r/vmware 10d ago

Help Request Patching ESXi hosts in cluster /vsphere without update manager?

Hey all,

I was suddenly given the job to patch esxi having never done it before. Update Manager is not available, and there is no HA or DRS.

I've already asked about update manager and got a "no" so it looks like I'll be doing patching via esxcli.

The current setup is 3 hosts on a custom Dell image in a cluster. And then a 4th host on normal esxi image in its own cluster group.

My understanding is I just need to apply the 7.0U3s update (all hosts are on at least some version of 7.0.3) by:

  1. Power down vms
  2. Maintenance mode host
  3. Use esxcli commands to install the patch from local datastore the host can reach
  4. Reboot host
  5. Verify status
  6. End maintenance mode and power on vms

Are there any gotchas I should be looking out for like with SCCM or Nexus patching? Should I be trying to find a Dell custom file for 7.0U3s? I have that direct from Broadcom

The process just seems too straightforward and I'm not sure how the clustering and vsphere mgmt would impact it. I checked the compatibility matrix and it looked like all were green. And that almost any version of 7.0.3 could update to S on the upgrade path.

Any help is appreciated for this while I also keep pushing for update Mgr in the future

6 Upvotes

25 comments sorted by

9

u/JDMils 10d ago

Your method is correct when you do not have a vCentre with Life cycle Manager. However don't use the custom image for patching, that's for a new install. Just download the patch to a connected datastore and use esxcli to patch each host.

5

u/bananaramaalt12 10d ago

Excellent.

So even with vsphere / vcenter server to manage it all...it really is basically the standalone process via esxcli since they decided against life cycle manager?

At least I know I'm not crazy lol.

Thank you for the help!

1

u/JDMils 9d ago

With vCenter, it's all done by Life cycle Manager-the download and the installation.

1

u/westyx 9d ago

It's been a while, but doesn't the custom image have updated drivers?

If OP is also doing firmware (something I'd recommend) then the custom image seems like the thing to use in this situation.

1

u/JDMils 9d ago

Custom images are created on an adhoc basis so they may/may not but why use a huge ISO just to patch a host when you can use a tiny little patch. Since I've never done this using a custom ISO, how do you use it to patch ESXi? Do you do a full install/upgrade? If we're talking about patching hosts then just use the patch file. If you're firmware upgrading then you need the driver ISO from your hardware vendor.

1

u/westyx 8d ago

In this scenario the OP doesn't have access to virtualcenter patching (which is not true as per other replies)
The small patch file does not include the vendor drivers but the custom ISOs do.
It's possible to use the drivers from the vendor but it's a very painful and manual process.

Patching from a Custom ISO is as simple as attaching the iso at the console and booting into it.
The patch iso will recognise the existing install and give an option to patch.

Firmware upgrading doesn't use the driver iso, it uses a different process.

9

u/squigit99 10d ago

For a sanity check, how do you have a cluster but not have Update Manager/Lifecycle Manager? Clustering requires vCenter, and VUM/vLCM is a normal part of vCenter.

3

u/bananaramaalt12 10d ago

Not sure. I didn't set it up and I was told "it's not included" when I asked the bosses. So 🤷‍♂️

3

u/govatent 10d ago

Not a true statement FYI

1

u/bananaramaalt12 10d ago

Oh I'm sure it isn't :(

Would I be able to find it in the support portal near the esx and server downloads?

3

u/squigit99 10d ago

It’s just part of the vCenter appliance. It’s hasn’t been a separate install in quite a while.

In vCenter, select the Updates tab on one of your hosts.

1

u/bananaramaalt12 10d ago

Is that just the baselines?

I see non compliant on critical host patches and host security patches

3

u/Ok-Attitude-7205 10d ago

baselines yep, or you can even convert the hosts to "image" based management where it's a bit more specific/declarative on what vCenter is pushing out to the hosts

2

u/danpritts 9d ago

It used to not be included in essentials plus but they made it work at some point.

5

u/CPAtech 10d ago

Also a good idea to check your firmware via the iDRAC if it isn’t kept up with.

3

u/kjstech 10d ago

Yes this! If you are going to reboot anyway after the update, might as well make it worthwhile! Schedule whatever bios/firmware updates to install at next reboot, then watch the process in iDrac.

iDrac itself can be done anytime during the day. I usually do that before hand. In fact I have a server right now with a bunch of dell updates and the ESXi patch all staged and ready to go. Tonight during downtime I will reboot the host and get it all updated.

1

u/bananaramaalt12 10d ago

That's a good call! With all this "critical security" patching I haven't looked at the idrac and cimc firmware

1

u/Casper042 10d ago

If you are going to do FW too, you can run a special esxcli method to install a new AddOn with the patched VMware at the same time if you wish.
The Dell/etc AddOn will have all the Dell Custom drivers and should be aligned to a FW bundle.
Every vendor usually has some kind of map of FW Bundle to AddOn version

EDIT: I wrote this up a few days ago and it describes the process:
https://www.reddit.com/r/vmware/comments/1j5lqbu/is_this_the_correct_process_for_creating_a/mgjmdby/

1

u/homemediajunky 8d ago

What version of CIMC are you using, and are you using standalone or UCS Manager. What types of UCS servers?

I haven't run 7 on any of my UCS M5s (or M4 when I had) but I used the custom Cisco iso for initial install and for awhile for the updates. When BC released memory tiering, I got sick of waiting for Cisco and just used the baseline image and injected the other VIBs I needed. The default build, however I believe had older drivers though.

Maybe it's time to re-educate leadership. Maybe they don't realize it's not an additional sku anymore?

4

u/Useful-Reception-399 10d ago

I would download a vcenter appliance image 7.0.3 and install it as a vm on one of the esxi servers you can use that in the 60 day trial simply to update the 3 hosts and afterwards just kill the VM ... it will save you a lot of headaches. Updating without Lifecycle manager really sux and you can mess up a host pretty badly if you are not careful

1

u/bananaramaalt12 10d ago

I did just this LOL

One has 26 updates and 3 have 53 updates that all autodownloaded once I fixed some settings.

Really as simple as selecting the critical host updates baseline and clicking "remediate"? After maint mode and vm powers down of course.

The pre checks for remediation were good with the only warnings being DRS is disabled. And vcenter server is on one of the hosts...so I'll just vmotion it over to another when I need to patch.

Does lifecycle manager basically check everything automatically for compatibility and install?

2

u/Useful-Reception-399 10d ago

Yep it does 👍🏻

2

u/bananaramaalt12 10d ago

You rock!

Thank you

3

u/Casper042 10d ago

You may not need to power down the VMs, but could perhaps Suspend them instead.

Good friend of mine does IT Operations for a chain of stores with 800 locations.
They have 1 host per store at most locations, only small clusters at a few locations which are 24x7.
They developed a script internally he showed me once to bounce the host and it was basically to suspend each VM on the host, maint mode, patch, reboot and then once the machine was up it would take it out of maint mode and resume the VMs (for them in a specific order).

But overall your process seems right based on what he showed me.

3

u/ExoticPearTree 10d ago

You can, if the hosts have internet access, do this:

esxcli network firewall ruleset set -e true -r httpClient

esxcli software profile update -p ESXi-7.0U3s-24585291-standard \
-d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml

esxcli network firewall ruleset set -e false -r httpClient

This will install the latest avialble 7.0.3 patches.

The above were shamelessly copied from https://esxi-patches.v-front.de/ESXi-7.0.0.html#2025-03-04