Manually updating ESXi

In this post

ESXi is a handy piece of kit – A hypervisor with (currently) a free offering that allows you to virtualise a long list of system types. Whether it be for consolidation of resources, spinning up systems for testing, or running that bespoke application that isn’t supported on today’s hardware.

Like all operating environments, ESXi can benefit from updates that provide improved security posture, bug fixes, and improved features. Side note – Yes, updates also have the potential to introduce new bugs, vulnerabilities and performance issues. This is the case with all software releases; There is no such thing as bug-free software.

So, how do we update ESXi? While not an exhaustive list, we could:

Use vCenter and its Update Manager plugin to manage the updates. This is helpful if you operate a significant environment, as the Update Manager helps automate the process. Not everyone has vCenter though.
Download the updates manually from https://customerconnect.vmware.com/patch. This might be useful when you’re in a pinch, though it requires knowledge of which packages that you need.
Download the latest ISO and reinstall ESXi. While effective, this is a little heavy-handed for a simple update task, though it has its place.
Perform an update from ESXi using built-in capabilities.

We’ll take a look at the last option – Performing an update from the host itself. To proceed, we’ll assume that you’ve performed all of the required pre-update tasks:

Taken required backups
Switched to maintenance mode
Moved and/or shutdown workloads
Can log in to the ESXi host through SSH using a privileged account

Update prep

Enable the ESXi host firewall to allow HTTP traffic:

esxcli network firewall ruleset set -e true -r httpClient

Log into the ESXi host using the console or SSH. Request the current software profile:

esxcli software profile get
ESXi-8.0U1a-21813344-standard
   Name: ESXi-8.0U1a-21813344-standard
   Vendor: VMware, Inc.
   Creation Time: 2022-01-01T00:03:29
   Modification Time: 2024-04-23T00:26:07
   Stateless Ready: False
   Description: 
      
      The general availability release of VMware ESXi Server 8.0U1a
      brings whole new levels of virtualization performance to
      datacenters and enterprises.

   VIBs: atlantic 1.0.3.0-11vmw.801.0.0.21495797, ...
   DPU Profiles:

Online update

List the available depot profiles that are available to you. This will take some time. You can filter the results by grepping for your major version. e.g. grep -i ESXi-8.

esxcli software sources profile list -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml | grep -i ESXi-8
ESXi-8.0.0-20513097-standard      VMware, Inc.  PartnerSupported  2022-09-23T18:59:28  2022-09-23T18:59:28
ESXi-8.0.0-20513097-no-tools      VMware, Inc.  PartnerSupported  2022-09-23T18:59:28  2022-09-23T18:59:28
ESXi-8.0a-20842819-standard       VMware, Inc.  PartnerSupported  2022-12-08T00:00:00  2022-12-08T00:00:00
ESXi-8.0a-20842819-no-tools       VMware, Inc.  PartnerSupported  2022-12-08T00:00:00  2022-11-24T05:47:13
ESXi-8.0sb-21203431-standard      VMware, Inc.  PartnerSupported  2023-02-14T00:00:00  2023-02-14T00:00:00
ESXi-8.0sb-21203431-no-tools      VMware, Inc.  PartnerSupported  2023-02-14T00:00:00  2023-01-30T05:35:42
ESXi-8.0b-21203435-standard       VMware, Inc.  PartnerSupported  2023-02-14T00:00:00  2023-02-14T00:00:00
ESXi-8.0b-21203435-no-tools       VMware, Inc.  PartnerSupported  2023-02-14T00:00:00  2023-01-30T07:21:34
ESXi-8.0c-21493926-standard       VMware, Inc.  PartnerSupported  2023-03-30T00:00:00  2023-03-30T00:00:00
ESXi-8.0c-21493926-no-tools       VMware, Inc.  PartnerSupported  2023-03-30T00:00:00  2023-03-24T16:36:33
ESXi-8.0U1-21495797-standard      VMware, Inc.  PartnerSupported  2023-04-18T00:00:00  2023-04-18T00:00:00
ESXi-8.0U1-21495797-no-tools      VMware, Inc.  PartnerSupported  2023-04-18T00:00:00  2023-03-25T02:02:48
ESXi-8.0U1a-21813344-standard     VMware, Inc.  PartnerSupported  2023-06-01T00:00:00  2023-06-01T00:00:00
ESXi-8.0U1a-21813344-no-tools     VMware, Inc.  PartnerSupported  2023-06-01T00:00:00  2023-05-24T06:02:20
ESXi-8.0U1sc-22082334-standard    VMware, Inc.  PartnerSupported  2023-07-27T00:00:00  2023-07-27T00:00:00
ESXi-8.0U1sc-22082334-no-tools    VMware, Inc.  PartnerSupported  2023-07-27T00:00:00  2023-07-14T01:55:09
ESXi-8.0U1c-22088125-standard     VMware, Inc.  PartnerSupported  2023-07-27T00:00:00  2023-07-27T00:00:00
ESXi-8.0U1c-22088125-no-tools     VMware, Inc.  PartnerSupported  2023-07-27T00:00:00  2023-07-15T02:41:02
ESXi-8.0U1d-23299997-standard     VMware, Inc.  PartnerSupported  2024-03-05T00:00:00  2024-03-05T00:00:00
ESXi-8.0U1d-23299997-no-tools     VMware, Inc.  PartnerSupported  2024-03-05T00:00:00  2024-02-13T10:05:44
ESXi-8.0U2-22380479-standard      VMware, Inc.  PartnerSupported  2023-09-21T00:00:00  2023-09-21T00:00:00
ESXi-8.0U2-22380479-no-tools      VMware, Inc.  PartnerSupported  2023-09-21T00:00:00  2023-09-04T22:07:43
ESXi-8.0U2sb-23305545-standard    VMware, Inc.  PartnerSupported  2024-02-29T00:00:00  2024-02-29T00:00:00
ESXi-8.0U2sb-23305545-no-tools    VMware, Inc.  PartnerSupported  2024-02-29T00:00:00  2024-02-14T06:50:08
ESXi-8.0U2b-23305546-standard     VMware, Inc.  PartnerSupported  2024-02-29T00:00:00  2024-02-29T00:00:00
ESXi-8.0U2b-23305546-no-tools     VMware, Inc.  PartnerSupported  2024-02-29T00:00:00  2024-02-14T08:21:05

