Managing Host and

Cluster Lifecycle
Modified on 13 AUG 2020
VMware vSphere 7.0
VMware ESXi 7.0
Managing Host and Cluster Lifecycle

You can find the most up-to-date technical documentation on the VMware website at:

https://docs.vmware.com/

VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com

©
Copyright 2020 VMware, Inc. All rights reserved. Copyright and trademark information.

VMware, Inc. 2
 Contents

About Managing Host and Cluster Lifecycle 7

Updated Information 8

1 About vSphere Lifecycle Manager 9

The vSphere Lifecycle Manager User Interface in the vSphere Client 11
vSphere Lifecycle Manager Terms and Definitions 13
ESXi Lifecycle Management with vSphere Lifecycle Manager 16
vSphere Lifecycle Manager Architecture 17
vSphere Lifecycle Manager Requirements and Specifics 18

2 Software Packages and Distribution Formats in vSphere 7.0 21

VIBs, Bulletins, Components 21
ESXi Base Images and Vendor Add-Ons 22
Distribution Formats for Software Updates 23

3 vSphere Lifecycle Manager Baselines and Images 25

Baselines and Baseline Groups 25
vSphere Lifecycle Manager Images 27
What Is in an Image? 29
Baselines and Images: What is the Difference? 30

4 vSphere Lifecycle Manager Privileges 31

vSphere Lifecycle Manager Privileges For Using Images 31
vSphere Lifecycle Manager Privileges For Using Baslines 33

5 Working with the vSphere Lifecycle Manager Depot 34

Types of Depots 35
Browsing the vSphere Lifecycle Manager Depot 37
Import Updates to the vSphere Lifecycle Manager Depot 39
Import an ISO Image to the vSphere Lifecycle Manager Depot 40
Delete an ISO Image from the vSphere Lifecycle Manager Depot 41
Synchronize the vSphere Lifecycle Manager Depot 42
Configuring the vSphere Lifecycle Manager Download Sources 43
Configure vSphere Lifecycle Manager to Use a Shared Repository as a Download Source
45
Configure vSphere Lifecycle Manager to Use the Internet as a Download Source 47
Add a New Download Source 47

VMware, Inc. 3
Managing Host and Cluster Lifecycle

Modify a Download Source 48

Configure the vSphere Lifecycle Manager Automatic Download Task 49
Run the VMware vSphere vSphere Lifecycle Manager Update Download Task 50
Configure the vSphere Lifecycle Manager Proxy Settings 50

6 Configuring the vSphere Lifecycle Manager Remediation Settings 52

Cluster Settings and Host Remediation 53
Configure Remediation Settings for vSphere Lifecycle Manager Images 55
Configure Remediation Settings for vSphere Lifecycle Manager Baselines 56

7 Cluster Operations and vSphere Lifecycle Manager 59

8 Using Baselines and Baseline Groups 61

Creating and Working with Baselines and Baseline Groups 62
Baseline Types 64
Create a Fixed Patch Baseline 65
Create a Dynamic Patch Baseline 66
Create a Host Extension Baseline 68
Create a Host Upgrade Baseline 69
Create a Host Baseline Group 70
Edit a Patch Baseline 71
Edit a Host Extension Baseline 72
Edit a Host Upgrade Baseline 73
Edit a Baseline Group 73
Add or Remove a Single Update from a Custom Baseline 74
Duplicate Baselines and Baseline Groups 75
Delete Baselines and Baseline Groups 76
Attaching Baselines and Baseline Groups to vSphere Objects 76
Attach Baselines and Baseline Groups to Objects 76
Detach Baselines and Baseline Groups from Objects 77
Checking Compliance Against vSphere Lifecycle Manager Baselines and Baseline Groups 78
Initiate a Compliance Check for ESXi Hosts Manually 79
Schedule Regular Compliance Checks for ESXi Hosts 79
Host Upgrade Compliance Messages 80
Host Upgrade Compliance Messages When Cisco Nexus 1000V Is Present 82
Viewing Compliance Information About ESXi Hosts and Updates 83
Staging Patches and Extensions to ESXi Hosts 93
Stage Patches and Extensions to ESXi Hosts 94
Remediating ESXi Hosts Against vSphere Lifecycle Manager Baselines and Baseline Groups
95
Understanding the Remediation Operation 96
Types of Host Remediation 97

VMware, Inc. 4
Managing Host and Cluster Lifecycle

Remediating Hosts in a Cluster 98

Remediating Hosts That Contain Third-Party Software 100
Remediating ESXi 6.5 or ESXi 6.7 Hosts Against an ESXi 7.0 Image 100
Remediation Pre-Check Report 101
Generate a Pre-Remediation Check Report 103
Remediate ESXi Hosts Against a Single Baseline or Multiple Baselines 104

9 Using Images 108

Working with Images 109
Setting Up an Image 110
Viewing Image Details 110
Editing Images 111
Reusing Existing Images 113
Checking Compliance Against a Single Image 116
Compliance States 117
Check Cluster Compliance Against an Image 118
View Host Compliance Information 119
Run a Remediation Pre-Check 119
Remediating a Cluster Against a Single Image 120
Edit the Remediation Settings for a Cluster 121
Remediate a Cluster Against a Single Image 122
View Last Remediation or Remediation Pre-Check Results for a Cluster that Uses a Single
Image 123
Manage Depot Overrides for a Cluster 124

10 Switching from Baselines to Images 126

Cluster Eligibility to Use vSphere Lifecycle Manager Images 128
Set Up a New Image 130
Import an Existing Image 132

11 Recommended Images 134

Check for Recommended Images 135
Use a Recommended Image 136

12 Firmware Updates 138

Deploying Hardware Support Managers 139
Use an Image for Firmware Updates 140

13 Hardware Compatibility Checks 143

Check the Hardware Compatibility of a Cluster 144
Check the Hardware Compatibility of a Host 145
Sync Hardware Compatibility Data 147

VMware, Inc. 5
Managing Host and Cluster Lifecycle

Hardware Compatibility Report for a Host 147

14 vSAN Clusters and vSphere Lifecycle Manager 150

Remediation Specifics of vSAN Clusters 151
Recommendation Baseline Groups 152
Updating Firmware in vSAN Clusters 154

15 Backup and Restore Scenarios When Using vSphere Lifecycle Manager 155

16 Upgrading Virtual Machines with vSphere Lifecycle Manager 157

Configure Virtual Machine Rollback Settings 157
Checking the Status of Virtual Machines 159
Check the Status of an Individual Virtual Machine 159
Check the Status of the Virtual Machines in a Container Object 160
The VMware Tools Status 160
Upgrading Virtual Machines 161
Upgrade the VM Hardware Compatibility of Virtual Machines 162
Upgrade the VMware Tools Version of Virtual Machines 163
Automatically Upgrade VMware Tools on Reboot 165

17 Installing, Setting Up, and Using Update Manager Download Service 166
Compatibility Between UMDS and vSphere Lifecycle Manager 167
Installing UMDS 167
Supported Linux-Based Operating Systems for Installing UMDS 167
Install UMDS on a Linux OS 168
Uninstall UMDS from a Linux OS 168
Setting Up and Using UMDS 169
Set Up the Data to Download with UMDS 170
Change the UMDS Patch Repository Location 170
Configure URL Addresses for Hosts 171
Download the Specified Data Using UMDS 171
Export the Downloaded Data 172

VMware, Inc. 6
About Managing Host and Cluster Lifecycle
®
Managing Host and Cluster Lifecycle provides information about configuring and using VMware
vSphere Lifecycle Manager to manage the ESXi hosts and clusters in your environment.

Managing Host and Cluster Lifecycle provides instructions for configuring vSphere Lifecycle
Manager, working with the vSphere Lifecycle Manager depot, and using baselines and images to
install, update, or upgrade the software and firmware running on your ESXi hosts.

Managing Host and Cluster Lifecycle also provides detailed guidelines about using vSphere
Lifecycle Manager recommended images and performing hardware compatibility checks on
single hosts or clusters. It also describes how you can configure and use the Update Manager
Download Service (UMDS) to download software updates in deployments with no access to the
Internet.

Intended Audience
This information is intended for experienced system administrators who are familiar with data
center operations and virtual machine technology.

Client Interface
The instructions in this guide reflect the HTML5-based vSphere Client.

VMware, Inc. 7
Updated Information

This Managing Host and Cluster Lifecycle is updated with each release of the product or when
necessary.

This table provides the update history of the Managing Host and Cluster Lifecycle.

Revision Description

13 AUG 2020 At VMware, we value inclusion. To foster this principle within our customer, partner, and internal
community, we are replacing some of the terminology in our content. We have updated this guide to
remove instances of non-inclusive language.
n Changed the layout of the vSphere Lifecycle Manager Requirements and Specifics topic.
n Added information about enabling unsupported solutions on an empty cluster in vSphere Lifecycle
Manager Requirements and Specifics.
n Elaborated on the same-vendor requirement for ESXi hosts in vSphere Lifecycle Manager
Requirements and Specifics.
n Added the information that vSphere Lifecycle Manager uses the vCenter Server proxy settings in
Configuring the vSphere Lifecycle Manager Download Sources.
n Updated the information in Remediation Pre-Check Report.

05 MAY 2020 n Updated the diagram in Types of Depots.

n Moved the Distribution Formats for vSphere Lifecycle Manager Images topic to the Chapter 9 Using
Images section.

30 APR 2020 Updated list of the Linux-based operating systems that UMDS supports. See Supported Linux-Based
Operating Systems for Installing UMDS.

23 APR 2020 Updated information about the requirements and limitations when using a vSphere Lifecycle Manager
image. See vSphere Lifecycle Manager Requirements and Specifics.

02 APR 2020 Initial release.

VMware, Inc. 8
About vSphere Lifecycle Manager
1
®
VMware vSphere vSphere Lifecycle Manager enables centralized and simplified lifecycle
management for VMware ESXi hosts through the use of images and baselines.

What Is Lifecycle Management?

Lifecycle management refers to the process of installing software, maintaining it through updates
and upgrades, and decommissioning it.

In the context of maintaining a vSphere environment, your clusers and hosts in particular,
lifecycle management refers to tasks such as installing ESXi and firmware on new hosts, and
updating or upgrading the ESXi version and firmware when required.

vSphere Lifecycle Manager General Overview

In vSphere 7.0, vSphere Lifecycle Manager encompasses the functionality that Update Manager
provided in earlier vSphere releases and enhances it by adding new features and possibilities for
ESXi lifecycle management at a cluster level.

vSphere Lifecycle Manager is a service that runs in vCenter Server. Upon deploying the vCenter
Server appliance, the vSphere Lifecycle Manager user interface becomes automatically enabled
in the HTML5-based vSphere Client.

vSphere Lifecycle Manager can work in an environment that has access to the Internet, directly
or through a proxy server. It can also work in a secured network without access to the Internet. In
such cases, you use the Update Manager Download Service (UMDS) to download updates to the
vSphere Lifecycle Manager depot, or you import them manually.

Images and Baselines

With vSphere Lifecycle Manager, you manage ESXi hosts by using either baselines or images.

In earlier vSphere releases, using baselines and baseline groups for host operations, such as
applying patches and software updates to a host and upgrading the ESXi version, was a
functionality that was already available.

VMware, Inc. 9
Managing Host and Cluster Lifecycle

In vSphere 7.0, you can use images as an alternative way of performing ESXi host lifecycle
operations. A vSphere Lifecycle Manager image represents a desired software specification to be
applied to all hosts in a cluster. Software and firmware updates happen simultaneously, in a
single workflow. By using images vSphere Lifecycle Manager images, you can also take
advantage of new functionalities, such as image recommendations, automized firmware updates
and hardware compatibility checks.

A vSphere Lifecycle Manager image is a precise description of what software, drivers, and
firmware to run on a host. With this new functionality, you set up a single image and apply it to all
hosts in a cluster, thus ensuring cluster-wide host image homogeneity.

Like in earlier vSphere releases, you can use vSphere Lifecycle Manager baselines and baseline
groups to perform the following tasks:

n Upgrade and patch ESXi hosts.

n Install and update third-party software on ESXi hosts.

Starting with vSphere 7.0, you can use vSphere Lifecycle Manager images to manage hosts in
clusters collectively and perform the following tasks:

n Install a desired ESXi version on all hosts in a cluster.

n Install and update third-party software on all ESXi hosts in a cluster.

n Update the firmware of all ESXi hosts in a cluster.

n Update and upgrade all ESXi hosts in a cluster collectively.

n Check the hardware compatibility of hosts against hardware compatibility lists, such as
VMware Compatibility Guide (VCG) and a host and vSAN Hardware Compatibility List (vSAN
HCL).

Note vSphere Lifecycle Manager provides you with the ability to start using images with the
very creation of a cluster. If you do not set up an image during the creation of a cluster, you can
switch from using vSphere Lifecycle Manager baselines to using vSphere Lifecycle Manager
images at a later time.

If you switch to using images, you cannot revert to using baselines for the cluster. You can move
the hosts to another cluster, which uses baselines, but you cannot change the cluster that
already uses a single image for management purposes.

vSphere Lifecycle Manager and Virtual Machines

You can use vSphere Lifecycle Manager to upgrade the virtual machine hardware and VMware
Tools versions of the virtual machines in your environment.

This chapter includes the following topics:

n The vSphere Lifecycle Manager User Interface in the vSphere Client

n vSphere Lifecycle Manager Terms and Definitions

VMware, Inc. 10
Managing Host and Cluster Lifecycle

n ESXi Lifecycle Management with vSphere Lifecycle Manager

n vSphere Lifecycle Manager Architecture

n vSphere Lifecycle Manager Requirements and Specifics

The vSphere Lifecycle Manager User Interface in the

vSphere Client
After you deploy the vCenter Server appliance, vSphere Lifecycle Manager becomes immediately
visible in the vSphere Client.

The vSphere Lifecycle Manager user interface has two main views, which for convenience this
book calls the home view and the compliance view.

vSphere Lifecycle Manager Home View

The vSphere Lifecycle Manager home view is where you configure and administer the vSphere
Lifecycle Manager instance that runs on your vCenter Server system. You go to the vSphere
Lifecycle Manager home view to configure how vSphere Lifecycle Manager baselines and images
work.

You do not need any special privilege to access the vSphere Lifecycle Manager home view.

To access the vSphere Lifecycle Manager home view in the vSphere Client, select Menu >
Lifecycle Manager.

In the vSphere Lifecycle Manager home view, you specify the vSphere Lifecycle Manager
instance that you want to administer by selecting a vCenter Server system from the drop-down
menu at the top of the Lifecycle Manager pane.

In the Lifecycle Manager pane, you have the following top-level tabs: Image Depot, Updates,
Imported ISOs, Baslines, and Settings.

You use the Image Depot tab when you work vSphere Lifecycle Manager images. You use the
Updates, Imported ISOs, and Baselines tabs when you work with vSphere Lifecycle Manager
baselines. For more information about the Image Depot, Updates, and Imported ISOs tabs, see
Browsing the vSphere Lifecycle Manager Depot.

The Settings tab is where you configure all vSphere Lifecycle Manager remediation settings and
download sources. You use the Settings with both vSphere Lifecycle Manager images and
baselines. For more information about configure the vSphere Lifecycle Manager settings, see
Chapter 6 Configuring the vSphere Lifecycle Manager Remediation Settings.

In the vSphere Lifecycle Manager home view, you can perform the following tasks:

n Browse the vSphere Lifecycle Manager depot.

n Trigger the synchronization of updates with the configured online depots.

n Trigger the synchronization of hardware compatibility data.

n Import offline depots manually.

VMware, Inc. 11
Managing Host and Cluster Lifecycle

n Import ISO images to use for the creation of upgrade baselines.

n Create and manage baselines and baseline groups.

n Configure the default vSphere Lifecycle Manager download source.

n Add a URL to an online depot to the list of download sources.

n Enable or disable downloading from a download source.

n Configure host remediation settings.

n Configure virtual machine rollback settings.

vSphere Lifecycle Manager Compliance View

The vSphere Lifecycle Manager compliance view is where you perform the major vSphere
Lifecycle Manager operations - checking the compliance of ESXi hosts against a baseline or an
image, staging, remediation pre-checks, remediation, and so on.

You go to the vSphere Lifecycle Manager compliance view to actually use the vSphere Lifecycle
Manager baselines and images on your clusters and hosts.

To access the vSphere Lifecycle Manager compliance view in the vSphere Client, you must have
the View Compliance Status privilege.

Generally, the vSphere Lifecycle Manager compliance view is on the Updates tab for a selected
object.

Depending on the selected object and weather you use baselines or images to manage the
object, you access the vSphere Lifecycle Manager compliance view in two different ways.

n To access the vSphere Lifecycle Manager compliance view for a host or a cluster that you
manage with baselines, go to the Updates tab for the object and select Baselines.

In the Baselines pane of the vSphere Lifecycle Manager compliance view, you can perform
the following tasks:

n Check the compliance status of ESXi hosts and clusters against baselines or baseline
groups.

n Attach and detach baselines and baseline groups to hosts and clusters.

n Generate a remediation pre-check report that lists recommended actions to ensure

successful remediation.

n Stage patches or extensions to hosts.

n Check the compliance status of ESXi hosts against an image.

n Remediate hosts against baselines and baseline groups.

n Remediate hosts that are part of a vSAN cluster against system-managed baselines.

n To access the vSphere Lifecycle Manager compliance view for a cluster that you manage with
a single image, go to the Updates tab for the cluster and select Image.

VMware, Inc. 12
Managing Host and Cluster Lifecycle

In the Image pane of the vSphere Lifecycle Manager compliance view, you can perform the
following tasks:

n Export, import, and edit the image that the cluster uses.

n Upgrade the firmware of the ESXi hosts in the cluster.

n Check for and view recommended images for the cluster.

n Check the hardware compatibility for a selected ESXi version against vSAN HCL .

n Check the compliance status of the ESXi hosts against the image.

n Run a remediation pre-check to ensure successful remediation.

n Remediate the ESXi hosts against the image that the cluster uses.

On the the Updates tab, you can also perform other tasks.

n Under Hosts, select Hardware Compatibility to check the hardware compatibility of a host
against the VMware Compatibility Guide.

n Under Hosts, select VMware Tools or VM Hardware to check the status of virtual machines
and upgrade the VMware Tools version or the virtual hardware version of the virtual
machines.

vSphere Lifecycle Manager and vCenter Server Single Sign-On

Domain
If your vCenter Server system is connected to other vCenter Server systems by a common
vCenter Single Sign-On domain, you can configure the settings for each vSphere Lifecycle
Manager instance. The modifications to the settings are applied only to the vSphere Lifecycle
Manager instance that you specify and are not propagated to the other instances in the group.
Similarly, you can use vSphere Lifecycle Manager to perform compliance and status checks, and
remediate only those inventory objects that are managed by the vCenter Server system where
the respective vSphere Lifecycle Manager instance runs.

vSphere Lifecycle Manager Terms and Definitions

To use vSphere Lifecycle Manager effectively, you must get acquainted with the basic
terminology related to software updates, the way vSphere Lifecycle Manager works, and the
operations that you can perform with vSphere Lifecycle Manager.

The presented terminology is grouped according to its relevance:

n General terminology that is relevant to both vSphere Lifecycle Manager baselines and images

n Terminology that is relevant to vSphere Lifecycle Manager images only

n Terminology that is relevant to vSphere Lifecycle Manager baselines only

VMware, Inc. 13
Managing Host and Cluster Lifecycle

Table 1-1. General Terms

Term Definition

Update In general terms, a software update provides software fixes

and enhancements. Both patching and upgrade are types
of software update operations.
An update release is a release that makes small changes to
the current version of the software. Starting with vSphere
7.0, update releases are marked in the following manner:
7.0 U1, 7.0 U2, and so on.

