This holiday season I had some time to install some much needed ESXi updates in my homelab. Since I have a small number of hosts to patch, I often update them manually instead of using vLCM (or VUM previously) as you would do in a production grade environment. The update in my case consisted of 2 parts.
- Update ESXi
- Update ESXi drivers
The main reason to create this post is that since vSphere 6.5, updating ESXi hosts using the CLI needs to be done via Image Profiles. Which is the supported method. This post is not about patching ESXi via vLCM or VUM.
Update VMware Tools on ESXi
When you’re looking for how to update VMware Tools on ESXi, check out this post:
Update VMware Tools package on ESXi
I don’t know why but it was only in the last couple of years that I got aware that updating ESXi using Image Profiles is the only supported way. This is mentioned in the documentation page: Upgrade or Update a Host with Image Profiles. Before that, I updated my ESXi lab hosts using the zip based depot file together with the vib based install method. Because of that the Image Profile version was never updated and kept showing the initially installed ESXi version. More to that later.
Check current version
You can check the current Image Profile version in the ‘Summary’ tab of your hosts in vCenter. This shows that my lab host runs a recent ESXi version that is updated the right way.
A CLI method is also available. The example below shows the status of my lab server when it was updated the wrong way, so via the ‘vib install‘ method, instead of the proper ‘profile update‘. The result is that the ESXi version does not match the Image Profiles version (which is still 6.5). This works, but is not supported.
[root@host:~] vmware -v VMware ESXi 6.7.0 build-18828794 [root@host:~] esxcli software profile get (Updated) ESXi-6.5.0-20170702001-standard Name: (Updated) ESXi-6.5.0-20170702001-standard Vendor: VMware, Inc. Creation Time: 2022-01-05T19:55:59 Modification Time: 2022-01-05T19:56:38 Stateless Ready: True ...
Updating ESXi the right way (using Image Profiles)
Download the offline depot file in zip format from VMware Customer Connect Product Patches for the ESXi version you need (requires a Customer Connect login).
It not mandatory to put the host in maintenance mode. Updating works fine with running VM’s when HA is disabled or not configured. You can check however if a certain VIB or Image Profiles requires a reboot or maintenance mode:
[root@host:~] esxcli software sources vib get --depot=file:///vmfs/volumes/speed-vm2\<datastore>/Intel-ixgben_184.108.40.206-1OEM.67 0.0.0.8169922-offline_bundle-20540724.zip INT_bootbank_ixgben_220.127.116.11-1OEM.618.104.22.16869922 Name: ixgben Version: 22.214.171.124-1OEM.6126.96.36.19969922 Type: bootbank Vendor: INT Acceptance Level: VMwareCertified Summary: Network driver for Intel(R) 10 Gigabit Adapters Description: Native ixgben network driver for VMware ESXi ReferenceURLs: Creation Date: 2022-08-17 Depends: vmkapi_2_5_0_0 Conflicts: Replaces: Provides: Maintenance Mode Required: True Hardware Platforms Required: Live Install Allowed: False Live Remove Allowed: False Stateless Ready: True Overlay: False
To get started upload the ESXi offline depot in zip format to the datastore of the host to be updated. In this example “ESXi670-202210001.zip”.
scp ESXi670-202210001.zip firstname.lastname@example.org:/vmfs/volumes/<datastore>
Now update the image profile using the uploaded offline depot file. The CLI command “esxcli software profile” has two ways of doing so. You can choose between “update” and “install” options, of which “update” the is only supported method. The difference between them is:
Update: Updates existing VIBs with the corresponding VIBs from the specified profile, but does not affect other VIBs installed on the target server.
Install: Installs the VIBs present in the depot image profile, and removes any other VIBS installed on the target server.
Before starting the update process, you first need to determine the correct Image Profiles in the depot file.