Kick-off the update process using the the desired package name from the list above as the target release. This activity will take a while, with output provided on completion of the command. Keep an eye out for a successful notification.

esxcli software profile update -p ESXi-8.0U2b-23305546-standard -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml
Update Result
   Message: The update completed successfully, but the system needs to be rebooted for the changes to be effective.
   VIBs Installed: VMW_bootbank_atlantic_1.0.3.0-12vmw.802.0.0.22380479, ...
   VIBs Skipped: 
   Reboot Required: true
   DPU Results:

Continue with post-update clean-up.

Offline update

Download the offline update bundle from the Broadcom support site
- Log in to the Broadcom Support portal.
- Use the dropdown next to Username and select VMware Cloud Foundations.
- On the left hand side menu, click My Downloads.
- In the search bar in the upper right side of the page enter “VMware vSphere”
  - Choose VMware vSphere
  - Note: Do not select “vCenter Server”.
- Under the Solutions Tab, choose the user entitlement for VMware vSphere (e.g. click on VMware vSphere – Enterprise).
- Select the major version of vSphere required.
- Find and download the desired version of ESXi in the list.
Copy the update bundle to a datastore on the ESXi host.
Validate the update by listing the contents of the bundle:

esxcli software sources profile list -d /vmfs/volumes/datastore/ISO/ESXi670-202210001.zip 
Name                              Vendor        Acceptance Level  Creation Time        Modification Time
--------------------------------  ------------  ----------------  -------------------  -------------------
ESXi-6.7.0-20221001001s-standard  VMware, Inc.  PartnerSupported  2022-09-21T13:36:44  2022-09-21T13:36:44
ESXi-6.7.0-20221001001s-no-tools  VMware, Inc.  PartnerSupported  2022-09-21T13:36:44  2022-09-21T13:36:44
ESXi-6.7.0-20221004001-standard   VMware, Inc.  PartnerSupported  2022-09-21T13:36:44  2022-09-21T13:36:44
ESXi-6.7.0-20221004001-no-tools   VMware, Inc.  PartnerSupported  2022-09-21T13:36:44  2022-09-21T13:36:44

Perform a dry-run of the update:

esxcli software profile update -p ESXi-6.7.0-20221004001-standard  -d /vmfs/volumes/datastore/ISO/ESXi670-202210001.zip --dry-run
Update Result
   Message: Dryrun only, host not changed. The following installers will be applied: [BootBankInstaller, LockerInstaller]
   Reboot Required: true
...

Enable maintenance mode:

esxcli system maintenanceMode set -e true

Perform the update:

esxcli software profile update -p ESXi-6.7.0-20221004001-standard  -d /vmfs/volumes/datastore/ISO/ESXi670-202210001.zip --no-hardware-warning
Update Result
   Message: The update completed successfully, but the system needs to be rebooted for the changes to be effective.
   Reboot Required: true
...

Disable maintenance mode:

esxcli system maintenanceMode set -e false

Continue with post-update clean-up.

Update clean-up

Disable HTTP traffic firewall policy and reboot the system. When the system returns, query the current software profile to validate the status of the update:

esxcli network firewall ruleset set -e false -r httpClient
reboot

======

esxcli software profile get
(Updated) ESXi-8.0U2b-23305546-standard
   Name: (Updated) ESXi-8.0U2b-23305546-standard
   Vendor: VMware, Inc.
   Creation Time: 2024-04-23T01:00:13
   Modification Time: 2024-04-23T01:11:16
   Stateless Ready: True
   Description:

Now it’s just testing, verification and return to service.