Upgrade Unlike an update, the upgrade introduces major changes to

the software.
Upgrade releases change the major version of the software
product. For example, the transitions from vSphere 6.0 to
vSphere 6.7 or vSphere 7.0 are both upgrades.

Patch A patch is a small software update that provides bug fixes

or enhancements to the current version of the software.
Starting with vSphere 7.0, patch releases are marked by
adding a letter to the version: 7.0a, 7.0 U1a, and so on.

VIB VIB stands for vSphere Installation Bundle. A VIB is a

software package that contains metadata and a binary
payload, which represents the actual piece of software to
be installed on ESXi. VIBs are the smallest container for
installable payloads.

VIB metadata An XML file (descriptor.xml) that describes the contents

of the VIB. It also contains dependency information, textual
descriptions, system requirements, and information about
bulletins.
vSphere Lifecycle Manager downloads only the metadata
during a synchronization of the depot.

Standalone VIB A VIB that is not included in a component.

Depot The hosted version of the updates that VMware, OEMs,

and third-party software vendors provide. The depot
contains the metadata and the actual VIBs of the updates.

Offline bundle/Offline depot An archive that encapsulates VIBs and the corresponding
metadata in a self-contained ZIP file that you use for offline
patching and updates. Starting with vSphere 7.0, you can
use offline bundles that contain vendor-created add-on to
customize an ESXi release (that is, ESXi stock image).
A single offline bundle might contain multiple base images,
vendor add-ons, or components.

OEM Original Equipment Manufacturer. OEMs are VMware

partners, for example Dell, HPE, VMware Cloud on AWS.

Third-party software providers Providers of I/O filters, device drivers, CIM modules, and so
on.

VMware, Inc. 14
Managing Host and Cluster Lifecycle

Table 1-2. vSphere Lifecycle Manager Images

Term Definition

Component A logical grouping of one or more VIBS that encapsulates a

functionality. Starting with vSphere 7.0, the component is
the smallest unit that is used by vSphere Lifecycle Manager
to install VMware and third-party software on ESXi hosts.
The component is defined in a similar way as the bulletin,
but it contains some additional information.

Add-On A set of components that, typically, OEMs bundle together

with an ESXi image to create a custom installable ESXi
image. Add-ons provide OEM customization for ESXi. In
vSphere 7.0, an ESXi base image plus a vendor add-on is
practically identical to the OEM custom image from earlier
vSphere releases.

Solution A VMware product that integrates with vCenter Server and

adds some new functionality to the ESXi hosts in the
inventory.
Some solutions, like HA and vSAN, integrate with vSphere
Lifecycle Manager.

Hardware Compatibility Lists Lists of the certified hardware compatible with a selected
ESXi or vSAN version.

Hardware support manager A vendor-provided plug-in that you must install to be able
to validate and update the firmware of the servers from
that vendor. Each OEM provides their own hardware
support manager, which you must deploy and register as a
vCenter Server extension.

Table 1-3. vSphere Lifecycle Manager Baselines

Term Definition

Bulletin A grouping of one or more VIBs. Bulletins are defined

within the metadata of the VIB. Bulletins are the basic
packaging mechanism for delivering software updates in
previous vSphere releases. In vSphere 7.0, bulletins coexist
with components. You can use bulletins to create vSphere
Lifecycle Manager baselines, but you cannot use bulletins
with vSphere Lifecycle Managerimages.

Patch A bulleting that groups one or more VIBs together to

address a particular issue or to provide enhancements.

Roll-up A collection of patches that is grouped to facilitate

downloads and deployment.

Extension A bulletin that defines a group of VIBs for adding an

optional component to an ESXi host. An extension is
usually provided by a third party, which is also responsible
for providing patches, or updates, for the extension.

VMware, Inc. 15
Managing Host and Cluster Lifecycle

vSphere Lifecycle Manager Operations

The main vSphere Lifecycle Manager operations are related to checking whether the objects in
your environment are up to date with a baseline or an image and performing the actual updates
of ESXi hosts.

Term Definition Relevant To

Validation A check that ensures that a vSphere vSphere Lifecycle Manager images
Lifecycle Manager image is applicable
to all hosts in a cluster.

Compliance check Scanning an ESXi hosts to determine n vSphere Lifecycle Manager images
its level of compliance against an n vSphere Lifecycle Manager
attached baseline or against a single baselines
image used at cluster level.

Staging When you stage patches or vSphere Lifecycle Manager baselines

extensions to an ESXi host, you
download patch and extension VIBs
to the host without applying them
immediately. Staging makes the
patches and extensions available
locally on the hosts. This action is
available only when you use baselines
and baseline groups for to manage
the lifecycle of the hosts in your
environment.

Remediation Applying software updates to an ESXi n vSphere Lifecycle Manager images

host. During remediation, you actually n vSphere Lifecycle Manager
install software on the hosts. Whether baselines
you use baselines or images, it is only
though remediation that you can
make a non-compliant host compliant
with a baseline or an image.

ESXi Lifecycle Management with vSphere Lifecycle Manager

vSphere Lifecycle Manager facilitates the process of managing the software on the hosts in your
environment by addressing today's challenges of using multiple deployment and upgrade
methods and tools.

ESXi Lifecycle Management: The Current State of Affairs

Today, you can use various methods and tools to deploy ESXi hosts and maintain their software
lifecycle.
®
To deploy and boot an ESXi host, you can use an ESXi installer image or VMware vSphere Auto
Deploy™. The availability of choice options results in two different underlying ESXi platforms.

n Using vSphere Auto Deploy can result in the so-called stateless mode of delivering ESXi.

n Using an installer ESXi image results in the so-called stateful mode of delivering ESXi.

VMware, Inc. 16
Managing Host and Cluster Lifecycle

Further, depending on the deployment method, you must use a separate set of tools and
methods for ESXi update and upgrade operations. For example, you can use Update Manager
®
baselines, VMware vSphere ESXi™ Image Builder CLI, esxcli, vSphere Auto Deploy etc. Each of
those methods requires that you follow a specific workflow and work with a specific ESXi image
format.

Regardless of the method and tools that you use for software lifecycle management, the ESXi
image that you install or upgrade might change at runtime either due to some solutions installing
software on the host automatically or a service changing a setting.

vSphere Lifecycle Manager Images: A Single Platform, Single Tool,

Single Workflow
By introducing the concept of images, vSphere Lifecycle Manager provides a unified platform for
ESXi lifecycle management. You can use vSphere Lifecycle Manager for stateful hosts only, but
starting with vSphere 7.0, you can convert the Auto Deploy-based stateless hosts into stateful
hosts, which you can add to clusters that you manage with vSphere Lifecycle Manager images.

When you use vSphere Lifecycle Manager images, you follow the same workflow and use the
same ESXi image format for the install and upgrade, as well as update and patching, operations,
which significantly simplifies the lifecycle management process.

Using vSphere Lifecycle Manager images helps prevent image drifts that might occur at runtime.
With vSphere Lifecycle Manager images, you define the precise software stack to run on your
hosts and no deviation is possible, because vSphere Lifecycle Manager does not allow solutions
to push VIBs directly onto the hosts.

vSphere Lifecycle Manager images work at the cluster level and you no longer need to work with
individual hosts.

vSphere Lifecycle Manager Architecture

Several components make up vSphere Lifecycle Manager and work together to deliver the
vSphere Lifecycle Manager functionality and coordinate the major lifecycle management
operations that it provides for.

vSphere Lifecycle Manager is a service that runs in vCenter Server and uses the embedded
vCenter Server PostgreSQL database. No additional installation is required to start using that
feature.

Some of the components that make up vSphere Lifecycle Manager run in the vCenter Server
appliance as part of the respective service, while others are external to vCenter Server.

To carry out some of the vSphere Lifecycle Manager operations - for example, compatibility
checks, validation, and remediation - the service in vCenter Server communicates with agents
inside ESXi, so that the actual changes happen on the respective host.

vSphere Lifecycle Manager performs extensive health checks to ensure that remediation against
baselines and images is safe and successful.

VMware, Inc. 17
Managing Host and Cluster Lifecycle

The Desired State Model

The concept of images that vSphere Lifecycle Manager introduces in vSphere 7.0 is based on the
Desired State model for managing ESXi hosts and clusters.

The desired state of an ESXi host represents both the target software and target configuration
for the host as opposed to the software and configuration that it currently runs. The Desired
State model is the idea of managing hosts and clusters by defining and applying a desired state
instead of listing and following steps to change the current state.

vSphere Lifecycle Manager Requirements and Specifics

Depending on whether you want to use baselines or images for software lifecycle management,
you must comply with a different set of requirements. To achieve your goals, you must also know
the specifics in behavior and limitations that vSphere Lifecycle Manager has.

VMware, Inc. 18
Managing Host and Cluster Lifecycle

Table 1-4. Requirements for Using vSphere Lifecycle Manager

Scenario Requirements

Using a single image to manage a cluster. n All ESXi hosts in the cluster must be of version 7.0 and
later.
n All ESXi hosts in the cluster must be stateful.

A stateful install is one in which the the host boots from

a disk.
n All ESXi hosts in the cluster must be from the same
vendor and with identical hardware.

Different generations and models of servers need

different software drivers, which implies that you must
set up different vSphere Lifecycle Manager images to
manage each generation or model. However, with
vSphere Lifecycle Manager, you use one single image
for the entire cluster. Also, vSphere Lifecycle Manager
does not detect and handle the hardware differences
between the hosts in the cluster.

You can use a vSphere Lifecycle Manager image to

manage a heterogeneous cluster only if the vSphere
Lifecycle Manager image for the cluster includes
vendor customization, for example a vendor or
firmware add-on, that can address and handle the
hardware differences across the hosts in the cluster,
which is a rare scenario.
n The cluster must include only integrated solutions, for
®
example VMware vSAN™ and VMware vSphere High
Availability (HA).

In vSphere 7.0, you cannot use a vSphere Lifecycle

Manager image to manage a cluster that has vSphere
with Kubernetes enabled or NSX installed. Such clusters
continue to function normally and you can manage
such clusters by using baselines and baseline groups.
Switching from baselines to images for clusters with
vSphere with Kubernetes or NSX is not possible.

Similarly, you cannot use vSphere with Kubernetes or

install NSX-T on a cluster that you already manage with
a single image.

Using baselines and baseline groups to manage a cluster. n To use baselines for ESXi host patching operations,
vSphere Lifecycle Manager works with ESXi 6.5, ESXi
6.7, and ESXi 7.0.
n To use baselines for ESXi host upgrade operations,
vSphere Lifecycle Manager works withESXi 6.5, ESXi
6.7, and their respective Update releases.

VMware, Inc. 19
Managing Host and Cluster Lifecycle

Table 1-4. Requirements for Using vSphere Lifecycle Manager (continued)

Scenario Requirements

Switching from using baselines to using a single image to n The cluster must meet the requirements for using an
manage a cluster. image.
n The cluster must be eligible for the transition.

For more information about the Check cluster's

eligibility to be managed with a single image task, see
Cluster Eligibility to Use vSphere Lifecycle Manager
Images.

Upgrading virtual machine hardware and VMware Tools For VMware Tools and virtual machine hardware upgrade
operations, vSphere Lifecycle Manager works with ESXi
6.5, ESXi 6.7, and ESXi 7.0.

Table 1-5. vSphere Lifecycle Manager Behavior Specifics

Scenario vSphere Lifecycle Manager Behavior

Using a single image to manage a cluster. n When you set up and save an image for a cluster, the
image is not applied to the hosts in the cluster unless
you remediate the hosts. The mere action of changing
the management method does not alter the hosts in the
cluster.
n After you set up an image for the cluster and remediate
the hosts in the cluster against the image, standalone
VIBs are deleted from the hosts.
n After you set up an image for the cluster and remediate
the hosts in the cluster against the image, non-
integrated solution agents are deleted from the hosts.

Switching from using baselines to using a single image to n If you switch to using images, you cannot revert to
manage a cluster. using baselines for the cluster. You can move the hosts
to a cluster that uses baselines, but you cannot change
a cluster that already uses a single image for
management purposes.
n You cannot switch to using images for clusters that
have vSphere with Kubernetes enabled or that already
have NSX installed.
n If you enable a solution that cannot work with vSphere
Lifecycle Manager, for example vSphere with
Kubernetes, on an empty cluster and attempt to switch
to using an image for that cluster, the transition
operation succeeds. However, the result is an
unsupported cluster configuration, because both
vSphere Lifecycle Manager and the non-integrated
solution are enabled on the cluster.

VMware, Inc. 20
Software Packages and
Distribution Formats in vSphere
7.0
2
To use vSphere Lifecycle Manager effectively, you must understand the basic concepts related
to the way software is created, packaged, and distributed. vSphere 7.0 introduces a new model
for software packaging and distribution.

This chapter includes the following topics:

n VIBs, Bulletins, Components

n ESXi Base Images and Vendor Add-Ons

n Distribution Formats for Software Updates

VIBs, Bulletins, Components

To understand the difference between vSphere Lifecycle Manager images and vSphere Lifecycle
Manager baselines, you must understand the relation between the basic software packaging
types that VMware, OEMs, and third-party vendors use to create and ship software updates.

A vSphere Installation Bundle, or a VIB, is the basic building block for the creation of installation
packages for ESXi hosts. The VIB does not represent an entire feature, but just a single module
of the feature. So, the VIB is the smallest installable software unit that VMware and other
software vendors ship. However, vSphere Lifecycle Manager does not consume and work with
individual VIBs. To use vSphere Lifecycle Manager baselines or images, the VIBs must be further
packaged into a higher-level construct.

In earlier vSphere releases, VMware packaged one or multiple VIBs into an .xml file called the
bulletin. OEMs and third-party software vendors created VIBs, but bulletins were only created by
VMware as part of the certification process. You could use only bulletins, and not individual VIBs,
to create baselines and use them to update and upgrade ESXi hosts.

Starting with vSphere 7.0, the component becomes the basic packaging construct for VIBs.
VMware, OEMs, and third-party software providers now deliver software in the form of
components and not bulletins. The component is a bulletin with additional metadata providing
the name and version of the component. And just like a bulletin, a component might contain one
or multiple VIBs. However, unlike the bulletin, the component is a logical grouping of VIBs and
upon installation, it provides you with a visible feature.

VMware bundles components together into a fully functional ESXi image.

VMware, Inc. 21
Managing Host and Cluster Lifecycle

OEMs bundle components into add-ons and deliver them through the VMware online depot and
as offline bundles.

Third-party software vendors create and ship drivers as components.

In vSphere 7.0, vSphere Lifecycle Manager can consume both bulletins and components. If you
use baselines and baseline groups to manage a host or a cluster, vSphere Lifecycle Manager
reads and lists the components available in the vSphere Lifecycle Manager depot as bulletins.
You can find the list of available bulletins on the Updates tab in the vSphere Lifecycle Manager
home view.

If you use a vSphere Lifecycle Manager image to manage hosts collectively, you can only work
with components and the related notions of add-ons and base image. You can find the list of the
components, add-ons, and ESXi base images on the Image Depot tab in the vSphere Lifecycle
Manager home view.

ESXi Base Images and Vendor Add-Ons

The ESXi base image is a collection of components that forms a complete, bootable ESXi image.
OEMs pack one or multiple components into a unit called an add-on. You use vendor add-ons to
customize an ESXi release for a family of servers.

Base Images
The base image is an ESXi image that VMware provides with every release of ESXi. The base
image is a collection of components that is complete and can boot up a server. Base images have
a user-readable name and a unique version that is updated with every major or minor release of
ESXi.

Base images are hosted and available in the VMware online depot. Additionally, you can
download an ESXi installer ISO file and an offline bundle (ZIP file) that contains the ESXi version
from my.vmware.com.

Vendor Add-Ons
You use vendor add-ons to customize an ESXi image with OEM content and drivers.

The add-on is a collection of components that does not represent a complete, bootable image.
You cannot use vendor add-ons on their own. To customize an ESXi release, you must add a
vendor add-on to an ESXi base image.

When combined with an ESXi base image, the add-on can add, update, or remove components
that are part of the ESXi base image.

In vSphere Client, for each add-on available in the depot, you can view the list of components
that it adds to an ESXi base image. Similarly, you can find information about the components that
it removes from a base image, when you add the add-on to an ESXi base image.

VMware, Inc. 22
Managing Host and Cluster Lifecycle

In earlier vSphere releases, OEMs merged their content with the stock image that VMware
provided, thus creating a custom image, which they distributed as an ISO file and as an offline
bundle (ZIP file). OEMs released custom images in accordance with the major and update
releases of vSphere.

Starting with vSphere 7.0, in addition to custom ISO images and offline bundles, OEMs can
release ZIP files that contain only the vendor add-on, that is, the delta between the custom image
and the ESXi base image. OEMs can release such add-on ZIP files at their discretion. The
introduction of the concept of add-ons decouples the release cycle of OEMs from the release
cycle of VMware. As a result, you can update vendor add-ons independently of updating the
ESXi version of your hosts. Also, the vendor add-on decouples the OEM customization from the
VMware stock image, thus letting you combine software components more freely.

The combination of a vendor add-on and an ESXi base image is practically identical to an OEM
custom image.

Distribution Formats for Software Updates

VMware, OEMs, and third-party software vendors must ship their software updates in a format
that vSphere Lifecycle Manager supports and can consume.

vSphere Lifecycle Manager can consume software updates only if they are delivered in one of
the following ways - in an online depot, as an offline depot, or as an installable ISO image.

An online depot is the hosted version of the software updates that VMware, OEMs, and third-
party software providers ship. You access an online depot through a URL.

vSphere Lifecycle Manager includes preconfigured URLs that point to the default VMware depot.
Starting with vSphere 7.0, the default online depot that VMware provides hosts vendor add-ons.
The default depot also contains ESXi-compatible I/O device drivers certified by VMware. You can
use the vSphere Client to access third-party online depots that contain additional components.

The offline bundle is a ZIP file that contains the software metadata and the respective VIBs. In
addition to uploading software to online depots, VMware, OEMs, and third-party software
providers create and distribute downloadable offline bundles.

Starting with vSphere 7.0, in addition to distributing an offline.zip file (offline bundle) and a
custom ISO image, OEMs distribute an Add-on.zip file that contains the delta between the OEM
custom image and the base image that VMware provides.

VMware, Inc. 23
Managing Host and Cluster Lifecycle

Software Vendor Software Deliverable Software Distribution Format

VMware Base images n The default VMware online depot

n Offline bundle
n ISO image

OEMs Add-ons n The default VMware online depot

n Offline bundle
n Add-on ZIP file
n ISO image

Third-party software providers Components For device drivers that are certified by
VMware:
n The default VMware online depot
n Offline bundle
For other third-party software that is
verified and certified by OEMs, for
example I/O filters, CIM module:
n An online depot
n Offline bundle

VMware, Inc. 24
vSphere Lifecycle Manager
Baselines and Images 3
vSphere Lifecycle Manager enables you to manage ESXi hosts and clusters with images or
baselines. You can set up an image at the cluster level and you use the image to manage all hosts
in the cluster collectively. You can use baselines with individual ESXi hosts and with all other
inventory objects that contain ESXi hosts.

To manage a all ESXi hosts in a cluster with a single image, you have two options.

n Set up an image for the cluster during the creation of the cluster

n Skip setting up an image for the cluster and switch from using baselines to using images at a
later time.

