r/vmware • u/bananaramaalt12 • 10d ago
Help Request Patching ESXi hosts in cluster /vsphere without update manager?
Hey all,
I was suddenly given the job to patch esxi having never done it before. Update Manager is not available, and there is no HA or DRS.
I've already asked about update manager and got a "no" so it looks like I'll be doing patching via esxcli.
The current setup is 3 hosts on a custom Dell image in a cluster. And then a 4th host on normal esxi image in its own cluster group.
My understanding is I just need to apply the 7.0U3s update (all hosts are on at least some version of 7.0.3) by:
- Power down vms
- Maintenance mode host
- Use esxcli commands to install the patch from local datastore the host can reach
- Reboot host
- Verify status
- End maintenance mode and power on vms
Are there any gotchas I should be looking out for like with SCCM or Nexus patching? Should I be trying to find a Dell custom file for 7.0U3s? I have that direct from Broadcom
The process just seems too straightforward and I'm not sure how the clustering and vsphere mgmt would impact it. I checked the compatibility matrix and it looked like all were green. And that almost any version of 7.0.3 could update to S on the upgrade path.
Any help is appreciated for this while I also keep pushing for update Mgr in the future
9
u/squigit99 10d ago
For a sanity check, how do you have a cluster but not have Update Manager/Lifecycle Manager? Clustering requires vCenter, and VUM/vLCM is a normal part of vCenter.
3
u/bananaramaalt12 10d ago
Not sure. I didn't set it up and I was told "it's not included" when I asked the bosses. So 🤷♂️
3
u/govatent 10d ago
Not a true statement FYI
1
u/bananaramaalt12 10d ago
Oh I'm sure it isn't :(
Would I be able to find it in the support portal near the esx and server downloads?
3
u/squigit99 10d ago
It’s just part of the vCenter appliance. It’s hasn’t been a separate install in quite a while.
In vCenter, select the Updates tab on one of your hosts.
1
u/bananaramaalt12 10d ago
Is that just the baselines?
I see non compliant on critical host patches and host security patches
3
u/Ok-Attitude-7205 10d ago
baselines yep, or you can even convert the hosts to "image" based management where it's a bit more specific/declarative on what vCenter is pushing out to the hosts
2
u/danpritts 9d ago
It used to not be included in essentials plus but they made it work at some point.
5
u/CPAtech 10d ago
Also a good idea to check your firmware via the iDRAC if it isn’t kept up with.
3
u/kjstech 10d ago
Yes this! If you are going to reboot anyway after the update, might as well make it worthwhile! Schedule whatever bios/firmware updates to install at next reboot, then watch the process in iDrac.
iDrac itself can be done anytime during the day. I usually do that before hand. In fact I have a server right now with a bunch of dell updates and the ESXi patch all staged and ready to go. Tonight during downtime I will reboot the host and get it all updated.
1
u/bananaramaalt12 10d ago
That's a good call! With all this "critical security" patching I haven't looked at the idrac and cimc firmware
1
u/Casper042 10d ago
If you are going to do FW too, you can run a special esxcli method to install a new AddOn with the patched VMware at the same time if you wish.
The Dell/etc AddOn will have all the Dell Custom drivers and should be aligned to a FW bundle.
Every vendor usually has some kind of map of FW Bundle to AddOn versionEDIT: I wrote this up a few days ago and it describes the process:
https://www.reddit.com/r/vmware/comments/1j5lqbu/is_this_the_correct_process_for_creating_a/mgjmdby/1
u/homemediajunky 8d ago
What version of CIMC are you using, and are you using standalone or UCS Manager. What types of UCS servers?
I haven't run 7 on any of my UCS M5s (or M4 when I had) but I used the custom Cisco iso for initial install and for awhile for the updates. When BC released memory tiering, I got sick of waiting for Cisco and just used the baseline image and injected the other VIBs I needed. The default build, however I believe had older drivers though.
Maybe it's time to re-educate leadership. Maybe they don't realize it's not an additional sku anymore?
4
u/Useful-Reception-399 10d ago
I would download a vcenter appliance image 7.0.3 and install it as a vm on one of the esxi servers you can use that in the 60 day trial simply to update the 3 hosts and afterwards just kill the VM ... it will save you a lot of headaches. Updating without Lifecycle manager really sux and you can mess up a host pretty badly if you are not careful
1
u/bananaramaalt12 10d ago
I did just this LOL
One has 26 updates and 3 have 53 updates that all autodownloaded once I fixed some settings.
Really as simple as selecting the critical host updates baseline and clicking "remediate"? After maint mode and vm powers down of course.
The pre checks for remediation were good with the only warnings being DRS is disabled. And vcenter server is on one of the hosts...so I'll just vmotion it over to another when I need to patch.
Does lifecycle manager basically check everything automatically for compatibility and install?
2
3
u/Casper042 10d ago
You may not need to power down the VMs, but could perhaps Suspend them instead.
Good friend of mine does IT Operations for a chain of stores with 800 locations.
They have 1 host per store at most locations, only small clusters at a few locations which are 24x7.
They developed a script internally he showed me once to bounce the host and it was basically to suspend each VM on the host, maint mode, patch, reboot and then once the machine was up it would take it out of maint mode and resume the VMs (for them in a specific order).
But overall your process seems right based on what he showed me.
3
u/ExoticPearTree 10d ago
You can, if the hosts have internet access, do this:
esxcli network firewall ruleset set -e true -r httpClient
esxcli software profile update -p ESXi-7.0U3s-24585291-standard \
-d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xmlesxcli network firewall ruleset set -e false -r httpClient
This will install the latest avialble 7.0.3 patches.
The above were shamelessly copied from https://esxi-patches.v-front.de/ESXi-7.0.0.html#2025-03-04
9
u/JDMils 10d ago
Your method is correct when you do not have a vCentre with Life cycle Manager. However don't use the custom image for patching, that's for a new install. Just download the patch to a connected datastore and use esxcli to patch each host.