2026.5.2 RPM upgrade bug

Installation RPM Installation
1

[2026.5.2][RPM upgrade] openiamrepo.tar.gz extracted from wrong path → mod_openiam not installed → httpd (reverse proxy) fails to start

Environment

  • OpenIAM 2026.5.2, upgraded from 2026.5.1
  • Deployment: RPM, single-node all-in-one
  • OS: RHEL 9.8 (el9), x86_64
  • DB: PostgreSQL 18.4 · Search: OpenSearch · Vault local
  • Upgrade run: online mode (openiam-cli upgrade / utils/upgrade.sh), answered Y to the internet-availability prompts

Severity / Impact: High — after the upgrade completes, the Apache reverse proxy (mod_openiam) is uninstalled and cannot be reinstalled, so httpd fails to start and the entire web UI (:80/:443) is unreachable. Backend services come up fine, but nothing is served through the proxy. Reproducible on every RPM upgrade to 2026.5.2.

Summary
The upgrade script downloads openiamrepo.tar.gz (which contains mod_openiam-2026.5.2.el9.x86_64.rpm and other RPM dependencies) to one directory but tries to extract it from a different, hard-coded directory. The extraction fails silently, openiamrepo/ stays empty, the subsequent mod_openiam install fails, and httpd won’t start.

Steps to reproduce

  1. RPM single-node install of 2026.5.1.
  2. Set UPGRADE_TO_VERSION="2026.5.2" in env.conf, run openiam-cli upgrade in online mode.
  3. Let it complete; then systemctl status httpd.

Expected: mod_openiam-2026.5.2 installed, httpd running, UI reachable.
Actual: openiamrepo/ empty, mod_openiam not installed, httpd dead.

Root cause (path mismatch in utils/upgrade.sh)

  • Download destination is $HOME_DIR (/usr/local/openiam):

    # upgrade.log

    + DEST_FILE=/usr/local/openiam/openiamrepo.tar.gz

    + curl -k -q .../dependencies/el9/openiamrepo.tar.gz --output /usr/local/openiam/openiamrepo.tar.gz

    The download succeeds (curl reaches 100%, ~1215 MB).

  • Extraction reads from $ARTIFACTS_PATH (/usr/src), not $HOME_DIR:

    # upgrade.sh line 152

    tar -xvf $ARTIFACTS_PATH/openiamrepo.tar.gz --directory=$HOME_DIR

    # upgrade.log (resolved)

    + tar -xvf /usr/src/openiamrepo.tar.gz --directory=/usr/local/openiam

    tar: /usr/src/openiamrepo.tar.gz: Cannot open: No such file or directory

    tar: Error is not recoverable: exiting now

  • Downstream failures caused by the empty repo:

    + yum install /usr/local/openiam/openiamrepo/mod_openiam-2026.5.2.el9.x86_64.rpm -y

    Can not load RPM file: /usr/local/openiam/openiamrepo/mod_openiam-2026.5.2.el9.x86_64.rpm.

    Could not open: ...

    + systemctl restart httpd

    Job for httpd.service failed ...

    # httpd -t:

    Cannot load modules/mod_openiam.so into server: .../mod_openiam.so: cannot open shared object file

  • For contrast, backend.tar.gz and frontend.tar.gz download and extract from /usr/local/openiam/ (consistent paths) and apply correctly — only openiamrepo.tar.gz uses the mismatched $ARTIFACTS_PATH.

Suggested fix
Make the openiamrepo.tar.gz extraction source match its download destination (use $HOME_DIR like backend/frontend), or download it to $ARTIFACTS_PATH consistently. i.e. tar -xvf $HOME_DIR/openiamrepo.tar.gz --directory=$HOME_DIR.

Workaround (verified)

cd /usr/local/openiam

sudo curl -k -o openiamrepo.tar.gz \

https://download.openiam.com/release/enterprise/2026.5.2/dependencies/el9/openiamrepo.tar.gz

sudo tar -xf openiamrepo.tar.gz --directory=/usr/local/openiam

sudo yum install /usr/local/openiam/openiamrepo/mod_openiam-2026.5.2.el9.x86_64.rpm -y

sudo systemctl restart httpd && httpd -t

After this, httpd starts and the UI is reachable again.

Secondary issue (same upgrade, likely related) — batch-task-manager not deployed on RPM
The 2026.5.2 payload (openiam.tar.gz) ships ./etc/systemd/system/openiam-batchtask.service (+ .timer) and installs services/bin/batch-task-manager.jar, but on a single-node RPM all-in-one the unit is not installed/enabled:

systemctl status openiam-batchtask.service

Unit openiam-batchtask.service could not be found.

So the new batch-task-manager microservice never starts, and its first-start Flyway migration into the new batchtasks DB (copying openiam.BATCH_CONFIG → batchtasks.BATCH_CONFIG) does not run. The upgrade notes describe deploying this service only via the Helm/ArgoCD (container) path, with no RPM equivalent documented. Request: document + automate the RPM deployment (install & enable openiam-batchtask.service).

2

Hello @Bizz,

I have alerted my team to your post. We will get back to you shortly.

Thanks,

Ameet

1 Like