Manually updating ESXi Hosts

This holiday season I had some time to install some much needed vSphere updates in my homelab. Since I have a small number of hosts to patch, I often update them manually instead of using vLCM (or VUM previously) as you would do in a production grade environment. The update in my case consisted of 2 parts.

• Update ESXi
• Update ESXi drivers

The main reason to create this post is that since vSphere 6.5, updating ESXi hosts using the CLI needs to be done via Image Profiles. Which is the supported method. This post is not about patching ESXi via vLCM or VUM.

Update VMware Tools on ESXi

When you’re looking for how to update VMware Tools on ESXi, check out this post:

Update VMware Tools package on ESXi

Updating ESXi

I don’t know why but it was only in the last couple of years that I got aware that updating ESXi using Image Profiles is the only supported way. This is mentioned in the documentation page: Upgrade or Update a Host with Image Profiles. Before that, I updated my ESXi lab hosts using the zip based depot file together with the vib based install method. Because of that the Image Profile version was never updated and kept showing the initially installed ESXi version. More to that later.

Check current version

You can check the current Image Profile version in the ‘Summary’ tab of your hosts in vCenter. This shows that my lab host runs a recent ESXi version that is updated the right way.

A CLI method is also available. The example below shows the status of my lab server when it was updated the wrong way, so via the ‘vib install‘ method, instead of the proper ‘profile update‘. The result is that the ESXi version does not match the Image Profiles version (which is still 6.5). This works, but is not supported.

[root@host:~] vmware -v
VMware ESXi 6.7.0 build-18828794

[root@host:~] esxcli software profile get
(Updated) ESXi-6.5.0-20170702001-standard
   Name: (Updated) ESXi-6.5.0-20170702001-standard
   Vendor: VMware, Inc.
   Creation Time: 2022-01-05T19:55:59
   Modification Time: 2022-01-05T19:56:38
   Stateless Ready: True

...

Updating ESXi the right way (using Image Profiles)

Download the offline depot file in zip format from VMware Customer Connect Product Patches for the ESXi version you need (requires a Customer Connect login).

It not mandatory to put the host in maintenance mode. Updating works fine with running VM’s when HA is disabled or not configured. You can check however if a certain VIB or Image Profiles requires a reboot or maintenance mode:

[root@host:~] esxcli software sources vib get --depot=file:///vmfs/volumes/<datastore>/Intel-ixgben_1.14.2.0-1OEM.67
0.0.0.8169922-offline_bundle-20540724.zip
INT_bootbank_ixgben_1.14.2.0-1OEM.670.0.0.8169922
   Name: ixgben
   Version: 1.14.2.0-1OEM.670.0.0.8169922
   Type: bootbank
   Vendor: INT
   Acceptance Level: VMwareCertified
   Summary: Network driver for Intel(R) 10 Gigabit Adapters
   Description: Native ixgben network driver for VMware ESXi
   ReferenceURLs:
   Creation Date: 2022-08-17
   Depends: vmkapi_2_5_0_0
   Conflicts:
   Replaces:
   Provides:
   Maintenance Mode Required: True
   Hardware Platforms Required:
   Live Install Allowed: False
   Live Remove Allowed: False
   Stateless Ready: True
   Overlay: False

To get started upload the ESXi offline depot in zip format to the datastore of the host to be updated. In this example “ESXi670-202210001.zip”.

scp ESXi670-202210001.zip root@x.x.x.x:/vmfs/volumes/<datastore>

Now update the image profile using the uploaded offline depot file. The CLI command “esxcli software profile” has two ways of doing so. You can choose between “update” and “install” options, of which “update” the is only supported method. The difference between them is:

Update: Updates existing VIBs with the corresponding VIBs from the specified profile, but does not affect other VIBs installed on the target server.

Install: Installs the VIBs present in the depot image profile, and removes any other VIBS installed on the target server.

Before starting the update process, you first need to determine the correct Image Profiles in the depot file.

