of getting those changes reviewed internally.

I am sorry I don't have more answers for you, hopefully that sheds some light on things.