Chapter 10. Patching ESXi Hosts and Upgrading Virtual Machines

You have to keep your ESXi hosts up to date with the latest patches to keep them secure and to solve bugs. The hardware compatibility of the virtual machines and the version of the VMware Tools in your virtual machines have to be updated as well to be able to use the newest features. All of these updates can be done and managed using the VMware vSphere Update Manager (VUM). This powerful piece of software is included in the VMware vCenter Server license.

vSphere Update Manager uses a local repository in which it stores patches downloaded from VMware and VMware partners, such as Dell and Hewlett Packard Enterprise (HPE). You can create baselines, in which you define the patches that have to be installed on your hosts. Then, you can scan your hosts for compliance with the baselines. If a host has missing patches, you can stage the missing patches to the host. Finally, you can remediate your hosts to install the missing patches....

Downloading new patches into the Update Manager repository

Before you can upgrade your ESXi hosts with the latest patches and upgrade the VMware Tools in your virtual machines, you have to download the patches from the enabled patch download sources to the local patch repository on your vSphere Update Manager server.

After installation of vSphere Update Manager, the download sources of VMware are already configured. Other vendors that have download sources are DELL and Hewlett-Packard Enterprise. The download sources of the companies are:

• http://vmwaredepot.dell.com/index.xml

• http://vibsdepot.hpe.com/index.xml

• http://vibsdepot.hpe.com/index-drv.xml

Unfortunately, you cannot use PowerCLI to add download sources to vSphere Update Manager. You have to use the vSphere Web Client to do this. Go to Home | Update Manager | Select your vSphere Update Manager in the left pane | Manage | Settings | Download Settings | Edit... to edit the download sources.

In the following screenshot of the vSphere...

Retrieving patches in the Update Manager repository

To list the content of your vSphere Update Manager repository, you can use the Get-Patch cmdlet. The syntax of the Get-Patch cmdlet is as follows. The first parameter set is to retrieve patches by a baseline.

Get-Patch [[-SearchPhrase] <String[]>] [-Id <Int32[]>] [-Baseline <Baseline[]>] [-Severity <PatchSeverity[]>] [-Product <String[]>] [-After <DateTime>] [-Before <DateTime>] [-TargetType <PatchTargetType[]>] [-Vendor <String[]>] [-InstallationImpact <PatchInstallationImpact[]>] [-BundleType <PatchBundleType[]>] [-Category <UpdateCategory[]>] [<CommonParameters>]

The second parameter set is to retrieve patches by server:

Get-Patch [-Server <VIServer[]>] [[-SearchPhrase] <String[]>] [-Id <Int32[]>] [-Severity <PatchSeverity[]>] [-Product <String[]>] [-After <DateTime>] [-Before <DateTime>] [-TargetType <PatchTargetType...

Using baselines and baseline groups

Baselines are a collection of patches, service packs, bug fixes, extensions, or upgrades that you want to be installed on your ESXi hosts. Baselines can be of one of the following types:

• Host patch

• Host extension

• Host upgrade

• VA upgrade

The VA upgrade type is for the upgrade of virtual appliances.

Baselines can be fixed or dynamic. A fixed baseline remains the same, even if new patches are added to the repository. Dynamic baselines are automatically updated when new patches are added to the repository.

During the installation of vSphere Update Manager, some baselines are already created:

• Critical Host Patches (Predefined)

• Non-Critical Host Patches (Predefined)

• VA Upgrade to Latest (Predefined)

• VM Hardware Upgrade to Match Host (Predefined)

• VMware Tools Upgrade to Match Host (Predefined)

All of the predefined baselines are dynamic.

You can create additional baselines to specify which patches must be installed. You can create fixed or dynamic baselines. You...