For more information about creating a cluster that uses a single image, see the vCenter Server
and Host Management documentation.

For more information about switching to vSphere Lifecycle Manager images, see Chapter 10
Switching from Baselines to Images.

To manage a cluster with baselines and baseline groups, you must skip setting up an image
during the creation of the cluster.

For more information about managing hosts and clusters with baselines and baseline groups, see
Chapter 8 Using Baselines and Baseline Groups .

This chapter includes the following topics:

n Baselines and Baseline Groups

n vSphere Lifecycle Manager Images

n Baselines and Images: What is the Difference?

Baselines and Baseline Groups

You use baselines and baseline groups to update and upgrade the ESXi hosts in your
environment.

In previous vSphere releases, baselines and baseline groups were the only option that Update
Manager provided for host updates and upgrades.

VMware, Inc. 25
Managing Host and Cluster Lifecycle

Baselines
A baseline is a grouping of multiple bulletins. You can attach a baseline to an ESXi host and check
the compliance of the host against the associated baseline. Depending on its content, a baseline
can be a patch, extension, or upgrade baseline. Patch and extension baselines contain bulletins
of the respective kind. Upgrade baselines contain ESXi images.

Baselines can be classified according to different criteria.

n Depending on the type of update, baselines are patch baselines, extension baselines, and
upgrade baselines.

n Depending on how the update content is selected, baselines are fixed and dynamic.

n Depending on how they are created and managed, baselines are predefined,
recommendation, or custom baselines.

vSphere Lifecycle Manager provides three predefined host patch baselines: Host Security
Patches, Critical Host Patches, and Non-Critical Host Patches. You cannot edit or delete the
predefined baselines. You can use the predefined baselines to check the compliance status of
ESXi hosts. Alternatively, you can use the predefined baselines to create patch, extension,
and upgrade baselines that meet your criteria. Custom baselines are the baselines that you
create. Recommendation baselines are baselines generated automatically byvSAN. You can
use recommendation baselines only with vSAN clusters.

Baseline Groups
A baseline group is a collection of non-conflicting baselines. You can attach the entire baseline
group to an inventory object to check the compliance status of the object against all the
baselines in the group as a whole.

You can combine custom baselines with any of the predefined baselines to create baseline
groups. The baselines that you add to a baseline group must be non-conflicting.

Host baseline groups can contain a single upgrade baseline, and various patch and extension
baselines.

The following are valid combinations of baselines that can make up a baseline group:

n Multiple host patch and extension baselines.

n One upgrade baseline, multiple patch, and extension baselines.

For example, one ESXi upgrade baseline and multiple ESXi patch or extension baselines.

To use baselines and baseline groups, you must attach them to an inventory object.

Although you can attach baselines and baseline groups to individual objects, a more efficient
method is to attach them to container objects, such as folders, vApps, clusters, and data centers.
Individual vSphere objects inherit baselines attached to the parent container object. Removing an
object from a container removes the inherited baselines from the object.

VMware, Inc. 26
Managing Host and Cluster Lifecycle

For more information about creating and managing baselines and baseline groups, see Creating
and Working with Baselines and Baseline Groups.

vSphere Lifecycle Manager Images

Starting with vSphere 7.0, you can use a single image to manage all hosts in a cluster collectively.
The concept of an image in the context of vSphere Lifecycle Manager is different from existing
notions such as custom image, stock image, image profile, and so on.

vSphere Lifecycle Manager Images and Existing vSphere

Terminology
The concept of an image that vSphere Lifecycle Manager introduces must not be confused with
existing vSphere terminology related to the creation, distribution, installation, update, and
customization of ESXi images.

Term Definition

ESXi image The stock ISO image that VMware delivers at a major or
update ESXi release.

ESXi base image Starting with vSphere 7.0, at each release, VMware delivers
a collection of components called a base image.
You can use vSphere Lifecycle Manager to select an ESXi
base image to apply to all hosts in your clusters. For further
customization, you can add vendor add-ons or additional
components to the base image.
OEMs use the base image to create their custom images.

Custom image A custom image is an ESXi installation image with a

customized set of updates, patches, and drivers. You
create custom images with vSphere ESXi Image Builder CLI.
OEMs also create custom images by using the ESXi
Packaging Kit. A custom image can be an ISO or ZIP file.
In vSphere 7.0, you can use custom ISO images only when
you work with vSphere Lifecycle Manager baselines and
baseline groups. For example, you use ISO images to
create upgrade baselines.
When you use vSphere Lifecycle Manager images, the
combination of an ESXi base image and a vendor add-on is
practically an exact equivalent of the custom image that
OEMs create.

VMware, Inc. 27
Managing Host and Cluster Lifecycle

Term Definition

Image profile An image profile is a collection of VIBs that defines an ESXi

image. You create an image profile by using vSphere ESXi
Image Builder CLI. You can use the image profile to
provision hosts with vSphere Auto Deploy.
Like vSphere Lifecycle Manager images, image profiles
specify the software that you want to use during the
installation or upgrade of an ESXi host. However, vSphere
Lifecycle Manager does not work with image profiles.

vSphere Lifecycle Manager image Introduced in vSphere 7.0. A vSphere Lifecycle

Managerimage is a combination of of VMware software,
vendor add-on, drivers and firmware specific to the
hardware in use.

What Is an Image?
A vSphere Lifecycle Manager image represents a desired software specification to be applied to
all hosts in a cluster. The image is a combination of vSphere software, driver software, and
desired firmware with regard to the underlying host hardware. You set up an image at a cluster
level and you use the image to manage all hosts in the cluster collectively. The image that a
cluster uses defines the full software set that you want to run on the ESXi hosts in the cluster: the
ESXi version, additional VMware-provided software, and vendor software, such as firmware and
drivers.

You can configure a cluster to use images during cluster creation or later. If you do not specify an
image to be associated with a cluster during cluster creation, you can only use baselines to
manage the cluster and hosts in the cluster. However, if all hosts in the cluster are stateful and
run ESXi 7.0 or later, you can at any time switch to using images for cluster and host
management.

Note If you switch to using images, you cannot revert to using baselines for the cluster. You can
move the hosts to another cluster, which uses baselines, but you cannot change the cluster that
already uses a single image.

Images and Solutions

When you enable a VMware product as a feature in a cluster that uses a vSphere Lifecycle
Manager image, the feature automatically uploads an offline bundle with components into the
vSphere Lifecycle Manager depot and adds its component to all hosts in the cluster. You cannot
control the lifecycle of solution components. For example, if you export the image, solution
components are not part of the exported image.

In vSphere 7.0, solutions that are integrated with vSphere Lifecycle Manager are vSphere HA and
vSAN. vSphere with Kubernetes, VMware NSX-T™ Data Center, and VMware NSX ® for vSphere
® are not yet integrated and do not work with vSphere Lifecycle Manager

VMware, Inc. 28
Managing Host and Cluster Lifecycle

What Is in an Image?
An image that you define with vSphere Lifecycle Manager has four composing elements. When
you set up and edit an image for a cluster, you select and combine those elements in such a way
as to define a precise desired image that is applicable to all hosts in the cluster.

An image might consist of four elements: an ESXi version, a vendor add-on, a firmware and
drivers add-on, and additional components. Spcifying an ESXi version is mandatory. Adding the
other elements to an image is optional.

ESXi Base Image

The base image is an ESXi release version that contains an image of VMware ESXi Server and
additional components such as drivers and adapters that are necessary to bring up a server.

Vendor Add-On

A vendor add-on is a collection of software components for the ESXi hosts that OEMs create
and distribute. This vendor add-on can contain drivers, patches, and solutions.

Firmware and Drivers Add-On

The firmware and drivers add-on is a special type of vendor add-on designed to assist in the
firmware update process. The firmware and drivers add-on contains firmware for a specific
server type and corresponding drivers. To add a firmware and drivers add-on to your image,
you must install the hardware support manager plug-in provided by the hardware vendor for
the hosts in the respective cluster.

Component

A component is the smallest discrete unit in an image. VMware and OEMs do not publish
components. VMware packages components into base images. OEMs package components
into vendor add-ons. However, third-party software vendors can create and publish
components, for example drivers or adapters, independently. You can add such independent
components to your image.

You can start using vSphere Lifecycle Manager images in two ways.

n When you create a new cluster, you set up a single image to manage all hosts in the cluster
collectively.

In that case, you only select an ESXi base image and, optionally, a vendor add-on. You can
add more elements to your image afterwards by editing the image.

n When you switch to using a single image for a cluster that already uses baselines.

In that case, during image set-up, you can immediately select and include any of the four
elements in the image.

VMware, Inc. 29
Managing Host and Cluster Lifecycle

Baselines and Images: What is the Difference?

You can use vSphere Lifecycle Manager baselines and images to manage the lifecycle of the ESXi
hosts in your environment. Those two management methods are different in their essence, the
way they work, and the features they support.

Baselines were already available in previous vSphere releases.

Images are a new concept in vSphere 7.0. Applying software updates by using vSphere Lifecycle
Manager images is a simple and straightforward process with a predictable result. Using images
allows you to enforce and maintain host homogeneity at cluster level.

Before you switch to using images, learn the differences between vSphere Lifecycle Manager
baselines and vSphere Lifecycle Manager images.

Baselines Images

Software packaging Bulletins. Components.

Consumable formats Online depot, offline bundle, ISO Online depot, offline depot, JSON files.
images.

Predictability of the remediation result Baselines list the updates to be Images define the precise image to be
applied to hosts, but image drift after applied to the hosts after remediation.
remediation is possible. No image drift is possible.

Software recommendations Limited support. Software Supported.

recommendations are only available Based on the hardware of the hosts in
for vSAN clusters in the form of the cluster, you get recommendations
recommendation baselines. about available and applicable ESXi
updates or upgrades.

Portability You can create a custom baseline and You can export an image and use it to
attach it to different objects in the manage other clusters in the same or
same vCenter Server instance. You in a different vCenter Server instance.
cannot export baselines and Images are portable across vCenter
distribute them across vCenter Server Server instances.
instances.

ROBO support Not provided. Provided.

Although no specific optimization With vSphere Lifecycle Manager
exists for Remote Office/Branch images, you can set up a local depot
Office (ROBO) deployments, you can and use it in ROBO environments.
still use baselines and baseline groups
with ROBO clusters.

REST APIs Not available. Available.

VMware, Inc. 30
vSphere Lifecycle Manager
Privileges 4
To configure vSphere Lifecycle Manager settings and to use successfully vSphere Lifecycle
Manager baselines and images, you must have the proper privileges.

You can assign vSphere Lifecycle Manager privileges to different roles from the vSphere
Lifecycle Manager client interface in the vSphere Client.

This chapter includes the following topics:

n vSphere Lifecycle Manager Privileges For Using Images

n vSphere Lifecycle Manager Privileges For Using Baslines

vSphere Lifecycle Manager Privileges For Using Images

When you use vSphere Lifecycle Manager images, you need a different set of privileges for each
task.

Table 4-1. VMware vSphere vSphere Lifecycle Manager Privileges For Using Images
Task Required Privileges

Set Up Image n VMware vSphere Lifecycle Manager.Lifecycle Manager:

Image Privileges.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Image Privileges.Write
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Settings Privileges.Read

Import Image n VMware vSphere Lifecycle Manager.Lifecycle Manager:

Image Privileges.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Image Privileges.Write
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Settings Privileges.Read
n Upload File.Upload File

Export Image VMware vSphere Lifecycle Manager.Lifecycle Manager: Image

Privileges.Read

VMware, Inc. 31
Managing Host and Cluster Lifecycle

Table 4-1. VMware vSphere vSphere Lifecycle Manager Privileges For Using Images (continued)
Task Required Privileges

Edit Image n VMware vSphere Lifecycle Manager.Lifecycle Manager:

Image Privileges.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Image Privileges.Write
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Settings Privileges.Read

Work with Recommendations n VMware vSphere Lifecycle Manager.Lifecycle Manager:

Image Privileges.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Image Privileges.Write
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Settings Privileges.Read

Work with Depot n VMware vSphere Lifecycle Manager.Lifecycle Manager:

Settings Privileges.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Settings Privileges.Write

Manage Depot Overrides n VMware vSphere Lifecycle Manager.Lifecycle Manager:

Settings Privileges.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Settings Privileges.Write

Check Compliance VMware vSphere Lifecycle Manager.Lifecycle Manager: Image

Privileges.Read

Run Remediation Pre-Check n VMware vSphere Lifecycle Manager.Lifecycle Manager:

General Privileges.Read
n VMware vSphere Lifecycle Manager.ESXi Health
Perspectives.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Image Remediation Privileges.Read

Remediate Against an Image n VMware vSphere Lifecycle Manager.Lifecycle Manager:

General Privileges.Read
n VMware vSphere Lifecycle Manager.ESXi Health
Perspectives.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Image Remediation Privileges.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Image Remediation Privileges.Write
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Settings Privileges.Read

Edit Remediation Settings n VMware vSphere Lifecycle Manager.Lifecycle Manager:

Settings Privileges.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Settings Privileges.Write

VMware, Inc. 32
Managing Host and Cluster Lifecycle

Table 4-1. VMware vSphere vSphere Lifecycle Manager Privileges For Using Images (continued)
Task Required Privileges

Update Firmware n VMware vSphere Lifecycle Manager.Lifecycle Manager:

Image Privileges.Read
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Image Privileges.Write
n VMware vSphere Lifecycle Manager.Lifecycle Manager:
Settings Privileges.Read

View Hardware Compatibility VMware vSphere Lifecycle Manager.Lifecycle Manager:

Hardware Compatibility Privileges.Access Hardware
Compatibility

For more information about managing users, groups, roles, and permissions, see the vSphere
Security documentation.

vSphere Lifecycle Manager Privileges For Using Baslines

Each of the vSphere Lifecycle Manager privileges that you need to use baselines and baseline
groups covers a distinct functionality.

Table 4-2. VMware vSphere Lifecycle Manager Privileges For Using Baslines
Task Privilege Description

Configure Configure.Configure Service Configure the vSphere Lifecycle Manager

service and the scheduled patch download
task.

Manage Baseline Manage Baselines.Attach Baseline Attach baselines and baseline groups to
objects in the vSphere inventory.

Manage Baselines.Manage Baselines Create, edit, or delete baselines and

baseline groups.

Manage Patches and Upgrades Manage Patches and Remediate virtual machines and hosts to
Upgrades.Remediate to Apply apply patches, extensions, or upgrades. In
Patches, Extensions, and Upgrades addition, this privilege allows you to view
the ompliance status of objects.

Manage Patches and Upgrades .Scan Scan virtual machines and hosts to search
for Applicable Patches, Extensions, for applicable patches, extensions, or
and Upgrades upgrades.

Manage Patches and Stage patches or extensions to hosts. In

Upgrades .Stage Patches and addition, this privilege allows you to view
Extensions the compliance status of hosts.

Manage Patches and Upgrades .View View baseline compliance information for an
Compliance Status object in the vSphere inventory.

Upload File Upload File.Upload File Upload upgrade images and offline patch
bundles.

For more information about managing users, groups, roles, and permissions, see the vSphere
Security documentation.

VMware, Inc. 33
Working with the vSphere
Lifecycle Manager Depot 5
The vSphere Lifecycle Manager depot is the source of software updates for vSphere Lifecycle
Manager. Conceptually, the vSphere Lifecycle Manager depot represents all software available
for consumption to vSphere Lifecycle Manager.

This book uses multiple terms related to the vSphere Lifecycle Manager depot.

Table 5-1. vSphere Lifecycle Manager Depot and Related Terminology

Term Definition

The vSphere Lifecycle Manager depot All software available to vSphere Lifecycle Manager. The
vSphere Lifecycle Manager depot is a local depot on the
vCenter Server machine. It contains all the content from the
online and offline depots that you use with vSphere
Lifecycle Manager.

Online and offline depots Formats for software distribution that software vendors
use. Online depots are accessible through a URL. Offline
depots are ZIP files that you download and import to the
vSphere Lifecycle Manager depot.

Download sources The vSphere Lifecycle Manager download sources are the
Internet or, in air-gap scenarios, a UMDS-created shared
repository. If you configure vSphere Lifecycle Manager to
use the Internet, then the download sources are practically
all online depots that you use for downloading software.

You can work with vSphere Lifecycle Manager images and baselines only if the vSphere Lifecycle
Manager depot contains software packages. For example, ESXi base images, vendor add-ons,
third-party components, and legacy patches and updates. For more information about ESXi base
images, vendor add-ons, components, and patches, see Chapter 2 Software Packages and
Distribution Formats in vSphere 7.0.

You control how the vSphere Lifecycle Manager depot gets populated with software. You can
configure vSphere Lifecycle Manager to download updates from online depots, or a UMDS-
created shared repository. Alternatively, you can use offline depots to import updates into the
vSphere Lifecycle Manager depot. For more information about the different types of depots that
vSphere Lifecycle Manager can use, see Types of Depots.

VMware, Inc. 34
Managing Host and Cluster Lifecycle

Synchronization is the process through which the contents of the online depots that you
configure vSphere Lifecycle Manager to use get into the vSphere Lifecycle Manager depot.
During synchronization, only the software metadata is downloaded. The actual payloads are
downloaded when they are needed.

Import is the operation through which the contents of an offline bundle get into the vSphere
Lifecycle Manager depot. During an import operation, both the software metadata and the actual
payloads are downloaded into the vSphere Lifecycle Manager depot.

By default, vSphere Lifecycle Manager is configured to use the official VMware online depot as a
download source for software updates. In vSphere 7.0, the official VMware online depot contains
ESXi images, OEM add-ons, drivers, and async VMware Tools releases. You can configure ESXi to
use additional online depots for components. You can also change the default download source
and use a UMDS-created shared repository.

All software updates hosted in the official VMware online depot are also available as offline
bundles, which you can download from my.vmware.com and import manually to the vSphere
Lifecycle Manager depot.

This chapter includes the following topics:

n Types of Depots

n Browsing the vSphere Lifecycle Manager Depot

n Import Updates to the vSphere Lifecycle Manager Depot

n Import an ISO Image to the vSphere Lifecycle Manager Depot

n Delete an ISO Image from the vSphere Lifecycle Manager Depot

n Synchronize the vSphere Lifecycle Manager Depot

n Configuring the vSphere Lifecycle Manager Download Sources

n Configure the vSphere Lifecycle Manager Automatic Download Task

n Configure the vSphere Lifecycle Manager Proxy Settings

Types of Depots
VMware, OEMs, and third-party software vendors distribute software by uploading it to online
depots or by providing you with downloadable offline bundles. The vSphere Lifecycle Manager
depot contains all software updates from the online and offline depots that you use with vSphere
Lifecycle Manager.

In air-gap scenarios, you can configure vSphere Lifecycle Manager to use a UMDS depot. With
Remote Office/Branch Office (ROBO) clusters, you can take advantage of vSphere Lifecycle
Manager depot overrides.

VMware, Inc. 35
Managing Host and Cluster Lifecycle

Online Depots
An online depot is a format for delivering software. You access the online depot through a URL.
vSphere Lifecycle Manager downloads the content from the online depots that you configure it
to use.

vSphere Lifecycle Manager is preconfigured to use the official VMware online depot.

Starting with vSphere 7.0, the official VMware online depot also hosts vendor add-ons and
VMware-certified device drivers. Unlike previous releases, all software that you need to install,
update, or customize the ESXi version of your hosts is available in the official VMware online
depot.

