samba - Feb 2025 - Upgrading Samba AD without upgrading any DC

HI,

Really appreciate you guys!

Three questions:

First, I am installing new DCs using Bookworm's stable install.  The current
DCs are running Bullseye (again using i's latest).  I don't think
upgrading a DC directly will be easy if I have to do it.  (They run in
containers on a Buster host.)  Is it feasible/advisable to upgrade by installing
a couple of new DCs, joining them to the domain, and then retiring the older
servers?  Or, would it be best that I install a DC on a Bullseye server that can
be upgraded, join the domain, and then upgrade that?

Second, if things go wrong, can a backup of a Bullseye DC be installed on a new
Bookworm DC?  What type of backup would you recommend?

And third, if the answer to the second question is "yes," is there
value in doing the upgrade by installing the older backup onto a newer server
and going from there rather than either of the two approaches in my first
question?

I would appreciate any pointers to documentation that you would suggest I read. 
I did read the suggestions on upgrading a DC directly but am trying to avoid
that approach if feasible.

Thanks for your help with this.

                Steve

On Fri, 7 Feb 2025 17:05:59 +0000
Stephen Brandli via samba <samba at lists.samba.org> wrote:
> HI,
> 
> Really appreciate you guys!
> 
> Three questions:
> 
> First, I am installing new DCs using Bookworm's stable install.
That would get you Samba 4.17.12, but using bookworm-backports will get
you 4.21.3 ( the latest version ).
>  The
> current DCs are running Bullseye (again using i's latest).  I don't
> think upgrading a DC directly will be easy if I have to do it.
I upgraded Raspberry pi bullseye to Raspberry pi bookworm and it worked
>  (They
> run in containers on a Buster host.)
You really need to upgrade the host as well, buster LTS went EOL over
six months ago.
>  Is it feasible/advisable to
> upgrade by installing a couple of new DCs, joining them to the
> domain, and then retiring the older servers?
You can do that, but it raises the RID pools.
>  Or, would it be best
> that I install a DC on a Bullseye server that can be upgraded, join
> the domain, and then upgrade that?
> 
You could do that, but use bookworm and skip the upgrading.
> Second, if things go wrong, can a backup of a Bullseye DC be
> installed on a new Bookworm DC?  What type of backup would you
> recommend?
> 
I cannot recommend doing a backup of a DC, backing up the domain with
samba-tool is okay, but only use such a backup if you suffer a
catastrophic failure of all DCS.

Rowland