Testing inventory objects for compliance with baselines

If you want to know whether your inventory objects are up to date or have missing patches, you can use the Test-Compliance cmdlet to test inventory objects for compliance with baselines attached to them. The syntax of the Test-Compliance cmdlet is as follows:

Test-Compliance [-Server <VIServer[]>] [-Entity] <InventoryItem[]>
    [[-UpdateType] <UpdateType[]>] [-RunAsync] [-WhatIf] [-Confirm] 
    [<CommonParameters>]

The -Entity parameter is required. You can use the -UpdateType parameter to specify the type of the patches and upgrades you want to scan. The valid values are: HostPatch, HostUpgrade, HostThirdParty, VmPatch, VmHardwareUpgrade, VmToolsUpgrade, and VaUpgrade. The VmPatch value is deprecated and will be removed in a following release of PowerCLI.

In the first example, we will scan all the hosts in the New York data center for missing patches:

PowerCLI C:\> Test-Compliance -UpdateType HostPatch...

Retrieving baseline compliance data

After scanning your inventory objects against one or more baselines for missing patches or upgrades, you can use the Get-Compliance cmdlet to retrieve the compliance data. The syntax of the Get-Compliance cmdlet is as follows:

Get-Compliance [-Server <VIServer[]>] [-Entity] <InventoryItem> [-ComplianceStatus <ComplianceStatus>] [-Baseline <Baseline[]>] [-Detailed] [<CommonParameters>]

The -Entity parameter is required.

In the following example, we will retrieve the compliance status for the hosts in the cluster Cluster01 against the Critical Host Patches (Predefined) baseline:

PowerCLI C:\> $Baseline = Get-Baseline -Name 'Critical Host
    Patches (Predefined)'
PowerCLI C:\> Get-Compliance -Entity (Get-Cluster -Name
    'Cluster01') -Baseline $Baseline

The output of the preceding commands is as follows:

Entity        Baseline                           Status
------        --------                           ...

Initializing staging of patches

Staging is the copying of patches to ESXi hosts without applying the to the hosts. This can reduce the time hosts that are in the maintenance mode during the remediation. Staging is optional. You can remediate hosts without staging the patches to the host in advance. The Copy-Patch cmdlet initializes staging of patchespatches to the hosts. This can reduce the time hosts that are in the maintenance mode during the remediation. Staging is optional. You can remediate hosts without staging the patches to the host in advance. The Copy-Patch cmdlet initializes staging of patches. The syntax of the Copy-Patch cmdlet is as follows:

Copy-Patch [-Server <VIServer[]>] [-Entity] <InventoryItem[]> [-Baseline <PatchBaseline[]>] [-ExcludePatch <Patch[]>] [-RunAsync] [-WhatIf] [-Confirm] [<CommonParameters>]

The -Entity parameter is required.

In the following example, we will stage patches to host 192.168.0.133:

PowerCLI C:\> Copy-Patch -Entity...

Remediating inventory objects

To remediate inventory objects against specified baselines, you can use the Update-Entity cmdlet. The syntax of the Update-Entity cmdlet is as follows:

Update-Entity [-Server <VIServer[]>] -Entity <InventoryItem> -Baseline <Baseline[]> [-ExcludePatch <Patch[]>] [-GuestCreateSnapshot [<Boolean>]] [-GuestKeepSnapshotHours <Int32>] [-GuestTakeMemoryDump [<Boolean>]] [-GuestSnapshotName <String>] [-GuestSnapshotDescription <String>] [-HostRetryDelaySeconds <Int32>] [-HostNumberOfRetries <Int32>] [-HostFailureAction <HostRemediationFailureAction>] [-HostPreRemediationPowerAction <HostPreRemediationPowerAction>] [-HostDisableMediaDevices [<Boolean>]] [-HostIgnoreThirdPartyDrivers [<Boolean>]] [-HostEnablePXEbootHostPatching [<Boolean>]] [-ClusterDisableDistributedPowerManagement [<Boolean>]] [-ClusterDisableHighAvailability [<Boolean>]] [-ClusterDisableFaultTolerance...

Summary

In this chapter, we discussed the downloading of patches into the Update Manager repository and retrieving the patches in this repository. You saw how to use baselines and test inventory objects for compliance with these baselines. You also learned to retrieve baseline compliance data and initialize the staging of patches to ESXi hosts for faster remediation. We used the vSphere Update Manager to upgrade or update your ESXi hosts with the latest patches. You also saw how to update the VMware Tools inside your virtual machines and upgrade the hardware version of your virtual machines.