Earlier vSphere releases vSphere 7.0

Third-party Third-party
software software
provider Third-party online depot provider

VMware VMware
Official VMware depot Official VMware depot

OEM OEM
OEM online depot

Firmware updates are not hosted in the VMware depot. To perform firmware updates, you must
install the hardware support manager plug-in that your hardware vendor provides. The plug-in
gives you access to depots that contain the necessary firmware and related drivers updates.

In the vSphere Client, you can list additional online depots for vSphere Lifecycle Manager to
download additional third-party components from, for example CIM modules. However, working
with additional third-party depots and independent components is rarely necessary. In most
cases, the vendor add-ons that are available in the official VMware depot provide full OEM
customization for ESXi.

When you deploy vCenter Server, vSphere Lifecycle Manager synchronizes with the official
VMware online depot. During synchronization, vSphere Lifecycle Manager downloads the
updates metadata from the online depot and exposes it to you through the vSphere Client. After
the initial synchronization, you can schedule a download task to run at regular intervals or you
can initiate a download task manually.

VMware, Inc. 36
Managing Host and Cluster Lifecycle

When vSphere Lifecycle Manager synchronizes to online depots, it downloads only the metadata
of the updates. The actual payload is downloaded during staging or remediation.

UMDS Depot
In vCenter Server deployments without access to the Internet, instead of synchronizing to online
depots, you can configure vSphere Lifecycle Manager to download updates from an UMDS-
created shared repository. When you configure vSphere Lifecycle Manager to use a UMDS
repository, synchronization of the updates metadata is not triggered immediately. The metadata
is downloaded according to the configured download schedule or when you initiate the
download. When the default download source for vSphere Lifecycle Manager is a UMDS
repository, only the metadata is stored and displayed in the vSphere Client. The actual payload is
downloaded during staging or remediation.

Offline Depots
An offline depot, also called an offline bundle, is a format for delivering software. The offline
bundle is a ZIP file that you download from the Internet or copy from a media drive and you save
them on a local or a shared network drive. You then can import the offline bundle to the vSphere
Lifecycle Manager depot. You can download offline bundles from the VMware website or from
the websites of third-party vendors.

The import of offline bundles is supported only for hosts that are running ESXi 6.5 and later. For
information about importing offline bundles to the vSphere Lifecycle Manager local depot, see
Import Updates to the vSphere Lifecycle Manager Depot.

Note You can use offline bundles for host patching operations only. You cannot use OEM or
third-party offline bundles, or offline bundles that you generated from custom VIB sets for host
upgrade from ESXi 6.5 and ESXi 6.7 to ESXi 7.0.

In vSphere 7.0, OEMs provide a new type of a ZIP file - Add-on.zip, which you can also import to
the vSphere Lifecycle Manager depot and use with vSphere Lifecycle Manager images. For more
information about OEM add-ons, see ESXi Base Images and Vendor Add-Ons.

Depot Overrides
In ROBO scenarios, you can configure vSphere Lifecycle Manager to use a local depot with
updates for a particular cluster instead of the depots that all clusters in that vCenter Server
instance use by default.

For more information, see Manage Depot Overrides for a Cluster.

Browsing the vSphere Lifecycle Manager Depot

You can use the vSphere Client to view and browse the contents of the vSphere Lifecycle
Manager depot.

VMware, Inc. 37
Managing Host and Cluster Lifecycle

You can view the vSphere Lifecycle Manager depot in the vSphere Lifecycle Manager home view.
The contents of the vSphere Lifecycle Manager depot are displayed on three different tabs:
Image Depot, Updates, and Imported ISOs.

Image Depot
On the Image Depot tab, you can view all VMware base images, vendor add-ons, and
components that are available in the vSphere Lifecycle Manager depot.

You can use the ESXi Versions, Vendor Addons, and Component links at the top of the pane for
easier navigation through the lists.

The ESXi Versions list contains all base images available in the depot together with information
about the version, release date, and category for each image. When you select an image from
the list, an information panel appears on the right. The panel displays a list of all components that
the base image applies to a host upon remediation.

The Vendor Addons list contains all vendor addons available in the depot together with
information about the version, release date, and category for each addon. When you select an
add-on from the list, an information panel appears on the right. The panel displays information
about the components that the add-on applies to the host and the components that the add-on
removes from a host upon remediation.

The Component list contains all components that are available in the depot together with
information about the version, release date, and category for each component. When you select
a component from the list, an information panel appears on the right. The panel displays
information about the VIBs that the component contains.

You can filter the Component list so that it displays only independent components or all
components available in the vSphere Lifecycle Manager depot. Independent components are
components that are not part of a vendor add-on.

You use the ESXi images, vendor add-ons, and components visible on the Image Depot tab to
set up images that you can use to manage hosts in clusters collectively.

Updates
On the Updates tab, you can see all components available in the vSphere Lifecycle Manager
depot as bulletins. You can use the Filter by Baseline drop-down menu to view only the bulletins
that are part of a particular baseline.

When you select a bulletin from the list, additional information appears below the bulletins list. In
the bottom pane, you see information about the baselines that include the selected bulletin.

You use the bulletins visible on the Updates tab to create baselines and baseline groups.

Because in vSphere 7.0 the official VMware depot hosts certified partner content in addition to
VMware content, the Updates tab displays a broader set of OEM bulletins, for example vendor
add-ons and VMware-certified device drivers. Some of these bulletins might have dependencies
that must be pulled into the baselines that you create, so that the remediation against those

VMware, Inc. 38
Managing Host and Cluster Lifecycle

baselines is successful. As a best practice, always consult the KB article for an individual bulletin
to find information about its deployment specfics and reqired dependencies before including the
bulletin in your baselines. For more information about the official VMware depot and other types
of depots, see Types of Depots.

Starting with vSphere 7.0, some changes are also introduced in the way VMware content is
packaged. As a result, you might see additional bulletins on the Updates tab at patch and update
releases. Those bulletins are usually of the Enhancement or BugFix category. When you include
those bulletins in a baseline, you might need to also include a base ESXi bulletins in that baseline.
As a best practice, to ensure successful application of patches and updates, always include the
appropriate rollup bulletin into your baselines.

Imported ISOs
On the Imported ISOs tab, you can see the ISO images that you import and make available to
vSphere Lifecycle Manager.

You use the ISO images visible on the Imported ISOs tab to create upgrade baselines. You
cannot use an ISO image for clusters configured to use a single vSphere Lifecycle Manager
image.

Note ISO images are not distributed through any online or offline depot, they are a separate
software distribution format. As a result, they cannot become available in the vSphere Lifecycle
Manager depot through synchronization or the regular import operation that you perform to
import offline bundles (ZIP files) to the depot. To make an ISO image available to vSphere
Lifecycle Manager, you must trigger the Import ISO operation. For more information, see Import
an ISO Image to the vSphere Lifecycle Manager Depot

Import Updates to the vSphere Lifecycle Manager Depot

You can use an offline bundle in ZIP format and import updates to the vSphere Lifecycle Manager
depot manually. When you import offline bundles, you add both the update metadata and actual
payload to the vSphere Lifecycle Manager depot.

You use the import option to populate the vSphere Lifecycle Manager depot with updates from
an offline bundle.

If you want to use vSphere Lifecycle Manager baselines, you can import offline bundles that
contain patches and extensions for hosts that run ESXi 6.5 and later. In that case, you can use the
contents of the offline bundle only for host patching operations. If you import an OEM offline
bundle that contains an ESXi image of a version earlier than 7.0, you cannot use the image for
upgrade operations. To create upgrade baselines, you need an ISO image. For more information,
see Import an ISO Image to the vSphere Lifecycle Manager Depot.

If you want to use vSphere Lifecycle Manager images, you can import offline bundles that contain
software for hosts that run ESXi 7.0 and later. In that case, you can use the contents of the offline
bundle to set up vSphere Lifecycle Manager images, which you can use to upgrade ESXi hosts
collectively.

VMware, Inc. 39
Managing Host and Cluster Lifecycle

As in previous releases, offline bundles can contain patches and extensions. Starting with
vSphere 7.0, an offline bundle can also contain an ESXi base image, a vendor add-on, or third-
party software, for example, asynchronous drivers specific to the OEM hardware requirements.
For more information about base images, vendor add-ons, and components, see Chapter 2
Software Packages and Distribution Formats in vSphere 7.0.

Prerequisites

n Verify that the updates that you import are in ZIP format.

n Required privileges: VMware vSphere Lifecycle Manager.Upload File.Upload File.

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 Select Actions > Import Updates at the top of the vSphere Lifecycle Manager home view.

The Import Updates dialog box opens.

3 Enter a URL or browse to an offline bundle in ZIP format on your local machine.

If the upload fails, check whether the structure of the ZIP file is correct and whether the
vSphere Lifecycle Manager network settings are set up correctly.

4 Click Import.

The Import updates task appears in the Recent Tasks pane.

Results

You imported updates to the vSphere Lifecycle Manager depot.

You can view the imported patches and extension on the Updates tab in the vSphere Lifecycle
Manager home view.

You can view the imported ESXi images, vendor add-ons, and additional components on the
Image Depot tab in the vSphere Lifecycle Manager home view.

Import an ISO Image to the vSphere Lifecycle Manager

Depot
You import ESXi images in ISO format to the vSphere Lifecycle Manager local depot, so that you
can create upgrade baselines, which you use for host upgrade operations.

You can use ESXi .iso images to upgrade ESXi 6.5.x hosts and ESXi 6.7.x hosts to ESXi 7.0.

VMware, Inc. 40
Managing Host and Cluster Lifecycle

ISO images can only be used with vSphere Lifecycle Manager baselines. You cannot use an ISO
image to upgrade the hosts in a cluster that uses a single image.

To upgrade hosts, use the ESXi installer image distributed by VMware with the name format
VMware-VMvisor-Installer-7.0.0-build_number.x86_64.iso or a custom image created by
using vSphere ESXi Image Builder. You can also use ISO images created and distributed by OEMs.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Upload File

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Imported ISOs tab, click Import ISO

3 In the Import ISO dialog box, select an image.

n Click the Browse button to import an ESXi image from your local system.

n Enter an URL address to import an ESXi image that is not on your local system.
Local images are imported immediately, whereas importing images from a URL takes some
time.

4 Click Import.

Results

The ISO image that you uploaded appears in the list of images. You can view information about
the ESXi image, such as product, version, and build details, vendor, acceptance level, and
creation date.

What to do next

Create a host upgrade baseline.

Delete an ISO Image from the vSphere Lifecycle Manager

Depot
If you do not need an ESXi image, you can delete it from the vSphere Lifecycle Manager depot.

Unlike components and bulletins, which you cannot delete from the vSphere Lifecycle Manager
depot, the ISO images that you import in the depot can be deleted when you no longer need
them .

VMware, Inc. 41
Managing Host and Cluster Lifecycle

Prerequisites

n Verify that the ISO image that you want to delete is not part of any baseline. You cannot
delete images that are included in a baseline.

n Delete any baseline that contains the ISO image that you want to delete.

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Imported ISOs tab, select an image from the list and click Delete.

Note If you try to delete an ESXi image that is used in a baseline, the operation fails with an
error message.

3 Click Yes to confirm the deletion.

Results

The ISO image is deleted and no longer available.

Synchronize the vSphere Lifecycle Manager Depot

Instead of waiting for the predefined download task to run as scheduled, you can update your
local vSphere Lifecycle Manager depot immediately.

At regular configurable intervals, vSphere Lifecycle Manager downloads updates from the
configured download sources. The download sources can be online depots or a UMDS-created
shared repository.

Regardless of the download schedule, you can initiate synchronization between the vSphere
Lifecycle Manager depot and the configured download sources. Similar to scheduled
synchronization, when you initiate synchronization manually, vSphere Lifecycle Manager
downloads software from all online depots that you configured it to use. For more information
about configuring the vSphere Lifecycle Manager download sources, see Configuring the
vSphere Lifecycle Manager Download Sources.

During synchronization, vSphere Lifecycle Manager downloads only the update metadata, the
actual payloads are downloaded during staging or remediation.

VMware, Inc. 42
Managing Host and Cluster Lifecycle

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 Select Actions > Sync Updates at the top of the vSphere Lifecycle Manager home view.

The Sync updates task appears in the Recent Tasks pane.

Results

You downloaded updates to the vSphere Lifecycle Manager depot.

You can view the downloaded patches and extension on the Updates tab in the vSphere
Lifecycle Manager home view.

You can view the downloaded ESXi images, vendor add-ons, and components on the Image
Depot tab in the vSphere Lifecycle Manager home view.

Configuring the vSphere Lifecycle Manager Download

Sources
You can configure vSphere Lifecycle Manager to download software updates for ESXi hosts
either from the Internet or from a shared repository of UMDS data.

vSphere Lifecycle Manager downloads only the metadata and not the actual binary payload of
the updates. Downloading the metadata saves disk space and network bandwidth. The
availability of regularly updated metadata in the vSphere Lifecycle Manager depot lets you
perform compliance checks on hosts at any time.

Whatever the download source, vSphere Lifecycle Manager downloads the following types of
information:

n Metadata about all ESXi 6.x updates regardless of whether you have hosts of such versions in
your environment.

n Metadata about all ESXi 7.x updates regardless of whether you have hosts of such versions in
your environment.

n Patch recalls for ESXi 6.x hosts.

vSphere Lifecycle Manager supports the recall of patches for hosts that are running ESXi 6.5
or later. A patch is recalled when it has problems or potential issues. After you scan the hosts
in your environment, vSphere Lifecycle Manager alerts you if the recalled patch has been
installed on any host. Recalled patches cannot be installed on hosts with vSphere Lifecycle
Manager. vSphere Lifecycle Manager deletes all the recalled patches from the vSphere

VMware, Inc. 43
Managing Host and Cluster Lifecycle

Lifecycle Manager depot. After a patch that fixes the problem is released, vSphere Lifecycle
Manager downloads the new patch to its depot. If you have already installed the problematic
patch, vSphere Lifecycle Manager notifies you that a fix is available and prompts you to apply
the new patch.

Downloading host patches from the VMware website is a secure process.

n Patches are cryptographically signed with the VMware private keys. Before you try to install
a patch on a host, the host verifies the signature. This signature enforces the end-to-end
protection of the patch itself and can also address any concerns about downloading the
patch.

n vSphere Lifecycle Manager downloads the patch metadata and patch binaries over SSL
connections. vSphere Lifecycle Manager verifies both the validity of the SSL certificates and
the common name in the certificates. The common name in the certificates must match the
names of the servers from which vSphere Lifecycle Manager downloads the patches.
vSphere Lifecycle Manager downloads the patch metadata and binaries only after successful
verification of the SSL certificates.

Download Sources
If your deployment system is connected to the Internet, you can use the default settings and links
for downloading updates to the vSphere Lifecycle Manager depot. You can also add URL
addresses to download third-party software, for example drivers.

If your deployment system is not connected to the Internet, you can use a shared repository
after downloading the upgrades, patches, and extensions by using Update Manager Download
Service (UMDS).

For more information about UMDS, see Chapter 17 Installing, Setting Up, and Using Update
Manager Download Service.

The default configuration is for the vSphere Lifecycle Manager to download information directly
from the Internet. However, you can change the download source at any time. Changing the
download source from a shared repository to the Internet, and the reverse is a change in the
vSphere Lifecycle Manager configuration. The two options are mutually exclusive. You cannot
download updates from the Internet and a shared repository at the same time.

By default, vSphere Lifecycle Manager is configured to use the official VMware online depot as a
download source. When you deploy vCenter Server, synchronization to the official VMware
depot is triggered automatically. When you change the default download source,
synchronization to the new download source is not triggered automatically. The synchronization
task runs as per its schedule. To download new data, you must run the VMware vSphere
Update Manager Download task or trigger synchronization manually.

The VMware vSphere Update Manager Download task is a scheduled task that runs at regular
intervals. You can change the schedule, and you can also trigger the VMware vSphere
Update Manager Download task independently of its schedule.

VMware, Inc. 44
Managing Host and Cluster Lifecycle

If the VMware vSphere Update Manager Download task is running when you apply the new
configuration settings, the task continues to use the old settings until it finishes. The next time the
download task starts, vSphere Lifecycle Manager uses the new settings.

Configure vSphere Lifecycle Manager to Use a Shared Repository as

a Download Source
You can configure vSphere Lifecycle Manager to use a shared repository as a source for
downloading ESXi images, vendor add-ons, and additional components.

You cannot use folders on a network drive as a shared repository. vSphere Lifecycle Manager
does not download updates from folders on a network share in the Microsoft Windows Uniform
Naming Convention form (such as \\Computer_Name_or_Computer_IP\Shared), or on a mapped
network drive (for example, Z:\).

The downloading of updates takes place at configurable regular intervals. To initiate

downloading of updates regardless of the download schedule, see Synchronize the vSphere
Lifecycle Manager Depot .

Prerequisites

n Create a shared repository by using UMDS and host the repository on a Web server or a
local disk. For detailed information about exporting the upgrades, update binaries, and
update metadata in Export the Downloaded Data.

n Verify that UMDS is of version compatible with the version of vSphere Lifecycle Manager that
you are using. For more information about compatibility, see Compatibility Between UMDS
and vSphere Lifecycle Manager.

n Required privileges: VMware vSphere Lifecycle Manager.Configure.

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Settings tab, select Administration > Patch Setup.

3 Click the Change Download Source button.

The Change Download Source Type dialog box opens.

VMware, Inc. 45
Managing Host and Cluster Lifecycle

4 Select the Download patches from a UMDS shared repository option and enter a path or
URL address to the shared repository.

For example, C:\repository_path\, https://repository_path/ or http://

repository_path/.

In these examples, repository_path is the path to the folder with the exported downloaded
upgrades, patches, extensions, and notifications. In an environment where vSphere Lifecycle
Manager does not have direct access to the Internet, but is connected to a physical machine
that has access to the Internet, the folder can be on a Web server.

You can specify an HTTP or HTTPS address, or a location on the disk where vSphere
Lifecycle Manager runs. HTTPS addresses are supported without any authentication.

5 Click Save.

vCenter Server validates the URL. You can use the path to the shared repository only when
the validation is successful. If the validation fails, vSphere Lifecycle Manager reports a reason
for the failure.

Important If the updates in the folder that you specify are downloaded with a UMDS version
that is not compatible with the vCenter Server version that you use, the validation fails and
you receive an error message.

Results

The shared repository is used as the main source for downloading software updates.
Downloading from the repository is enabled by default.

Example: Using a Folder or a Web Server as a Shared Repository

You can use a folder or a Web server as a shared repository.

n When you use a folder as a shared repository, repository_path is the path to the top-level
directory that stores the patches and notifications exported from UMDS.

For example, use UMDS to export the patches and notifications to the F:\ drive, which is a
drive mapped to a plugged-in USB device on the physical machine where UMDS is installed.
Then, plug in the USB device to the physical machine where vSphere Lifecycle Manager runs.
The device is mapped as E:\ and the folder to configure as a shared repository for vSphere
Lifecycle Manager is E:\.

n When you use a Web server as a shared repository, repository_path is the path to the top-
level directory on the Web server that stores the patches exported from UMDS.

For example, export the patches and notifications from UMDS to C:\docroot\exportdata. If
the folder is configured on a Web server and is accessible from other physical machines at
the URL https://umds_host_name/exportdata, the URL to configure as a shared repository
in vSphere Lifecycle Manager is https://umds_host_name/exportdata.

VMware, Inc. 46
Managing Host and Cluster Lifecycle

Configure vSphere Lifecycle Manager to Use the Internet as a

Download Source
If your deployment system is connected to the Internet, you can configure vSphere Lifecycle
Manager to directly download ESXi images, vendor add-ons, and other components from the
configured online depots to the local vSphere Lifecycle Manager depot.