[root@host:~] esxcli software sources profile list --depot=file:///vmfs/volumes/<datastore>/ESXi670-202210001.zip
Name                              Vendor        Acceptance Level  Creation Time        Modification Time
--------------------------------  ------------  ----------------  -------------------  -------------------
ESXi-6.7.0-20221004001-no-tools   VMware, Inc.  PartnerSupported  2022-09-21T13:36:44  2022-09-21T13:36:44
ESXi-6.7.0-20221001001s-standard  VMware, Inc.  PartnerSupported  2022-09-21T13:36:44  2022-09-21T13:36:44
ESXi-6.7.0-20221004001-standard   VMware, Inc.  PartnerSupported  2022-09-21T13:36:44  2022-09-21T13:36:44
ESXi-6.7.0-20221001001s-no-tools  VMware, Inc.  PartnerSupported  2022-09-21T13:36:44  2022-09-21T13:36:44

In my case, I chose the profile ‘ESXi-6.7.0-20221004001-standard‘ which also contains VMware Tools. Now all the parameters are known, let’s start.

It is advised to perform a dry-run of the updated, before starting the actual update. A dry-run can be performed by adding the option ‘–dry-run‘ to the statement.

[root@host:~] esxcli software profile update --depot=file:///vmfs/volumes/<datastore>/ESXi670-202210001.zip --profile=ESXi-6.7.0-20221004001-standard
Update Result
Message: The update completed successfully, but the system needs to be rebooted for the changes to be effective.
Reboot Required: true
VIBs Installed: VMW_bootbank_ntg3_4.1.8.0-4vmw.670.3.189.20497097, 
...
...
VMware_bootbank_rste_2.0.2.0088-7vmw.670.0.0.8169922, VMware_bootbank_vmware-esx-esxcli-nvme-plugin_1.2.0.36-2vmw.670.3.116.16713306

After a reboot, the ESXi and the Image Profile versions are in sync again.

[root@host:~] vmware -v
VMware ESXi 6.7.0 build-20497097

[root@speed-vm2:~] esxcli software profile get
(Updated) ESXi-6.7.0-20221004001-standard
   Name: (Updated) ESXi-6.7.0-20221004001-standard
   Vendor: VMware, Inc.
   Creation Time: 2022-12-29T15:28:17
   Modification Time: 2022-12-29T19:53:56
   Stateless Ready: False

Updating drivers

Updating or installing ESXi drivers (or other vendor tools) use a different variation of the CLI command. It uses ‘esxcli software vib‘ instead of ‘esxcli software profile‘. Before getting started, put the new or updated driver (or vendor tool) on a datastore which is available to the host. See the previous section for more info.

Now the host can be updated with individual vibs using the offline depot (zip) file(s). Certain drivers (and firmware combinations) are often recommend by the I/O device section of the VMware Compatibility Guide. The latest drivers are available via the Drivers & Tools section of the vSphere download page.

When using the CLI command ‘esxcli software profile‘ you can choose between the ‘update‘ and ‘install‘ options. A bit like in the previous section. In this example I’m updating the Intel NIC driver of my lab host.

[root@host:~] esxcli software vib update --depot=file:///vmfs/volumes/<datastore>/Updates/Intel-ixgben_1.14.2.0-1OEM.670.0.0.8169922-offline_bundle-20540724.zip
Installation Result
   Message: Operation finished successfully.
   Reboot Required: true
   VIBs Installed: INT_bootbank_ixgben_1.14.2.0-1OEM.670.0.0.8169922
   VIBs Removed:
   VIBs Skipped:

When the host is rebooted, the new driver will become active and is shown when retrieving the installed vib list via: ‘esxcli software vib list‘.

To conclude

Because I regularly update my lab hosts with the latest vSphere updates, It’s quite handy to update them the right way, so use Images Profiles and not via the ‘vib install’ method. The latter is the right way only for drivers and vendor tools.

Useful links

VMware Customer Connect Product Patches

vSphere Download page – Drivers section

vSphere Documentation – Update the image profile

vSphere Documentation – Upgrade or Update a Host with Image Profiles

vSphere Documentation – Determine Whether an Update Requires a Host to Be in Maintenance Mode or to Be Rebooted

VMware Compatibility Guide – I/O devices section