Zimbra 10 Daffodil, is the first majorly innovative release from Zimbra in a number of years. Over the past ~three months that Daffodil has been General Availability we’ve been answering pretty much the same set of questions from customers, so I thought it might be helpful to share at a high level what we’ve learned about Daffodil and how you can decide when to upgrade.
What’s Different About Daffodil?
Daffodil removes all of the NG code licensed from Zextras in favor of Zimbra-native code. With the exception of backups to S3 targets (coming this summer), as near as we can tell, essentially all of the functionality provided by NG is now provided by Zimbra-native code. There is also some new functionality, like more granular, predefined delegated administration roles. As Zimbra now owns the entirety of the product’s code base, Zimbra have gone on record as saying that this change alone will speed development, including introducing new features, refactoring and continued security improvements.
Despite those under-the hood differences, Daffodil still includes the Classic (Ajax) and Modern (Preact) web client interfaces available in Zimbra 9. The Admin Console is also pretty much the same, aside from some UI changes to put all of what used to appear in the NG tab back in their respective logical locations.
Isn’t that A Lot of New Code? Shouldn’t We Be Worried About Lots of New Bugs?
No and No. Recall Synacor (Zimbra’s corporate owners) were Zimbra’s largest customer before they bought Zimbra. Synacor have provided customizations to their very large customers (hundreds of thousands and millions of mailboxes in a single Zimbra multi-server environment) for many years. Many of these customizations provide functionality previously provided by NG in the commercial product (like HSM support for S3 and other external volumes). We have been given to understand that this battle-tested code was simply updated and repurposed for Daffodil.
Further, although there is, as with any new release, new code in the product, Daffodil was released as “Early Access” in the Fall of 2022. There are actually a fair number of customers running Daffodil in production for more than half a year as of this writing (end of April 2023).
Also, as one of Zimbra’s Certified Trainers, I have so far put two groups of trainees through using Daffodil during the rigorous three-day classes, where we do installs/upgrades every day. No problems yet.
Let’s get specific about some of that seemingly-new-but-not-really code in Daffodil:
Zimbra 10 Daffodil Backups
Backups in Daffodil are realtime, just like NG, and are based on the Network Edition “Classic” backups that have been around forever. NG backups are similar to Apple Time Machine backups: a Full backup once at inception and then forever incrementals. Daffodil backups using the now-default “auto-grouped” method mix Full and Incremental backups each night, with continuously-written redologs providing the real-time backup capability. Enhancements regarding compression reduce storage consumption, and this summer S3 as a backup target is scheduled for release. This architecture makes it easier to copy offsite point-in-time backups, without having to create a brand new External Backup in NG first.
NG Backup allows an administrator to backup everything in Zimbra, or, to exclude accounts by excluding one or more Classes of Service (and the accounts therein). Daffodil does this too, but also allows an administrator to exclude one or more domains from being backed up.
Restore modes between Daffodil and NG are comparable, except that Daffodil has an offline restore mode that in our experience works really fast, so can be used to lower RTO targets for customers sensitive to needing very short Recovery Time Objectives during Disaster Recovery.
NG restores, because they don’t rely on either Zimbra’s MariaDB databases nor Zimbra’s LDAP, provide more flexibility for doing things like consolidating two old mailbox servers onto a single new mailbox server (or vica versa), so with Daffodil you’ll need to move mailboxes after a disaster recovery restore if you want to consolidate (or expand) the number of mailstores.
Zimbra 10 Daffodil Mobile
Like NG Mobile, Daffodil Mobile includes a number of features we politely refer to as a “poor man’s MDM (mobile device management)” capability. You can implement ABQ (allow, block, quarantine) for mobile devices, enforce policies like longer alphanumeric passwords, and even wipe the mobile device from the Admin Console.
Zimbra 10 Daffodil Storage Manager (“SM”)
SM provides the HSM capabilities we are used to with NG, like supporting S3 volumes, Intelligent Tiering etc. We’ve been told that S3 throughput in Daffodil is higher than that in NG, but we haven’t yet had an opportunity to test this. As with both NG and Daffodil, you can lifecycle local and remote storage volumes with no downtime whatsoever. When I demonstrate this during the three-day Zimbra Administration Training course, most attendees were not aware of this capability. Someone always comments that they were dreading having to retire a SAN in the next quarter, and were expecting that they’d have to move Zimbra to entirely new virtual servers. It’s good that SM retains this very valuable feature set, which incorporates very handy NG features like Volume-to-Volume moves.
Zimbra 10 Daffodil Delegated Administration
NG Admin greatly simplifies creating and managing Delegated Administrators, at the cost of limited flexibility in adjusting rights and permissions of Delegated Admins. Daffodil uses the same, incredibly granular Access Control Entries framework that has been in Zimbra for years, but now offers a number of (soon to be growing) pre-defined roles for creating delegated admin accounts via check boxes in the Admin Console. The Wizards for creating hand-crafted Delegated Admin roles in Daffodil seem a bit more helpful than I remembered them from before NG Admin.