The Internet is the default download source for vSphere Lifecycle Manager. Downloading takes
place at configurable regular intervals. To initiate downloading of updates regardless of the
download schedule, see Synchronize the vSphere Lifecycle Manager Depot .

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Configure

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Settings tab, select Administration > Patch Setup.

3 Click the Change Download Source button.

The Change Download Source Type dialog box opens.

4 Select the Download patches directly from the Internet option and click Save.

Add a New Download Source

If you use the Internet as a download source for updates, you can add URL addresses to third-
party online depots. vSphere Lifecycle Manager downloads software updates from all the online
depots that you configured it to use. Update metadata are downloaded from the online depots
to the local vSphere Lifecycle Manager depot.

The default download source for vSphere Lifecycle Manager is the official VMware depot.

Starting with vSphere 7.0, the official VMware online depot also hosts vendor add-ons and
VMware-certified device drivers. Unlike previous releases, all software that you need to install,
update, or customize the ESXi version of your hosts is available in the official VMware online
depot.

Downloading updates takes place at configurable regular intervals. To initiate the downloading of
updates regardless of the download schedule, see Synchronize the vSphere Lifecycle Manager
Depot .

VMware, Inc. 47
Managing Host and Cluster Lifecycle

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Configure

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Settings tab, select Administration > Patch Setup.

3 In the Patches downloaded from the Internet pane, click New.

The New Download Source dialog box opens.

4 Enter a URL address to a new download source.

vSphere Lifecycle Manager supports both HTTP and HTTPS URL addresses. Use HTTPS URL
addresses to download data securely. The URL addresses that you add must be complete
and contain an index.xml file, which lists the vendor and the vendor index.

Note The proxy settings that vSphere Lifecycle Manager uses are also applicable to third-
party URL addresses.

5 (Optional) Enter a short description for the download source.

6 Click Save.

Results

The new location is added to the list of download sources and downloading from it is enabled by
default.

Modify a Download Source

You can enable, disable, edit, or delete a download source from the list of vSphere Lifecycle
Manager download sources.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Configure

VMware, Inc. 48
Managing Host and Cluster Lifecycle

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Settings tab, select Administration > Patch Setup.

3 In the Patches downloaded from the Internet pane, select a URL address from the list of
download sources and select your task.

n Click Edit to edit the source URL or the description for the selected download source.

n Click Enable or Disable to enable or disable downloading from the selected download
source.

n Click Delete to delete the selected download source.

Note You cannot edit or delete the default VMware download source for ESXi updates. You
can only enable or disable downloading update metadata from it.

Configure the vSphere Lifecycle Manager Automatic

Download Task
Downloading host updates and related metadata is a predefined automatic process that you can
modify. The automatic download task is enabled by default and starts immediately after you
deploy vCenter Server. After the initial download, the task runs according to its schedule.

The default schedule settings ensure frequent checks, but you can change the schedule if your
environment requires you to adjust the frequency of the checks.

If you need the latest software updates, you might want to reduce the time interval between the
checks for updates. By contrast, if you are not concerned about the latest updates, if you want
to reduce the network traffic, or if you cannot access the update servers, you might want to
increase the time interval between the checks for updates.

The automatic download of update metadata is enabled by default and the default task name is
VMware vSphere vSphere Lifecycle Manager Update Download. You can change the
configuration of the task.

Prerequisites

n Verify that the machine on which vSphere Lifecycle Manager runs has access to the Internet.

n Required privileges: VMware vSphere Lifecycle Manager.Configure.

VMware, Inc. 49
Managing Host and Cluster Lifecycle

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Settings tab, select Administration > Patch Downloads.

3 In the Automatic Download Settings pane, click the Edit button.

The Edit Settings for Automatic Patch Downloads dialog box opens.

4 Select the Download patches check box and configure the schedule and settings for the
download.

To receive notification emails after the download task finishes, you must configure mail
settings for the vSphere Client. For more information, see the vCenter Server and Host
Management documentation.

5 Click Save to save your changes and close the dialog box.

Results

The automatic download task runs according to the schedule you configured.

Run the VMware vSphere vSphere Lifecycle Manager Update

Download Task
If you change the download source, you must run the VMware vSphere vSphere Lifecycle
Manager Update Download task to download any new updates.

Procedure

1 In the vSphere Client, navigate to a vCenter Server instance.

2 On the Configure tab, select Scheduled Tasks.

3 In the Scheduled Tasks pane, select the VMware vSphere Lifecycle Manager Update
Download task and click Run.

Results

You can see the running task listed in the Recent Tasks pane.

Configure the vSphere Lifecycle Manager Proxy Settings

You can configure vSphere Lifecycle Manager to download updates from the Internet through a
proxy server.

VMware, Inc. 50
Managing Host and Cluster Lifecycle

Starting with vSphere 7.0, vSphere Lifecycle Manager uses the proxy settings of the vCenter
Server instance where it runs. Configuring proxy settings is only available for vCenter Server
deployments of earlier versions.

Prerequisites

n Verify that vCenter Server is of version 6.7 or earlier.

n Required privileges: VMware vSphere Lifecycle Manager.Configure.

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 Click the Settings tab.

3 In the Proxy Settings pane, click the Edit button.

Important The Edit option is not visible if you are using vSphere Lifecycle Manager 7.0.

The Edit Proxy Settings dialog box opens.

4 Select the Use proxy check box and enter the proxy server address and port.

5 If the proxy requires authentication, select the Proxy requires authentication check box and
provide a user name and password.

6 (Optional) Click Test Connection to verify that you can connect to the Internet through the
proxy.

7 Click Save.

Results

You configured vSphere Lifecycle Manager to use a proxy server to download updates metadata
from the Internet.

VMware, Inc. 51
Configuring the vSphere Lifecycle
Manager Remediation Settings 6
Whether you manage the ESXi hosts in your environment with baselines or with images, you can
configure the behavior of vSphere Lifecycle Manager during host update and upgrade
operations.

You can configure and modify the vSphere Lifecycle Manager settings only if you have the
privileges to configure the vSphere Lifecycle Manager settings and service. The permission must
be assigned to the vCenter Server where vSphere Lifecycle Manager runs. For more information
about managing users, groups, roles, and permissions, see the vSphere Security documentation.
For a list of the vSphere Lifecycle Manager privileges and their descriptions, see Chapter 4
vSphere Lifecycle Manager Privileges.

If your vCenter Server system is connected to other vCenter Server systems by a common
vCenter Single Sign-On domain, you can configure the settings for each vSphere Lifecycle
Manager instance. The configuration properties that you modify are applied only to the vSphere
Lifecycle Manager instance that you specify, and are not propagated to the other instances in
the domain.

You can change any of the vSphere Lifecycle Manager settings on the Settings tab in the
vSphere Lifecycle Manager home view.

Host Remediation Settings

You can use baselines or images to remediate individual hosts or all hosts in a cluster collectively.
Some remediation settings are applicable regardless of whether you use baselines or images to
initiate host remediation. For example, you can configure virtual machine migration settings,
maintenance mode settings, and quick boot for hosts that are managed by either cluster images
or baselines.

Other settings are applicable only to hosts that you manage by using baselines and baselines
groups. Such settings are allowing the installation of software on PXE booted hosts and the
removal of media devices before maintenance mode.

For information about how to configure host remediation settings, see Configure Remediation
Settings for vSphere Lifecycle Manager Baselines.

You can also configure certain cluster settings so as to ensure successful remediation.

VMware, Inc. 52
Managing Host and Cluster Lifecycle

For more information about the cluster settings that affect host remediation, see Cluster Settings
and Host Remediation.

Quick Boot
Quick Boot is a setting that you can use with both vSphere Lifecycle Manager images and
vSphere Lifecycle Manager baselines. Using Quick Boot optimizes the host patching and upgrade
operations. Quick Boot lets vSphere Lifecycle Manager reduce the remediation time for hosts
that undergo patch and upgrade operations. Patch and upgrade operations do not affect the
hardware of a host. If the Quick Boot feature is enabled, vSphere Lifecycle Manager skips the
hardware reboot (the BIOS or UEFI firmware reboot). As a result, the time an ESXi host spends in
maintenance mode is reduced and the risk of failures during remediation is minimized.

Quick Boot is supported on a limited set of hardware platforms and drivers. Quick Boot is not
supported on ESXi hosts that use TPM or passthrough devices. For more information about a
host's compatibility with the Quick Boot setting, see the following KB article: https://
kb.vmware.com/s/article/52477.

This chapter includes the following topics:

n Cluster Settings and Host Remediation

n Configure Remediation Settings for vSphere Lifecycle Manager Images

n Configure Remediation Settings for vSphere Lifecycle Manager Baselines

Cluster Settings and Host Remediation

When you remediate ESXi hosts that are in a cluster, certain cluster settings might cause
remediation failure. You must configure the cluster settings in such a way as to ensure successful
remediation.

When you update the ESXi hosts in a cluster that has vSphere Distributed Resource Scheduler
(DRS), vSphere High Availability (HA), and vSphere Fault Tolerance (FT) enabled, you can
temporarily disable vSphere Distributed Power Management (DPM), HA admission control, and
FT for the entire cluster. When the update finishes, vSphere Lifecycle Manager restarts these
features.

DRS
Updates might require a host to enter maintenance mode during remediation. Virtual machines
cannot run when a host is in maintenance mode. To ensure availability, you can enable DRS for
the cluster and you can configure it for vSphere vMotion. In this case, before the host is put in
maintenance mode, vCenter Server migrates the virtual machines to another ESXi host within the
cluster.

VMware, Inc. 53
Managing Host and Cluster Lifecycle

To help ensure vSphere vMotion compatibility between the hosts in the cluster, you can enable
Enhanced vMotion Compatibility (EVC). EVC ensures that all hosts in the cluster present the same
CPU feature set to virtual machines, even if the actual CPUs on the hosts differ. EVC prevents
migration failures due to incompatible CPUs. You can enable EVC only in a cluster where the host
CPUs meet the compatibility requirements. For more information about EVC and the
requirements that the hosts in an EVC cluster must meet, see the vCenter Server and Host
Management documentation.

DPM
If a host has no running virtual machines, DPM might put the host in standby mode, which might
interrupt a vSphere Lifecycle Manager operation. So, to make sure that all vSphere Lifecycle
Manager operations finish successfully, you can configure vSphere Lifecycle Manager to disable
DPM during these operations. For successful remediation, you must have vSphere Lifecycle
Manager disable DPM. After the remediation task finishes, vSphere Lifecycle Manager restores
DPM.

If DPM has already put a host in standby mode, vSphere Lifecycle Manager powers on the host
before compliance checks and remediation. Additionally, for clusters that you manage with
baselines, vSphere Lifecycle Manager powers on the host before staging, too. After the
respective task finishes, vSphere Lifecycle Manager turns on DPM and HA admission control and
lets DPM put the host into standby mode, if needed. vSphere Lifecycle Manager does not
remediate powered off hosts.

If a host is put in standby mode and DPM is manually disabled for a reason, vSphere Lifecycle
Manager does not remediate or power on the host.

HA Admission Control
Within a cluster, you must disable HA admission control temporarily to let vSphere vMotion
proceed. This action prevents downtime for the machines on the hosts that you remediate. You
can configure vSphere Lifecycle Manager to disable HA admission control during remediation.
After the remediation of the entire cluster is complete, vSphere Lifecycle Manager restores the
HA admission control settings. vSphere Lifecycle Manager disables HA admission control before
remediation, but not before compliance checks. Additionally, for clusters that you manage with
baselines, vSphere Lifecycle Manager disables HA admission control before staging.

Fault Tolerance
If FT is turned on for any of the virtual machines on a host within a cluster, you must temporarily
turn off FT before performing any vSphere Lifecycle Manager operation on the cluster. If FT is
turned on for any of the virtual machines on a host, vSphere Lifecycle Manager does not
remediate that host. You must remediate all hosts in a cluster with the same updates, so that FT
can be reenabled after remediation. A primary virtual machine and a secondary virtual machine
cannot reside on hosts of different ESXi versions and patch levels.

VMware, Inc. 54
Managing Host and Cluster Lifecycle

Configure Remediation Settings for vSphere Lifecycle

Manager Images
You can configure how ESXi hosts and VMs behave before and during the remedition of a cluster
that you managed with a single image.

When you edit images remediation settings, you set the global remediation setting for all clusters
that you manage with images. However, you can override the global remedation settings and use
specific remediation settings for a cluster. For more information, see Edit the Remediation
Settings for a Cluster.

Hosts that are in a vSAN cluster can enter maintenance mode only one at a time. This behavior is
a peculiarity of the vSAN cluster. For more information about the vSphere Lifecycle Manager
behavior during the remediation of hosts in a vSAN cluster, see Remediation Specifics of vSAN
Clusters .

Prerequisites

Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For Using
Images.

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Settings tab, select Host Remediation > Images.

3 Click the Edit button.

The Edit Cluster Settings dialog box opens.

4 Configure the images remediation settings and click Save.

Option Description

Quick Boot Quick Boot reduces the host reboot time during remediation. Before you
enable Quick Boot, you must make sure that the ESXi host is compatible
with the feature.

VM power state The VM power stateoption lets you control the behavior of the virtual
machines that run on the ESXi host. You can configure vSphere Lifecycle
Manager to power off or suspend all running virtual machines before host
remediation. Alternatively, you can choose not to change the power state of
the virtual machines.

VMware, Inc. 55
Managing Host and Cluster Lifecycle

Option Description

VM migration You can configure vSphere Lifecycle Manager to migrate the suspended
and powered off virtual machines from the hosts that must enter
maintenance mode to other hosts in the cluster.

Maintenance mode failures You can configure how vSphere Lifecycle Manager behaves if a host fails to
enter maintenance mode before remediation. You can configure vSphere
Lifecycle Manager to wait for a specified retry delay period and to retry to
put the host into maintenance mode as many times as you indicate in the
Number of retries text box.

HA admission control Admission control is a policy that vSphere HA uses to ensure failover
capacity within a cluster. If vSphere HA admission control is enabled during
remediation, vMotion might be unable to migrate the virtual machines within
the cluster.
Disabling admission control allows a virtual machine to be powered on even
if it causes insufficient failover capacity. When this happens, no warnings are
presented, and the cluster does not turn red. If a cluster has insufficient
failover capacity, vSphere HA can still perform failovers, and uses the VM
Restart Priority setting to determine which virtual machines to power on
first.
You can configure vSphere Lifecycle Manager to disable HA admission
control. In that case, vSphere Lifecycle Manager remediates the cluster and
re-enables HA admission control after remediation is complete.
If you do not disable HA admission control, vSphere Lifecycle Manager skips
the clusters on which HA admission control is enabled.

DPM VMware Distributed Power Management (DPM) monitors the resources

consumed by the running virtual machines in the cluster. If sufficient excess
capacity exists, VMware DPM recommends moving virtual machines to other
hosts in the cluster and placing the original host into standby mode to
conserve power. If the capacity is insufficient, VMware DPM might
recommend returning standby hosts to a powered-on state.
If you select to disable DPM on the cluster, vSphere Lifecycle Manager
remediates the hosts in the cluster and re-enables DPM after remediation is
complete. If you choose not to disable DPM, vSphere Lifecycle Manager
skips the clusters on which VMware DPM is enabled.

Results

These settings become the default failure response settings with vSphere Lifecycle Manager
images. You can specify different settings when you configure individual remediation tasks.

Configure Remediation Settings for vSphere Lifecycle

Manager Baselines
You can configure how vSphere Lifecycle Manager behaves before and during remediation
against a baseline or a baseline group. The remediation settings help ensure that vSphere
Lifecycle Manager puts ESXi hosts in maintenance mode before remediation.

vSphere Lifecycle Manager might behave differently during remediation against an image and
against a baseline.

VMware, Inc. 56
Managing Host and Cluster Lifecycle

You cannot use vMotion to migrate virtual machines that run on individual hosts. If vCenter Server
cannot migrate the virtual machines to another host, you can configure how vSphere Lifecycle
Manager responds. You can also configure how vSphere Lifecycle Manager responds when a
host fails to enter maintenance mode.

Hosts that are in a vSAN cluster can enter maintenance mode only one at a time. This behavior is
a peculiarity of the vSAN cluster. For more information about the vSphere Lifecycle Manager
behavior during the remediation of hosts in a vSAN cluster, see Chapter 14 vSAN Clusters and
vSphere Lifecycle Manager.

When you use vSphere Lifecycle Manager baselines, you can configure vSphere Lifecycle
Manager to let other software initiate the remediation of PXE booted ESXi hosts. The remediation
installs software modules on the hosts, but typically those host updates are lost after a reboot.
To retain updates on stateless hosts after a reboot, use a PXE boot image that contains the
updates. You can update the PXE boot image before applying the updates with vSphere
Lifecycle Manager, so that the updates are not lost because of a reboot. vSphere Lifecycle
Manager itself does not reboot the hosts, because it does not install updates requiring a reboot
on PXE booted ESXi hosts.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Configure

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Settings tab, select Host Remediation > Baselines.

3 Click the Edit button.

The Edit Settings for Host Remediation dialog box opens.

4 Configure the baselines remediation settings and click Save.

Option Description

VM power State You can determine the behavior of the virtual machines that run on the host.
You can configure vSphere Lifecycle Manager to power off or suspend all
running virtual machines before host remediation. Alternatively, you can
choose not to change the power state of the virtual machines.

Maintenance mode failures If a host fails to enter maintenance mode before remediation, vSphere
Lifecycle Manager waits for the specified retry delay period and retries
putting the host into maintenance mode as many times as you indicate in
the Number of retries text box.

VMware, Inc. 57
Managing Host and Cluster Lifecycle

Option Description

PXE booted hosts You can allow the installation of software for solutions on the PXE booted
ESXi hosts in the vSphere inventory that you manage withvSphere Lifecycle
Manager baselines.

VM migration vSphere Lifecycle Manager migrates the suspended and powered off virtual
machines from the hosts that must enter maintenance mode to other hosts
in the cluster.

Removable media devices vSphere Lifecycle Manager does not remediate hosts on which virtual
machines have connected CD/DVD or floppy drives. All removable media
drives that are connected to the virtual machines on a host might prevent
the host from entering maintenance mode and interrupt remediation. So,
you can disconnect all removable media devices to ensure that the
respective host enters maintenance mode successfully. After remediation,
vSphere Lifecycle Manager reconnects the removable media devices if they
are still available.

Quick Boot Quick Boot reduces the host reboot time during remediation. Before you
enable Quick Boot, you must make sure that the ESXi host is compatible
with the feature. For more information, see Quick Boot.

Results

These settings become the default failure response settings with vSphere Lifecycle Manager
baselines. You can specify different settings when you configure individual remediation tasks.

VMware, Inc. 58
Cluster Operations and vSphere
Lifecycle Manager 7
Whether you manage the hosts and clusters in your environment with vSphere Lifecycle
Manager baselines or vSphere Lifecycle Manager images has an impact on the basic cluster
operations.

All cluster-related operations are described in full detail in the vCenter Server and Host
Management documentation.

For detailed information about all requirements and limitations that are related to usingvSphere
Lifecycle Manager, see vSphere Lifecycle Manager Requirements and Specifics.

For information about using Auto Deploy to deploy and provision ESXi hosts, see VMware ESXi
Installation and Setup.

Creating a Cluster
When you create a new cluster, you can specify an image to be applied to all hosts in the cluster.
If you do not specify an image during the creation of the cluster, you must use baselines for host
patching and upgrade operations. You can switch from using baselines to using images at a later
time. For more information about switching from baselines to images, see Chapter 10 Switching
from Baselines to Images.