[root@host:~] esxcli software sources profile list --depot=file:///vmfs/volumes/<datastore>/ESXi670-202210001.zip Name Vendor Acceptance Level Creation Time Modification Time -------------------------------- ------------ ---------------- ------------------- ------------------- ESXi-6.7.0-20221004001-no-tools VMware, Inc. PartnerSupported 2022-09-21T13:36:44 2022-09-21T13:36:44 ESXi-6.7.0-20221001001s-standard VMware, Inc. PartnerSupported 2022-09-21T13:36:44 2022-09-21T13:36:44 ESXi-6.7.0-20221004001-standard VMware, Inc. PartnerSupported 2022-09-21T13:36:44 2022-09-21T13:36:44 ESXi-6.7.0-20221001001s-no-tools VMware, Inc. PartnerSupported 2022-09-21T13:36:44 2022-09-21T13:36:44
In my case, I chose the profile ‘ESXi-6.7.0-20221004001-standard‘ which also contains VMware Tools. Now all the parameters are known, let’s start.
It is advised to perform a dry-run of the updated, before starting the actual update. A dry-run can be performed by adding the option ‘–dry-run‘ to the statement.
[root@host:~] esxcli software profile update --depot=file:///vmfs/volumes/<datastore>/ESXi670-202210001.zip --profile=ESXi-6.7.0-20221004001-standard Update Result Message: The update completed successfully, but the system needs to be rebooted for the changes to be effective. Reboot Required: true VIBs Installed: VMW_bootbank_ntg3_188.8.131.52-4vmw.6184.108.40.20697097, ... ... VMware_bootbank_rste_2.0.2.0088-7vmw.6220.127.116.1169922, VMware_bootbank_vmware-esx-esxcli-nvme-plugin_18.104.22.168-2vmw.622.214.171.12413306
After a reboot, the ESXi and the Image Profile versions are in sync again.
[root@host:~] vmware -v VMware ESXi 6.7.0 build-20497097 [root@speed-vm2:~] esxcli software profile get (Updated) ESXi-6.7.0-20221004001-standard Name: (Updated) ESXi-6.7.0-20221004001-standard Vendor: VMware, Inc. Creation Time: 2022-12-29T15:28:17 Modification Time: 2022-12-29T19:53:56 Stateless Ready: False
Updating or installing ESXi drivers (or other vendor tools) use a different variation of the CLI command. It uses ‘esxcli software vib‘ instead of ‘esxcli software profile‘. Before getting started, put the new or updated driver (or vendor tool) on a datastore which is available to the host. See the previous section for more info.
Now the host can be updated with individual vibs using the offline depot (zip) file(s). Certain drivers (and firmware combinations) are often recommend by the I/O device section of the VMware Compatibility Guide. The latest drivers are available via the Drivers & Tools section of the vSphere download page.
When using the CLI command ‘esxcli software profile‘ you can choose between the ‘update‘ and ‘install‘ options. A bit like in the previous section. In this example I’m updating the Intel NIC driver of my lab host.
[root@host:~] esxcli software vib update --depot=file:///vmfs/volumes/5862dad9-ef2 576a7-560d-0010e046ab48/Updates/Intel-ixgben_126.96.36.199-1OEM.6188.8.131.5269922-offline_bundle-20540724.zip Installation Result Message: Operation finished successfully. Reboot Required: true VIBs Installed: INT_bootbank_ixgben_184.108.40.206-1OEM.6220.127.116.1169922 VIBs Removed: VIBs Skipped:
When the host is rebooted, the new driver will become active and is shown when retrieving the installed vib list via: ‘esxcli software vib list‘.
Because I regularly update my lab hosts with the latest updates, It’s quite handy to update them the right way, so use Images Profiles and not via the ‘vib install’ method. The latter is the right way only for drivers and vendor tools.
VMware Customer Connect Product Patches
vSphere Download page – Drivers section
vSphere Documentation – Update the image profile
vSphere Documentation – Upgrade or Update a Host with Image Profiles
vSphere Documentation – Determine Whether an Update Requires a Host to Be in Maintenance Mode or to Be Rebooted