If you are familiar with Windows Security Groups, Daffodil’s Delegated Admin learning curve will be relatively short and not (terribly) steep. All you need to do is use the Wizard to create a Distribution List that has rights to access different portions of the Admin Console (so that members of the DL will only be presented with those portions of the Admin Console UI necessary for them to do what the role allows). After you create these “View” rights, the Wizard will then walk you through creating companion “Action” rights (technically, Access Control Entries) on the desired target(s). IOW, a delegated admin you want to be able to change passwords in two out of the five domains in your Zimbra system needs to have the ACEs created on those two domains, with the “View” rights added to the distribution list (sometimes called an “Admin Role” in the Admin Console UI).
Alignment between these View and Action rights, applied only to the Targets you wish (like one or more domains for which you want someone to be able to administer Distribution Lists) is what enables anyone you configure as members of this Admin Distribution List to inherit the rights on the DL. The final step, for anyone you want to be a delegated admin, is to make their account a member of the DL and set the account attribute zimbraIsDelegatedAdminAccount TRUE and you are done.
Aside from being able to create really granular delegated admin roles with this framework, recall that Zimbra distribution lists can be nested, so this provides for some permissions simplification when, for example, you have three tiers of Help Desk agents with somewhat overlapping permissions.
Briefcase and Drive
Drive, being part of NG, is gone in Daffodil, but Zimbra’s migration tool allows you to export Drive data. Briefcase supports versioning, check-out/check-in, and now in Daffodil, collaborative document editing without the need for a separate Docs server.
Text And Video Chat
Zimbra Connect, being part of NG, is gone in Daffodil. Zimbra took a SaaS approach to text and video chat with Daffodil’s launch by doing a freemium deal with IMMail. For customers that care about data sovereignty, this isn’t acceptable, so Zimbra expects to release self-hosted chat functionality within Daffodil we are told later this year.
Zimbra 10 Daffodil Product Lifecycle Changes
There is no more “LTS” edition, and the massive architectural changes that caused a lot of grief in the early 8.8.x series are also gone. Customers can choose with Daffodil to stay on a “no-new-features” upgrade path, receiving only bug fixes and security updates, or; they can choose an upgrade path that provides those same bug fixes and security updates, as well as modest new features and enhancements. Major architectural changes that for example have the risk of breaking things, as had been the case between Zimbra 8.8.9 and 8.8.15, will now result in a new Major version. By way of background, Zimbra numbering is Major.Minor.Micro, so Daffodil 10.0.5 for example will have had five rounds of bug fixes and security patches; Daffodil 10.2.5 will have had the same five rounds of bug fixes and security patches, but also two rounds of modest feature enhancements. Daffodil 11.0.0 will contain some significant architectural changes over Daffodil 10.x.x.
OK, OK… But Should I Upgrade To Zimbra 10 Daffodil Now?
We are currently doing all greenfield installations for new Zimbra customers on Daffodil. For existing Zimbra customers, we generally, but not always, recommend waiting a bit before migrating to Daffodil. Why? Two reasons:
First, we’ve been told that there will be Daffodil binaries for Ubuntu 22.04 in the very near future. If you are going to go the hassle of moving to a new system, why not do so on the very latest operating system available?
At the moment, the only supported upgrade path is for in-place upgrades of single and multi-server Zimbra systems which have never had NG installed, and that is expected to change in the near term. Zimbra has a “Rolling Upgrade” migration tool for moving from NG-based Zimbra Network Edition systems to Daffodil with essentially zero downtime. This tool, currently in beta as of this writing, will work even when the new system is architecturally different from the legacy system, e.g. differing numbers of mailbox servers; no LDAP MMR on the legacy system but LDAP MMR on the new system, and; different operating systems on both systems. Zimbra also has a general guide to Rolling Upgrades. Our plan is to wait until this tool becomes GA, and then we will use it on our own hosting farm as well as with our on-premises customers to whom we provide professional services.
I should mention that we are extremely risk averse, so we try to avoid in-place upgrades whenever possible, even when they are fully supported by Zimbra. Too cautious? Maybe, but recovering from an in-place upgrade gone wrong is at best, quite arduous, even when supported by Zimbra. There are rarely any totally data safe rollback options with in-place upgrades, so we like to avoid the added risks from in-place upgrades, when side-by-side, or rolling upgrade, migrations are readily available.
If however your existing Zimbra system has NG installed, but also has issues (some customers fell behind in applying patches and suffered security issues), and you need to migrate right away, you can do so using tools like IMAPSYNC for the mail corpus, and rely on publicly available scripts for bulk provisioning accounts, exporting contacts, calendars and distribution lists.
We’ll update this post as Zimbra updates their migration tool set and new information comes to light.
In the interim, if you’d like help planning your Daffodil migration, please start the conversation by filling out the form:
Hope that helps,
L. Mark Stone
Mission Critical Email LLC
29 April 2023
The information provided in this blog is intended for informational and educational purposes only. The views expressed herein are those of Mr. Stone personally. The contents of this site are not intended as advice for any purpose and are subject to change without notice. Mission Critical Email makes no warranties of any kind regarding the accuracy or completeness of any information on this site, and we make no representations regarding whether such information is up-to-date or applicable to any particular situation. All copyrights are reserved by Mr. Stone. Any portion of the material on this site may be used for personal or educational purposes provided appropriate attribution is given to Mr. Stone and this blog.