Before you create a cluster that uses a single image or switch to using images, verify that the
cluster meets all requirements for using images. See vSphere Lifecycle Manager Requirements
and Specifics.

Extending a Cluster
You can extend a cluster by adding hosts to the cluster.

You can add hosts of any version to a cluster that you manage with baselines.

You can add hosts to a cluster that you manage with a single image only if the hosts are of
version 7.0 and meet all other requirements. See vSphere Lifecycle Manager Requirements and
Specifics.

The image that the cluster uses is applied to the newly added host upon remediation.

VMware, Inc. 59
Managing Host and Cluster Lifecycle

Removing Hosts from a Cluster

Removing a host from a cluster is a straightforward procedure. If you remove a host from a
cluster that uses a single image, the host retains the software and firmware installed during the
last remediation against the image for the cluster.

VMware, Inc. 60
Using Baselines and Baseline
Groups 8
vSphere Lifecycle Manager baselines and baselines groups were already available in previous
vSphere releases. You use baselines and baseline groups for host patching and upgrade
operations.

Using baselines and baseline groups to manage the updates and upgrades of ESXi hosts is a
multi-stage process.

1 You populate the vSphere Lifecycle Manager repository with patches, extensions, and
updates.

The vSphere Lifecycle Manager repository contains software updates that you can use with
both vSphere Lifecycle Manager baselines and vSphere Lifecycle Manager images. On the

Updates tab of the vSphere Lifecycle Manager home view, you see all software updates
available in the vSphere Lifecycle Manager depot as bulletins.

Updates get into the vSphere Lifecycle Manager local depot through synchronization with
configurable download sources. By default, vSphere Lifecycle Manager is configured to
synchronize updates from the official VMware depot.

You can also import updates into the depot manually.

For host upgrade operations through baselines, you use ESXi ISO images, which you must
also import to the vSphere Lifecycle Manager depot manually.

For more information about working with the vSphere Lifecycle Manager depot, see Chapter
5 Working with the vSphere Lifecycle Manager Depot.

2 You create baselines by combining bulletins from the depot and using manually uploaded
ESXi ISO images.

You can also combine several non-conflicting baselines to create a baseline group. Baseline
groups can contain different types of baselines. If a baseline group contains both upgrade
and patch or extension baselines, the upgrade runs first.

For more information about creating baselines and baseline groups, see Creating and
Working with Baselines and Baseline Groups.

3 You attach the baselines to individual ESXi hosts or container objects for ESXi hosts.

For more information, see Attach Baselines and Baseline Groups to Objects.

VMware, Inc. 61
Managing Host and Cluster Lifecycle

4 You check the compliance of ESXi hosts against a selected baseline or baseline group.

You can run a compliance check on an individual ESXi host or a container object.

For more information about compliance checks against baselines and baseline groups, see
Checking Compliance Against vSphere Lifecycle Manager Baselines and Baseline Groups.

5 You review the compliance status of the scanned object.

For more information about compliance states, see Viewing Compliance Information About
ESXi Hosts and Updates.

6 You stage the patches and extensions to ESXi hosts before remediation. Staging is not a
mandatory step, it is a step that you can skip.

For more information about staging updates before remediation, see Staging Patches and
Extensions to ESXi Hosts.

7 You remediate the non-compliant objects. After remediation, you can review the compliance
status again to make sure that the updates are installed.

For more information about remediating objects against baselines and baseline groups, see
Remediating ESXi Hosts Against vSphere Lifecycle Manager Baselines and Baseline Groups .

This chapter includes the following topics:

n Creating and Working with Baselines and Baseline Groups

n Attaching Baselines and Baseline Groups to vSphere Objects

n Checking Compliance Against vSphere Lifecycle Manager Baselines and Baseline Groups

n Staging Patches and Extensions to ESXi Hosts

n Remediating ESXi Hosts Against vSphere Lifecycle Manager Baselines and Baseline Groups

Creating and Working with Baselines and Baseline Groups

You use baselines and baseline groups to update the ESXi hosts in your vSphere inventory. The
vSphere Lifecycle Manager baselines are three types: predefined baselines, recommendation
baselines, or custom baselines, which you create. Depending on their content, baselines can be
patch, extension, or upgrade baselines.

When you initiate a compliance check for an ESXi host, you evaluate it against baselines and
baseline groups to determine its level of compliance to those baselines or baseline groups.

If your vCenter Server system is connected to other vCenter Server systems by a common
vCenter Single Sign-On domain, the baselines and baseline groups that you create and manage
are applicable only to the inventory objects managed by the vCenter Server system where the
selected vSphere Lifecycle Manager instance runs.

In the vSphere Client, the baselines and baseline groups are displayed on the Baselines tab of the
vSphere Lifecycle Manager home view.

VMware, Inc. 62
Managing Host and Cluster Lifecycle

Predefined, Recommendation, and Custom Baselines

Predefined baselines

Predefined baselines cannot be edited or deleted, you can only attach or detach them to
inventory objects.

On the Baselines tab in the vSphere Lifecycle Manager home view, you can see the following
predefined baselines.

n Host Security Patches

The Host Security Patches baseline checks ESXi hosts for compliance with all security
patches.

n Critical Host Patches

The Critical Host Patches baseline checks ESXi hosts for compliance with all critical
patches.

n Non-Critical Host Patches

The Non-Critical Host Patches baseline checks ESXi hosts for compliance with all optional
patches.

The Host Security Patches, and Critical Host Patches predefined baselines are attached by
default to the vCenter Server instance where vSphere Lifecycle Manager runs.

Recommendation Baselines

Recommendation baselines are predefined baselines that vSAN generates.

You use recommendation baselines to update your vSAN clusters with recommended critical
patches, drivers, updates, or the latest supported ESXi host version for vSAN.

These baselines appear by default when you use vSAN clusters with ESXi hosts of version 6.0
Update 2 and later in your vSphere inventory. If your vSphere environment does not contain
any vSAN clusters, no recommendation baselines are created.

Recommendation baselines update their content periodically, which requires vSphere

Lifecycle Manager to have constant access to the Internet. The vSAN recommendation
baselines are typically refreshed every 24 hours.

Recommendation baselines cannot be edited or deleted. You do not attach recommendation

baselines to inventory objects in your vSphere environment. You can create a baseline group
by combining multiple recommendation baselines, but you cannot add any other type of
baseline to that group. Similarly, you cannot add a recommendation baseline to a baseline
group that contains upgrade, patch, and extension baselines.

Custom Baselines

VMware, Inc. 63
Managing Host and Cluster Lifecycle

Custom baselines are the baselines that you create. You can create custom patch, extension,
and upgrade baselines to meet the needs of your specific deployment.

Baseline Groups
You create a baseline group by assembling existing and non-conflicting baselines. A baseline
group might contain one upgrade baseline and one or more patch and extension baselines, or it
might contain a combination of multiple patch and extension baselines. Baseline groups allow you
to scan and remediate objects against multiple baselines at the same time.

To create, edit, or delete baselines and baseline groups, you must have the Manage Baseline
privilege. To attach baselines and baseline groups to target inventory objects, you must have the
Attach Baseline privilege. The privileges must be assigned on the vCenter Server system where
vSphere Lifecycle Manager runs.

For more information about managing users, groups, roles, and permissions, see the vSphere
Security vSphere Security documentation.

For a list of all vSphere Lifecycle Manager privileges and their descriptions, see vSphere Lifecycle
Manager Privileges For Using Baslines.

Creating Baselines in vSphere 7.0

Because in vSphere 7.0 the official VMware online depot hosts certified partner content in
addition to VMware content, a broader set of OEM bulletins are available in the vSphere Lifecycle
Manager depot. As a result, in the Create Baseline and Edit Baseline wizards, you also see a
broader set of OEM bulletins. Some of these bulletins might have dependencies that must be
pulled into the baselines that you create, so that the remediation against those baselines is
successful. As a best practice, always consult the KB article for an individual bulletin before you
include it in a baseline. The KB article contains information about the bulletin deployment
specifics and required dependencies.

Starting with vSphere 7.0, some changes are also introduced in the way VMware content is
packaged. As a result, at patch and update releases, you might see additional bulletins on the
patch selection page of the Create Baseline and Edit Baseline wizards. Those bulletins are
usually of the Enhancement or BugFix category. When you include those bulletins in a baseline,
you might need to also include a base ESXi bulletins in that baseline. As a best practice, to ensure
successful application of VMware patches and updates, always include the appropriate rollup
bulletin into your baselines.

Baseline Types
Depending on their content, vSphere Lifecycle Manager baselines can be upgrade, patch, and
extension baselines. You use those types of baselines to check the compliance state of target
inventory objects and to remediate the non-compliant objects.

VMware, Inc. 64
Managing Host and Cluster Lifecycle

Upgrade Baselines
Host upgrade baselines define the version to which you upgrade the hosts in your environment.
With vSphere Lifecycle Manager 7.0, you can upgrade ESXi hosts from version 6.5 and 6.7 to
ESXi 7.0. Host upgrades to ESXi 5.x, ESXi 6.5, or ESXi 6.7 are not supported.

To create an upgrade baseline, you must first import an ESXi ISO image to the vCenter Server
inventory.

Patch Baselines
Patch baselines define a number of patches that must be applied to a given host. Patch baselines
can be either dynamic or fixed.

Baseline Description

Dynamic Patch You specify the criteria for patch inclusion in the baseline. Only the patches that meet the criteria
Baseline are included in the baseline. As the set of available patches in the vSphere Lifecycle Manager depot
changes, dynamic baselines are updated as well. You can manually include or exclude patches from
the baseline.

Fixed Patch You manually select the patches from the total set of patches available in the vSphere Lifecycle
Baseline Manager depot.

Extension Baselines
Extensions baselines contain additional software modules for ESXi hosts, for example device
drivers. This additional software might be VMware software or third-party software. You can
install additional modules by using extension baselines, and update the installed modules by
using patch baselines.

Extensions are installed on the hosts that do not yet have such software, and patched on the
hosts that already have the software installed. All third-party software for ESXi hosts is classified
as host extension, although extensions are not restricted to just third-party software.

Create a Fixed Patch Baseline

A fixed baseline is a set of patches that does not change as patch availability in the depot
changes.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

VMware, Inc. 65
Managing Host and Cluster Lifecycle

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Baselines tab, select New > Baseline.

The Create Baseline wizard opens.

3 On the Name and Description page, enter information about the baseline and click Next.

a Enter a name and, optionally, a description for the baseline.

b Select the Upgrade, Patch, or Extension radio button.

4 On the Select Patches Automatically page, disable the automatic updates by deselecting the
respective check box and click Next.

5 On the Select Patches Manually page, select the patches that you want to include in the
baseline and click Next.

You can use the filter icon next to each column header to filter the patches that are available
in the vSphere Lifecycle Manager depot and find specific patches to include in the baseline. If
you use several criteria to filter the patches, the relationship between those filter criteria is
defined by the Boolean operator AND.

6 On the Summary page, review your selections and click Finish.

Results

The new baseline appears in the baselines list on the Baselines tab.You can attach the baseline
to a data center, a cluster, or a host.

Create a Dynamic Patch Baseline

A dynamic baseline is a set of patches that meet certain criteria. The content of a dynamic
baseline changes as the available patches change. You can manually exclude or add specific
patches to the baseline.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

VMware, Inc. 66
Managing Host and Cluster Lifecycle

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Baselines tab, select New > Baseline.

The Create Baseline wizard appears.

3 On the Name and Description page, enter information about the baseline and click Next.

a Enter a name and, optionally, a description for the baseline.

b Select the Upgrade, Patch, or Extension radio button.

4 On the Select Patches Automatically page, set the criteria for adding patches to the
baseline.

a Enable the automatic update of the baseline by selecting the respective check box.

b On the Criteria tab, specify the criteria that a patch must meet to be added to the
baseline and click Next.

Option Description

Patch Vendor Specifies which patch vendor to use.

Note In vSphere 7.0, the vendor name of VMware for inbox components
has changed from VMware, Inc to VMware. As a result, if you use the
filter to see only components by VMware, the filtered list contains both
VMware, Inc for 6.x patches and VMware for 7.0 patches.

Product Restricts the set of patches to the selected products or operating

systems.
The asterisk at the end of a product name is a wildcard character for any
version number.

Severity Specifies the severity of patches to include.

Category Specifies the category of patches to include.

Release Date Specifies the range for the release dates of the patches.

The relationship between these fields is defined by the Boolean operator AND.
For example, when you select a product and severity option, the patches are restricted to
the ones that are applicable for the selected product and are of the specified severity
level.

VMware, Inc. 67
Managing Host and Cluster Lifecycle

c (Optional) On the Matched tab, deselect patches from the ones that matched your
criteria to exclude them permanently from the baseline.

d (Optional) On the Excluded and Selected tabs, view the patches that are are excluded
from the baseline and the ones that are included in the baseline.
You can use the filter icon next to each column header on the Matched, Excluded, and
Selected tabs to filter the patches that are available in the vSphere Lifecycle Manager depot.
This way, you can easily find specific patches to exclude from or include in the baseline. If you
use several criteria to filter the patches, the relationship between those filter criteria is
defined by the Boolean operator AND.

5 On the Select Patches Manually page, select individual patches to include in the baseline and
click Next.

The patches that are displayed on this page are patches that do not meet the criteria you set
on the Select Patches Automatically page. You can use the filter icon next to each column
header to filter the patches that are available in the vSphere Lifecycle Manager depot and
find specific patches to include in the baseline. If you use several criteria to filter the patches,
the relationship between those filter criteria is defined by the Boolean operator AND.

The patches that you add manually to the dynamic baseline stay in the baseline regardless of
the automatically downloaded patches.

6 On the Summary page, review your selections and click Finish.

Results

The new baseline appears in the baselines list on the Baselines tab.You can attach the baseline
to a data center, a cluster, or a host.

Create a Host Extension Baseline

Extension baselines contain additional software for ESXi hosts. This additional software might be
VMware software or third-party software.

Extensions deliver additional host features, updated drivers for hardware, Common Information
Model (CIM) providers for managing third-party modules on the host, improvements to the
performance or usability of the existing host features, and so on.

The host extension baselines that you create are always fixed. You must carefully select the
appropriate extensions for the ESXi hosts in your environment.

You use extension baselines to install extensions on the ESXi hosts in your environment. After an
extension is installed on a host, you can update the extension module through either patch, or
extension baselines.

Note When you use extension baselines, you must be aware of the functional implications that
the installation of new modules on the host might have. Extension modules might alter the
behavior of ESXihosts. During the installation of extensions, vSphere Lifecycle Manager only
performs the checks and verifications expressed at the package level.

VMware, Inc. 68
Managing Host and Cluster Lifecycle

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Baselines tab, select New > Baseline.

The Create Baseline wizard appears.

3 On the Name and Description page, enter information about the baseline and click Next.

a Enter a name and, optionally, a description for the baseline.

b Select the Extension radio button.

4 On the Select Extensions page, select individual extensions to include in the baseline and
click Next.

You can use the filter icon next to each column header to filter the extensions that are
available in the vSphere Lifecycle Manager depot and find specific extensions to include in
the baseline. If you use several criteria to filter the patches, the relationship between those
filter criteria is defined by the Boolean operator AND.

5 On the Select Extensions page, select individual extensions to include in the baseline and
click Next.

6 On the Summary page, review your selections and click Finish.

Results

The new baseline appears in the baselines list on the Baselines tab.You can attach the baseline
to a data center, a cluster, or a host.

Create a Host Upgrade Baseline

You can create upgrade baselines for ESXi hosts with ESXi 7.0 images, which you must first
import to the vSphere Lifecycle Manager depot.

You can use ESXi .iso images to upgrade ESXi 6.5.x hosts and ESXi 6.7.x hosts to ESXi 7.0.

VMware, Inc. 69
Managing Host and Cluster Lifecycle

To upgrade hosts, use the ESXi installer image distributed by VMware with the name format
VMware-VMvisor-Installer-7.0.0-build_number.x86_64.iso or a custom image created by
using vSphere ESXi Image Builder. You can also use ISO images created and distributed by OEMs.

Note In case of an unsuccessful upgrade from ESXi 6.5 or ESXi 6.7 to ESXi 7.0, you cannot roll
back to your previous ESXi 6.5 or ESXi 6.7 instance.

Prerequisites

n Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines.

n Verify that you have an ESXi 7.0 image available in inventory. For more information, see
Import an ISO Image to the vSphere Lifecycle Manager Depot.

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 Start the Create Baseline wizard.

n On the Imported ISOs tab, select an ESXi image from the list and click New Baseline.

n On the Baselines tab, select New > Baseline.

3 On the Name and Description page, enter information about the baseline and click Next.

a Enter a name and, optionally, a description for the baseline.

b Select the Upgrade radio button.

4 On the Select ISO page, select an ESXi image from the list and click Next.

5 On the Summary page, review your selections and click Finish.

Results

The new baseline appears in the baselines list on the Baselines tab.You can attach the baseline
to a data center, a cluster, or a host.

Create a Host Baseline Group

You can combine multiple baselines of different types into a baseline group. For example, you
can combine one host upgrade baseline with multiple patch or extension baselines, or you can
combine multiple patch and extension baselines.

A baseline group might contain a single host upgrade baseline and multiple patch or extension
baselines, or a combination of host patch and host extension baselines.

VMware, Inc. 70
Managing Host and Cluster Lifecycle

You can create a baseline group and add baselines to it later.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Baselines tab, select New > Baseline Group.

The Create Baseline Group wizard opens.

3 On the Name and Description page, enter a unique name and, optionally, a description for
the baseline group, and click Next.

4 (Optional) On the Upgrade Baseline page, select an upgrade baseline to include in the
baseline group and click Next .

a Select the Add the following Upgrade Baseline to the Group check box.

b Select an upgrade baseline from the list.

5 (Optional) On the Patch Baselines page, select patch baselines to include in the baseline
group and click Next.

6 (Optional) On the Extension Baselines page, select extension baselines to include in the
baseline group and click Next.

7 On the Summary page, review your selections and click Finish.

Results

The new host baseline group appears in the baselines list on the Baselines tab. You can attach
the baseline group to a data center, a cluster, or a host.

Edit a Patch Baseline

You can edit existing patch baselines.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

VMware, Inc. 71
Managing Host and Cluster Lifecycle

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Baselines tab, select a patch baseline from the list and click Edit.

The Edit Baseline wizard appears.

3 (Optional) On the Name and Description page, edit the name and, optionally, the description
of the baseline.

4 (Optional) On the Select Patches Automatically page, change the criteria for a patch
selection and click Next.

5 (Optional) On the Select Patches Manually page, change the selected patches and click Next.

You can deselect patches, or select new ones to include in the patch baseline.

6 On the Summary page, review your selections and click Finish.

What to do next

Attach the baseline to a data center, a cluster, or a host.

Edit a Host Extension Baseline

You can change the name, description, and composition of an existing extension baseline.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Baselines tab, select an extension baseline from the list and click Edit.

The Edit Baseline wizard appears.

3 (Optional) On the Name and Description page, edit the name and, optionally, the description
of the baseline.

VMware, Inc. 72
Managing Host and Cluster Lifecycle

4 (Optional) On the Select Extensions page, change the included extensions and click Next.

5 On the Summary page, review your selections and click Finish.

What to do next

Attach the baseline to a data center, a cluster, or a host.

Edit a Host Upgrade Baseline

You can change the name of an existing upgrade baseline. You can also select a different ESXi
image for the baseline.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Baselines tab, select an upgrade baseline from the list and click Edit.

