Problem

We got a lot of Debian servers and it's impractical to issue an 'apt-get dist-upgrade' on all of them separately. Also, we do not want unsupervised upgrades, since that could mess stuff up. We want to test before telling all the machines to upgrade.

Solution

We create a file on our puppetmaster. Where it resides or what the content is, doesn't matter. Let's call the file 'update_initiator'. Now we add the following recipe to the manifest we use for each server:

file { "/etc/update_initiator":
  source => "puppet://puppet/config/update_initiator",
}

exec { "/usr/bin/apt-get -y dist-upgrade":
  refreshonly => true,
  subscribe => File["/etc/update_initiator"],
}

Et voila, when we've tested all the available upgrades on our test server, we simply change the content of 'update-initiator' on the puppetmaster, the file registers as changed and the machines will initiate the dist-upgrade. This of course requires you to run a "apt-get update" once in a while on all the servers (we use cron-apt for that). A good way to change the file is to have the date of the last upgrade in there. That way it's a reference point.