The Edit Baseline wizard appears.

3 (Optional) On the Name and Description page, edit the name and, optionally, the description
of the baseline.

4 (Optional) On the Select ISO page, change the included ESXi image and click Next.

5 On the Summary page, review your selections and click Finish.

Edit a Baseline Group

You can change the name and type of an existing baseline group. You also use the Edit Baseline
Group wizard to add or remove baselines to an existing baseline group.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

VMware, Inc. 73
Managing Host and Cluster Lifecycle

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Baselines tab, select a baseline group from the list and click Edit.

The Edit Baseline Group wizard opens.

3 (Optional) On the Name and Description page, edit the name, description, or the ESXi version
for the baseline group.

4 (Optional) On the Upgrade Baseline page, select an upgrade baseline and select your task,
and click Next.

n To add the selected upgrade baseline to the baseline group, select the Add the following
Upgrade Baseline to the Group check box.

n To remove the selected upgrade baseline from the baseline group, deselect the Add the
following Upgrade Baseline to the Group check box.

5 (Optional) On the Patch Baselines page, specify which patch baselines are included in the
baseline group and click Next.

n To add patch baselines to the baseline group, select the respective patch baselines.

n To remove patch baselines from the baseline group, deselect the respective patch
baselines.

6 (Optional) On the Extension Baselines page, specify which extension baselines are included
in the baseline group and click Next.

n To add extension baselines to the baseline group, select the respective extension
baselines.

n To remove extension baselines from the baseline group, deselect the respective
extension baselines.

7 On the Summary page, review your selections and click Finish.

What to do next

Attach the baseline group to a data center, a cluster, or a host.

Add or Remove a Single Update from a Custom Baseline

You can edit the content of a custom baseline by adding or removing individual patches or
extension from the baseline.

VMware, Inc. 74
Managing Host and Cluster Lifecycle

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 Click the Updates tab.

You see a list of all updates in the vSphere Lifecycle Manager depot.

3 Select a patch or extension from the list, and click Add/Remove Baselines.

The Add/Remove baselines dialog box opens.

4 Select your task.

n To add the patch to a baseline, select that baseline in the Custom Patch Baselines list.

n To remove the patch from a baseline, deselect that baseline in the Custom Patch
Baselines list.

5 Click OK.

Duplicate Baselines and Baseline Groups

You can duplicate baselines and baseline groups and edit the copies without the risk of
compromising the original baseline.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Baselines tab, select a baseline or a baseline group from the list and click Duplicate.

The Duplicate Baseline dialog box opens.

VMware, Inc. 75
Managing Host and Cluster Lifecycle

3 Enter a name for the new baseline or baseline group or use the suggested one.

4 Click Duplicate to confirm the creation of a duplicate copy of the selected baseline or
baseline group.

Results

The duplicated baseline or baseline group appears in the Baselines list on the Baselines tab.

Delete Baselines and Baseline Groups

You can delete the baselines and baseline groups that you no longer need. Deleting a baseline
detaches it from all the objects to which it is attached. You cannot delete predefined and system-
managed baselines.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Baselines tab, select a baseline or a baseline group from the list and click Delete.

The Delete Baseline dialog box opens.

3 Click Yes to confirm the deletion of the selected baseline or baseline group.

Attaching Baselines and Baseline Groups to vSphere

Objects
To update ESXi hosts by using vSphere Lifecycle Manager baselines and baseline groups, you
must first attach the baselines and baseline groups to individual hosts, clusters, or container
objects.

When you no longer need baselines or baseline groups, you can detach them from the objects.

Attach Baselines and Baseline Groups to Objects

To check the compliance status of the objects in your inventory against selected baselines and
baseline groups, you must first attach the respective baselines and baseline groups to the
objects.

VMware, Inc. 76
Managing Host and Cluster Lifecycle

You attach baselines and baseline groups to individual hosts or objects that contain hosts, such
as clusters, data centers, and vCenter Server instances. In the vSphere infrastructure hierarchy,
the baseline and baseline groups that you attach to container objects are also attached to the
child objects. For example, if you attach a baseline or baseline group to a folder, the baseline or
the baseline groups is inherited by all the objects in the folder, including subfolders.

You cannot use vSphere Lifecycle Manager to update the hosts in a cluster that uses a single
vSphere Lifecycle Manager image. For more information about using vSphere Lifecycle Manager
images to manage hosts in clusters collectively, see Chapter 9 Using Images .

Prerequisites

n If you want to attach a baseline or a baseline group to a cluster, verify that the cluster is not
configured to use a single image.

n Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines.Attach Baseline.

Procedure

1 In the vSphere Client, navigate to the vSphere Lifecycle Manager compliance view for an
individual host or a container object.

a Navigate to a host, cluster, or a container object.

b Click the Updates tab.

2 Select Hosts > Baselines.

3 In the Attached Baselines pane, click Attach > Attach Baseline or Baseline Group.

The Attach dialog box opens.

4 Select one or more baselines or baseline groups and click Attach.

If you select a baseline group, all the baselines in it are attached to the object.

The selected baselines or baseline groups are attached to the object. They appear on the list
in the Attached Baselines pane. If the selected object is a container object, the selected
baselines or baseline groups are attached to all the child objects.

What to do next

Scan the selected object against the attached baselines.

Detach Baselines and Baseline Groups from Objects

You can detach baselines and baseline groups from the objects to which the baselines or
baseline groups are directly attached.

vSphere inventory objects might have inherited properties, so instead of detaching baselines and
baseline groups directly from an object, you might need to select its container object and detach
the baselines or baseline groups from the container object. For example, if you want to detach a
baseline or a baseline group from a host that is a part of a cluster, you must select the cluster
and not the host.

VMware, Inc. 77
Managing Host and Cluster Lifecycle

Prerequisites

n Verify that the cluster is not configured to manage all its hosts collectively.

n Required privileges: VMware vSphere Lifecycle Manager.Manage Baselines.Attach Baseline.

Procedure

1 In the vSphere Client, navigate to the vSphere Lifecycle Manager compliance view for an
individual host or a container object.

a Navigate to a host, cluster, or a container object.

b Click the Updates tab.

2 Select Hosts > Baselines.

3 In the Attached Baselines pane, select one or more baselines or baseline groups and click
Detach.

The Detach dialog box opens.

4 Select the object to detach the baseline or baseline group from and click Detach.

The baseline is removed from the Attached Baselines list.

Checking Compliance Against vSphere Lifecycle Manager

Baselines and Baseline Groups
Before you update or upgrade an ESXi host or a container object with vSphere Lifecycle
Manager baselines, you must first check its compliance status.

You use vSphere Lifecycle Manager to check the compliance status of ESXi hosts against the
baselines and baseline groups that you attach to the hosts or to a parent container object. You
do a compliance check on hosts to determine whether they have the latest patches or
extensions. During the compliance check, attributes of the host are evaluated against all patches,
extensions, and upgrades from an attached baseline or baseline group.

You can check the compliance status of a single ESXi host or a valid container object. Supported
groups of ESXi hosts include virtual infrastructure container objects such as folders, clusters, and
data centers. When you initiate a compliance check for a container object, vSphere Lifecycle
Manager scans all the ESXi hosts in that container object.

Note If you initiate a compliance check for an inventory object, for example data center, that
contains clusters that use vSphere Lifecycle Manager images, the compliance check is not
performed for those clusters. Operations

To generate compliance information, you can initiate compliance checks manually or you can
schedule the compliance checks to run at regular periods. Schedule compliance checks at a data
center or vCenter Server system level to make sure that the objects in your inventory are up-to-
date.

VMware, Inc. 78
Managing Host and Cluster Lifecycle

You check the compliance status of vSphere objects from the vSphere Lifecycle
Manager compliance view.

To initiate or schedule compliance checks, you must have the Scan for Applicable Patches,
Extensions, and Upgrades privilege.

For more information about managing users, groups, roles, and permissions, see the vSphere
Security documentation.

For a list of all vSphere Lifecycle Manager privileges and their descriptions, see vSphere Lifecycle
Manager Privileges For Using Baslines.

Initiate a Compliance Check for ESXi Hosts Manually

Before remediation, you must check the compliance of the vSphere objects against the attached
baselines and baseline groups. To check the compliance status of hosts in the vSphere inventory
immediately, initiate a compliance check manually.

Prerequisites

If you want to check the compliance status of a cluster, verify that the cluster is not configured to
use a single image.

Procedure

1 In the vSphere Client, navigate to the vSphere Lifecycle Manager compliance view for an
individual host or a container object.

a Navigate to a host, cluster, or a container object.

b Click the Updates tab.

2 Select Hosts > Baselines.

The Baselines pane shows three panels. In those panels, you obtain host information about
the selected object, host compliance information, and remediation information.

3 In the compliance information panel, click Check Compliance.

Results

The selected inventory object and all child objects are scanned against all attached patch,
extension, and upgrade baselines. The larger the virtual infrastructure and the higher up in the
object hierarchy that you initiate the scan, the longer the scan takes.

Schedule Regular Compliance Checks for ESXi Hosts

You can configure vSphere Lifecycle Manager to check the compliance status of ESXi hosts at
specific times or at intervals that are convenient for you.

Prerequisites

If you want to check the compliance status of a cluster, verify that the cluster is not configured to
use a single image.

VMware, Inc. 79
Managing Host and Cluster Lifecycle

Procedure

1 In the vSphere Client, navigate to the vSphere Lifecycle Manager compliance view for an
individual host or a container object.

a Navigate to a host, cluster, or a container object.

b Click the Updates tab.

2 Select Hosts > Baselines.

The Baselines pane shows three panels. In those panels, you obtain host information about
the selected object, host compliance information, and remediation information.

3 In the compliance information panel, click Schedule.

The Automatic compliance check dialog box opens.

4 Configure the compliance check schedule.

a Set the frequency and the starting point of the compliance check.

b Enter a unique name, and optionally, a description for the scan task.

c (Optional) Specify one or more email addresses to receive notification after the scan task
is complete.

You must configure mail settings for the vCenter Server system to enable this option.

5 Click Save to exit the Automatic compliance check dialog box.

Host Upgrade Compliance Messages

When you check the compliance of ESXi hosts against an upgrade baseline, vSphere Lifecycle
Manager runs a precheck script and provides informative messages in the in the bottom pane of
the vSphere Lifecycle Manager compliance view. The messages notify you about potential
problems with hardware or third-party software on the host, and configuration issues, which
might prevent a successful upgrade to ESXi 7.0.

The messages that vSphere Lifecycle Manager provides correspond to error or warning codes
from running the host upgrade precheck script.

For interactive installations and upgrades performed by using the ESXi installer, the errors or
warnings from the precheck script are displayed on the final panel of the installer, where you are
asked to confirm or cancel the installation or upgrade. For scripted installations and upgrades,
the errors or warnings are written to the installation log.

vSphere Lifecycle Manager displays scan result information in the bottom pane of the vSphere
Lifecycle Manager compliance view. To see the original errors and warnings returned by the
precheck script during an vSphere Lifecycle Manager host upgrade scan operation, review the
vSphere Lifecycle Manager log file.

VMware, Inc. 80
Managing Host and Cluster Lifecycle

Table 8-1. Scan Result Messages and Corresponding Error and Warning Codes
Scan Result Message invSphere Lifecycle Manager Description

Host CPU is unsupported. New ESXi version requires This message appears if the host processor is 32-bit and
a 64-bit CPU with support for LAHF/SAHF does not support required features.
instructions in long mode. The corresponding error code is 64BIT_LONGMODESTATUS.

Trusted boot is enabled on the host but the upgrade This message indicates that the host upgrade scan did not
does not contain the software package esx-tboot. locate the esx-tboot VIB on the upgrade ISO.
Upgrading the host will remove the trusted boot The corresponding error code is TBOOT_REQUIRED
feature.

VMkernel and Service Console network interfaces are Warning. An IPv4 address was found on an enabled
sharing the same subnet subnet_name. This Service Console virtual NIC for which there is no
configuration is not supported after upgrade. Only corresponding address in the same subnet in the vmkernel.
one interface should connect to subnet subnet_name. A separate warning appears for each such occurrence.
The corresponding error code is COS_NETWORKING.

New ESXi version requires a minimum of core_count The host must have at least two cores.
processor cores. The corresponding error code is CPU_CORES.

Processor does not support hardware virtualization Host performance might be impaired if the host processor
or it is disabled in BIOS. Virtual machine does not support hardware virtualization or if hardware
performance may be slow. virtualization is not turned on in the host BIOS. Enable
hardware virtualization in the host machine boot options.
See your hardware vendor's documentation.
The corresponding error code is
HARDWARE_VIRTUALIZATION.

Insufficient memory, minimum size_in_MB required The host requires the specified amount of memory to
for upgrade. upgrade.
The corresponding error code is MEMORY_SIZE.

Host upgrade validity checks for file_name are not This test checks whether the precheck script itself can be
successful. run.
The corresponding error code is PRECHECK_INITIALIZE.

The host partition layout is not suitable for Upgrade is possible only if there is at most one VMFS
upgrade. partition on the disk that is being upgraded and the VMFS
partition starts after sector 1843200.
The corresponding error code is PARTITION_LAYOUT.

Unsupported configuration. The file /etc/vmware/esx.conf must exist on the host.

This message indicates that the file /etc/vmware/esx.conf
is either missing, or the file data cannot be retrieved or
read correctly.
The corresponding error code is SANE_ESX_CONF.

The host does not have sufficient free space on a The host disk must have enough free space to store the
local VMFS datastore to back up current host ESXi 5.x configuration between reboots.
configuration. A minimum of size_in_MB is required. The corresponding error code is SPACE_AVAIL_CONFIG.

The upgrade is not supported for current host Upgrading to ESXi 7.0 is possible only from ESXi 6.5 and
version. ESXi 6.7 hosts.
The corresponding error code is SUPPORTED_ESX_VERSION.

VMware, Inc. 81
Managing Host and Cluster Lifecycle

Table 8-1. Scan Result Messages and Corresponding Error and Warning Codes (continued)
Scan Result Message invSphere Lifecycle Manager Description

Unsupported devices device_name found on the host. The script checks for unsupported devices. Some PCI
devices are not supported with ESXi 7.0.
The corresponding error code is UNSUPPORTED_DEVICES.

Host software configuration requires a reboot. To ensure a good bootbank for the upgrade, you must
Reboot the host and try upgrade again. reboot the hosts before remediation.
The corresponding error code is UPDATE_PENDING.

In an environment with Cisco Nexus 1000V Distributed If Cisco's Virtual Ethernet Module (VEM) software is found
Virtual Switch, vSphere Lifecycle Manager displays on the host, the precheck script checks if the software is
different messages in different situations. For details, see part of the upgrade as well, and that the VEM supports the
Host Upgrade Compliance Messages When Cisco Nexus same version of the Virtual Supervisor Module (VSM) as the
1000V Is Present. existing version on the host. If the software is missing or is
compatible with a different version of the VSM, the script
returns a warning and the scan result indicates the version
of the VEM software that was expected on the upgrade
ISO, and the version, if any, that was found on the ISO.
The corresponding error code is
DISTRIBUTED_VIRTUAL_SWITCH.

The host uses an EMC PowerPath multipathing module The script checks for installation of EMC PowerPath
file_name to access storage. The host will not be software, consisting of a CIM module and a kernel module.
able to access such storage after upgrade. If either of these components is found on the host, the
script verifies that matching components (CIM, VMkernel
module) also exist in the upgrade. If they do not, the script
returns a warning that indicates which PowerPath
components were expected on the upgrade ISO and which,
if any, were found.
The corresponding error code is POWERPATH.

Host Upgrade Compliance Messages When Cisco Nexus 1000V Is

Present
When a host is managed by the Cisco Nexus 1000V virtual switch and you check the compliance
of the host against an upgrade baseline, the scan messages provide information about problems
with compliance between the VEM modules installed on the host and the modules available on
the ESXi 7.0 image.

vSphere Lifecycle Manager supports Cisco Nexus 1000V, a virtual access software switch that
works with VMware vSphere and consists of two components.

Virtual Supervisor Module (VSM)

The control plane of the switch and a virtual machine that runs NX-OS.

Virtual Ethernet Module (VEM)

A virtual line card embedded in ESXi hosts.

VMware, Inc. 82
Managing Host and Cluster Lifecycle

vSphere Lifecycle Manager determines whether a host is managed by Cisco Nexus 1000V.
vSphere Lifecycle Manager verifies whether the Cisco Nexus 1000V VEM VIBs in the ESXi
upgrade image are compatible with the Cisco Nexus 1000V VSM that manages the host.

By using vSphere ESXi Image Builder, you can create custom ESXi images, which contain third-
party VIBs that are required for a successful remediation operation.

Table 8-2. Compliance Check Results for the Cisco Nexus 1000V Network Switch
Compliance Check Message Description

The upgrade does not contain any Cisco Nexus 1000V A VEM VIB is not available on the ESXi 7.0 upgrade image.
software package that is compatible with the Cisco
Nexus 1000V software package on the host. Upgrading
the host will remove the feature from the host.

The host is currently added to a Cisco Nexus 1000V The VEM VIB on the ESXi 7.0 upgrade image is not
virtual network switch. The upgrade contains a compatible with the version of the VSM.
Cisco Nexus 1000V software package VIB_name that is
incompatible with the Cisco Nexus 1000V VSM.
Upgrading the host will remove the feature from the
host.

The host is currently added to a Cisco Nexus 1000V The host and the image do not contain VEM VIBs, but the
virtual network switch. The upgrade does not host is still listed in vCenter Server as managed by Cisco
contain any Cisco Nexus 1000V software package that Nexus 1000V.
is compatible with the Cisco Nexus 1000V VSM.
Upgrading the host will remove the feature from the
host.

Cannot determine whether the upgrade breaks Cisco There was a problem with determining compatibility
Nexus 1000V virtual network switch feature on the between the VEM VIB on the ESXi 7.0 upgrade image and
host. If the host does not have the feature, you the VSM. Check whether the version of the VSM managing
can ignore this warning. the host is certified as being compatible with vCenter
Server 7.0 and ESXi 7.0.

Viewing Compliance Information About ESXi Hosts and Updates

vSphere Lifecycle Manager scans objects to determine how they comply with the baselines and
baseline groups that you attach to those objects. You can view compliance information about a
single ESXi host or a group of hosts in a container object.

Supported groups of ESXi hosts include virtual infrastructure container objects such as folders,
clusters, and data centers.

The host or the container object must have an attached baseline or baseline group to be
examined for compliance information. Compliance with baselines and baseline groups is assessed
at the time of viewing.

The overall compliance status of an ESXi hosts depends on the compliance statuses of all
baselines and baseline groups that are attached to the object. For information about the different
compliance statuses that an object, a baseline or a baseline group might have, see Compliance
Statuses of ESXi Hosts, Baselines, and Baseline Groups .

VMware, Inc. 83
Managing Host and Cluster Lifecycle

The compliance status of a baseline depends on the compliance statuses of all updates in the
baseline. For information about the compliance statuses that updates might have, see
Compliance Statuses of Updates.

The ability to view the compliance status of vSphere objects depends on the privileges that you
have. To view the compliance status of an inventory object, you must have the View Compliance
Status privilege. Users that have privileges to remediate against patches, extensions, and
upgrades and to stage patches and extensions on a particular inventory object, can view the
compliance status of the same object even if they do not have the View Compliance Status
privilege.

n Users with the privilege to view a container, but not all the contents of the container, can
view the aggregate compliance status of all objects in the container.

n If a user does not have the permission to view an object, its contents, or a particular virtual
machine, the results of those scans are not displayed.

For more information about managing users, groups, roles, and permissions, see the vSphere
Security documentation.

For a list of all vSphere Lifecycle Manager privileges and their descriptions, see vSphere Lifecycle
Manager Privileges For Using Baslines.

For information about checking the compliance of hosts against an image, see Check Cluster
Compliance Against an Image.

The vSphere Lifecycle Manager Compliance View

Compliance information about inventory objects is displayed on the Updates tab for the object,
in the so-called vSphere Lifecycle Manager compliance view.

The vSphere Lifecycle Manager compliance view for objects that you manage with baselines and
baseline groups consists of three panes.

VMware, Inc. 84
Managing Host and Cluster Lifecycle

Table 8-3. vSphere Lifecycle Manager Compliance View

Pane Description

Baselines The Baselines pane has three information panels.

n Host Information panel

For individual ESXi hosts, this panel shows information about the ESXi
version installed on the host. You can also view all updates that are
installed on the host.

For container objects, this panel shows information about the ESXi
versions of all hosts in the container object.
n Compliance Information panel

For individual ESXi hosts, this panel shows the overall compliance status
of the host against all attached baselines and baseline groups. You can
also view compliance information about the baselines and baseline
groups attached to the host.

For container objects, this panel shows the overall number of compliant
and non-compliant hosts.

This panel also shows the last time a compliance check was completed.
n Remediation Information panel

This panel shows the result of the remediation pre-check and indicates
whether the selected object is ready for remediation. The panel also
contains information about the issues that require user attention or
action.

This panel also shows the last time a remediation pre-check was
completed.
The information in the Baselines pane changes dynamically depending on
the inventory object, baselines, and baseline groups that you select.

Attached Baselines and Baseline Groups Displays the baselines and baseline groups attached to the selected object.

Bottom pane The bottom pane appears when you select a baseline or a baseline group
from the Attached Baselines and Baseline Groups pane. The information in
this pane depends on the type of inventory object that you select.
For individual hosts, the bottom pane shows information about all updates in
the baseline or baseline group that you select from the Attached Baselines
and Baseline Groups pane.
n If you select a patch baseline or extension baseline, the bottom pane
shows a list of all updates that the selected baseline contains.
n If you select an upgrade baseline, the bottom pane shows information
about the ESXi image that the upgrade baseline contains.
n If you select a baseline group, the bottom pane shows all baselines
included in the group along with their compliance statuses. You can also
view all the updates that the baseline group contains. If the baseline
group contains an ESXi image, information about it is also displayed in
the bottom pane.

VMware, Inc. 85
Managing Host and Cluster Lifecycle

Table 8-3. vSphere Lifecycle Manager Compliance View (continued)

Pane Description

For container objects, the bottom pane displays compliance information

about the ESXi hosts that have the selected baseline or baseline group.
When you select a baseline or a baseline group from the Attached Baselines
and Baseline Groups pane, the bottom pane appears and displays all the
hosts to which the selected baseline or baseline group is attached along with
the individual compliance statuses of those hosts.

Compliance Statuses of Updates

When you work with vSphere Lifecycle Manager baselines, an update stands for all patches,
extensions, and upgrades that you can apply with vSphere Lifecycle Manager baselines. The
compliance status of the updates in the baselines and baseline groups that you attach to objects
in your inventory is calculated after you check the compliance of the target object.

The compliance statuses of the updates in a baseline define the overall compliance status of that
baseline. For more information about baseline compliance statuses, see Compliance Statuses of
ESXi Hosts, Baselines, and Baseline Groups .

Conflict

The update conflicts with either an existing update on the host or another update in the
vSphere Lifecycle Manager depot. vSphere Lifecycle Manager reports the type of conflict. A
conflict does not indicate any problem on the target object. It just means that the current
baseline selection is in conflict. You can perform compliance checks, remediation, and staging
operations. In most cases, you must resolve the conflict.

Conflicting New Module

The host update is a new module that provides software for the first time, but it is in conflict
with either an existing update on the host or another update in the vSphere Lifecycle
Manager depot. vSphere Lifecycle Manager reports the type of conflict. A conflict does not
indicate any problem on the target object. It just means that the current baseline selection is
in conflict. You can perform scan, remediation, and staging operations. In most cases, you
must resolve the conflict.

Incompatible Hardware
The hardware of the selected object is incompatible or has insufficient resources to support
the update. For example, when you perform a host upgrade scan against a 32-bit host or if a
host has insufficient RAM.

Installed

The update is installed on the target object and no further user action is required.

Missing

The update is applicable to the target object, but it is not yet installed. You must perform a
remediation on the target object with this update, so that the update becomes compliant.

VMware, Inc. 86
Managing Host and Cluster Lifecycle

Missing Package

The metadata for the update is in the depot, but the corresponding binary payload is missing.
The reasons can be that the product might not have an update for a given locale; the
vSphere Lifecycle Manager depot is corrupt, and vSphere Lifecycle Manager no longer has
Internet access to download updates; or you have manually deleted an upgrade package
from the vSphere Lifecycle Manager depot.

New Module

The update is a new module. An update with this compliance status cannot be installed when
it is part of a host patch baseline. When it is part of a host extension baseline, the new
module status indicates that the module is missing on the host and can be provisioned by
remediation. The compliance status of the baseline depends on the type of baseline
containing the update with the New Module status. If the baseline is a host patch baseline, the
overall status of the baseline is compliant. If the baseline is a host extension baseline, the
overall status of the baseline is non-compliant.

Not Applicable

The update is not applicable to the target object. A patch might have the not applicable
compliance status for one of the following reasons:

n There are other patches in the vSphere Lifecycle Manager depot that obsolete this patch.

n The update does not apply to the target object.

Not Installable

The update cannot be installed. The compliance check might succeed, but the remediation of
the target object cannot be performed.

Obsoleted By Host

This compliance status is mainly applicable to patches. The target object has a newer version
of the patch. For example, if a patch has multiple versions, after you apply the latest version
to the host, the earlier versions of the patch have the Obsoleted By Host compliance status.

Staged

This compliance status applies to host patches and host extensions. It indicates that the
update is copied from the vSphere Lifecycle Manager depot to the host, but it is not yet
installed. Staged compliance status might occur only when you check the compliance status
of hosts running ESXi 6.5 and later.

Unknown

A patch is in the unknown state for a target object until vSphere Lifecycle Manager
successfully scans the object. A scan might not succeed if the target object is of an

VMware, Inc. 87
Managing Host and Cluster Lifecycle

unsupported version, if vSphere Lifecycle Manager lacks metadata, or if the patch metadata
is corrupt.

Unsupported Upgrade

The upgrade path is not supported. For example, the current hardware version of the virtual
machine is later than the latest version supported by the host.

Compliance Statuses of ESXi Hosts, Baselines, and Baseline Groups

Compliance statuses are computed after you initiate a compliance check for an inventory object
against the attached baselines or baseline groups. The compliance statuses that baselines and
baseline groups might have depend on the applicability of the patches, extensions, and upgrades
contained in the baseline or baseline group attached to an object. The compliance status of a
single host depends on the compliance statuses of all baselines and baseline groups attached to
the host.

Compliant
The compliant status indicates that a vSphere object is compliant with all baselines in an attached
baseline group or with all patches, extensions, and upgrades in an attached baseline. The
compliant state requires no further action. If a baseline contains patches or upgrades that are not
relevant to the target object, the individual updates, and baselines or baseline groups that
contain them, are treated as not applicable, and represented as compliant. Compliant are also
hosts with attached patch baselines containing extensions or patches with the obsoleted by host
status.

The compliant status occurs under the following conditions:

n Target objects are compliant with the baselines and baseline groups when all updates in the
baseline or baseline group are either installed on the target object, obsoleted by host, or are
not applicable to the target object.

n The updates in a baseline are compliant when they are installed on the target object, or are
not applicable to the object.

Non-Compliant
The non-compliant status indicates that one or more baselines in a baseline group, or one or
more patches, extensions, or upgrades in a baseline are applicable to the target object, but are
not installed (missing) on the target. You must remediate the target object to make it compliant.

When a baseline contains a non-compliant update, the overall status of the baseline is non-
compliant. When a baseline group contains a non-compliant baseline, the overall status of the
baseline group is non-compliant. The non-compliant status takes precedence over the
incompatible, unknown, and compliant states.

VMware, Inc. 88
Managing Host and Cluster Lifecycle

Unknown
When you attach a baseline or a baseline group to a vSphere object and you do not initiate a
compliance check for the object, the status of the vSphere object against the baseline or baseline
group is unknown. This status indicates that a compliance check is required, that the compliance
check has failed, or that you initiated a compliance check on an unsupported platform.

When a baseline contains updates in the compliant and unknown states, the overall status of the
baseline is unknown. When a baseline group contains unknown baselines and compliant
baselines, the overall status of the baseline group is unknown. The unknown compliance status
takes precedence over the compliant status.

Incompatible
The incompatible status requires attention and further action. You must determine the reason for
incompatibility by probing further. You can remediate the objects that have this status, but the
operation might not be successful. In most cases,vSphere Lifecycle Manager provides sufficient
details for the incompatibility.

When a baseline contains updates in the incompatible, compliant, and unknown states, the
overall status of the baseline is incompatible. When a baseline group contains incompatible,
unknown, and compliant baselines, the overall status of the baseline group is incompatible. The
incompatible compliance status takes precedence over the compliant and unknown compliance
statuses.

View Compliance Information About ESXi Hosts

You can check how the ESXi hosts in your environment comply with the baselines and baseline
groups that you attach to those hosts. You can check and view the compliance status of an
individual host or a container object.

Compliance checks provide information about the degree of compliance of an object with the
attached baselines and baseline groups.

In the compliance view for an object, you can view information about the compliance of the
object with the attached baselines and baselines groups. You can also view the individual
compliance statuses of the attached baselines and baseline groups. The compliance view
changes dynamically and depends on the object that you want to view compliance information
about. For a full description of the compliance information that you can obtain about an object,
seeThe vSphere Lifecycle Manager Compliance View.

For information about the different compliance statuses that an object might have, see
Compliance Statuses of ESXi Hosts, Baselines, and Baseline Groups .

Prerequisites

n Verify that the host for which you want to view compliance information uses baselines and is
not managed with a single vSphere Lifecycle Manager image.

n Review the The vSphere Lifecycle Manager Compliance View topic.

VMware, Inc. 89
Managing Host and Cluster Lifecycle

Procedure

1 In the vSphere Client, navigate to the vSphere Lifecycle Manager compliance view for an
individual host or a container object.

a Navigate to a host, cluster, or a container object.

b Click the Updates tab.

2 Select Hosts > Baselines and review the compliance information in the compliance view.

Results

You see complete compliance information about the selected object.

View Information About the Patches, Extensions, and ISO Images in a Baseline
You can view information about the patches, extensions, and upgrades included in a baseline or
a baseline group.

For information about the different compliance statuses that an update might have, see
Compliance Statuses of Updates.

Prerequisites

n Verify that the host for which you want to view compliance information uses baselines and is
not managed with a single vSphere Lifecycle Manager image.

n Review the The vSphere Lifecycle Manager Compliance View topic.

Procedure

1 In the vSphere Client, navigate to the vSphere Lifecycle Manager compliance view for an
individual host or a container object.

a Navigate to a host, cluster, or a container object.

b Click the Updates tab.

2 In the vSphere Client, navigate to a single ESXi host.

3 Select Hosts > Baselines.

4 In the Attached Baselines and Baseline Groups pane, select a baseline.

A new pane appears below the Attached Baselines and Baseline Groups pane. Depending
on the selected object, the bottom pane might contain information about the updates and
ESXi images in the baseline that you select. If the selected object is a container for ESXi
hosts, the bottom pane shows the compliance of each ESXi in the container object against
the selected baseline.

VMware, Inc. 90
Managing Host and Cluster Lifecycle

Baseline Type Available Information

Patch The bottom pane contains a table that lists all patches in
the baseline. For each update, you can see the following
information.
n Update Name
n Update ID

The update ID is a vendor-assigned identification

code of the patch.
n Status

The Status column shows the compliance status of

the update.
n Severity
n Category
n Impact

The Impact column displays the actions that you

must take to install the update. For example,
rebooting the system or putting the host in
maintenance mode.
n ESXi Version

Upgrade The bottom pane displays the following information.

n ESXi Version
n Build
n Status

The Status column shows the compliance status of

the update.
n Release Date
n Vendor
n Details
n Release Notes
n Acceptance Level

ESXi images can be either Signed or Unsigned, which

indicates their level of acceptance by VMware.

The software packages included in ESXi images

might have any of the following acceptance levels.

VMware Certified

The package has gone through a rigorous

certification program that verifies the functionality of
the feature, and is signed by VMware with a private
key. VMware provides customer support for these
packages.

VMware Accepted

VMware, Inc. 91
Managing Host and Cluster Lifecycle

Baseline Type Available Information

The package has gone through a less rigorous

acceptance test program that only verifies that the
package does not destabilize the system, and is
signed by VMware with a private key. The test
regimen does not validate the proper functioning of
the feature. VMware support hands off support calls
directly to the partner.

Partner Supported

The partner has signed an agreement with VMware

and has demonstrated a sound test methodology.
VMware provides a signed private/public key pair to
the partner to use for self-signing their packages. The
VMware support team redirects support calls directly
to the partner.

Community Supported

The package is either unsigned or signed by a key

that is not cross-signed by VMware. VMware does
not provide support for the package. For support,
customers must either use the community or contact
the author of the package.

Extension n Update Name

n Update ID

The update ID is a vendor-assigned identification

code of the extension.
n Status

The Status column shows the compliance status of

the update.
n Severity
n Category
n Impact

The Impact column displays the actions that you

must take to install the update. For example,
rebooting the system or putting the host in
maintenance mode.
n ESXi Version

Baseline Group To view information about the patches, extension, and

ISO images in a baseline group, select the respective tab
in the bottom pane.
n Click Baselines for information about the baselines
that a baseline group contains.
n Click ISO for information about the ESXi image that a
baseline group contains.
n Click Updates for information about the patches and
extensions that the baseline group contains.

VMware, Inc. 92
Managing Host and Cluster Lifecycle

Staging Patches and Extensions to ESXi Hosts

Staging lets you download the patches and extensions from the vSphere Lifecycle Manager
repository to ESXi hosts, without applying the patches and extensions immediately. Staging
patches and extensions speeds up the remediation process, because the patches and extensions
are already available locally on the hosts.

To stage patches or extensions to hosts, first attach a patch or extension baseline or a baseline
group containing patches and extensions to the host. Staging patches and extensions does not
require that hosts enter maintenance mode.

With the vSphere Client, you can stage a single baseline, multiple baselines, or baseline groups to
a single host or a group of hosts in a container object.

Some limitations exist depending on the compliance status of the patches or extensions that you
want to stage.

Patches cannot be staged if they are obsoleted by other patches in the baselines or baseline
groups for the same stage operation. vSphere Lifecycle Manager stages only the patches that it
can install in a subsequent remediation process, based on the current compliance status of the
host. If a patch is obsoleted by patches in the same selected patch set, the obsoleted patch is
not staged.

If a patch is in conflict with the patches in the vSphere Lifecycle Manager depot and is not in
conflict with a host, after a compliance check, vSphere Lifecycle Manager reports this patch as a
conflicting one. You can still stage the patch to the host and after the stage operation, vSphere
Lifecycle Manager reports this patch as staged.

During the stage operation, vSphere Lifecycle Manager performs prescan and postscan
operations and updates the compliance status of the baseline.

For more information about the different compliance statuses that an update might have, see
Compliance Statuses of Updates.

After you stage patches or extensions to hosts, you must remediate the hosts against all staged
patches or extensions.

After remediation finishes, the host deletes all staged patches or extensions from its cache
regardless of whether they were applied during the remediation. The compliance status of the
patches or extensions that were staged but not applied to the hosts reverts from Staged to its
previous value.

Important Staging patches and extensions is supported for hosts that are running ESXi 6.5 and
later. You can stage patches to PXE booted ESXi hosts, but if the host is restarted before
remediation, the staged patches are lost and you must stage them again.

VMware, Inc. 93
Managing Host and Cluster Lifecycle

Stage Patches and Extensions to ESXi Hosts

Staging is the process during which vSphere Lifecycle Manager downloads patches and
extensions on the ESXi hosts. During staging, the patches and extensions are not installed on the
host. Staging reduces the time that the host spends in maintenance mode during remediation.

Prerequisites

n Attach a patch or extension baseline or a baseline group containing patches and extensions
to the host.

n Required privileges: VMware vSphere Lifecycle Manager.Manage Patches and

Upgrades.Stage Patches and Extensions.

Procedure

1 In the vSphere Client, navigate to the vSphere Lifecycle Manager compliance view for an
individual host or a container object.

a Navigate to a host, cluster, or a container object.

b Click the Updates tab.

2 Select Hosts > Baselines.

3 In the Attached Baselines pane, select one or more baselines.

4 Click Stage.

The Stage Patches dialog box opens.

5 Select hosts on which to stage patches and extensions.

The number of selected hosts is on the top of the list.

6 To view the patches or extensions that will download to the selected hosts, expand the Stage
list.

7 Click Stage.

Results

The staging operation starts. You can monitor the progress of the task in the Recent Tasks pane.

What to do next

Remediate the host or hosts.

After remediation, all staged patches and extensions, whether installed or not during the
remediation, are deleted from the host.

VMware, Inc. 94
Managing Host and Cluster Lifecycle

Remediating ESXi Hosts Against vSphere Lifecycle Manager

Baselines and Baseline Groups
Remediation is the process during which vSphere Lifecycle Manager applies patches, extensions,
and upgrades to ESXi hosts. Remediation makes the selected vSphere objects compliant with the
attached baselines and baseline groups.

vSphere Lifecycle Manager supports the remediation of ESXi hosts against patch, extension, and
upgrade baselines.

You can initiate remediation manually or schedule a regular remediation task to run at a time that
is convenient for you.

You can remediate a single ESXi host or a container object. You can initiate remediation at a
folder, a cluster, or a data center level.

Note If you initiate remediation for an object that contains clusters that use a single vSphere
Lifecycle Manager image, remediation is not performed on those clusters.

If a vCenter Server instance is connected to other vCenter Server systems by a common vCenter
Single Sign-On domain, you can remediate only the inventory objects managed by the vCenter
Server system where the vSphere Lifecycle Manager instance that you use runs.

Orchestrated Upgrades of ESXi Hosts

You can use baseline groups to perform an orchestrated upgrade of the ESXi hosts in your
environment. The baseline group might contain a single host upgrade baseline and multiple patch
or extension baselines, or multiple patch and extension baselines. vSphere Lifecycle Manager first
upgrades the hosts and then applies the patch or extension baselines. Because the upgrade runs
first and patches are applicable to a specific host version, the orchestrated workflow ensures that
no patches are lost during the upgrade.

Orchestrated upgrades can be performed at a host, cluster, folder, or a data center level.

Starting with vCenter Server 6.7 Update 2, you can select and work with multiple baselines
instead of grouping them into a baseline group first.

Maintenance Mode
If the update requires it, hosts are put into maintenance mode before remediation. Virtual
machines cannot run when a host is in maintenance mode. To ensure a consistent user
experience, vCenter Server migrates the virtual machines to other hosts within the cluster before
the host is put in maintenance mode. vCenter Server can migrate the virtual machines if the
cluster is configured for vMotion and if VMware Distributed Resource Scheduler (DRS) and
VMware Enhanced vMotion Compatibility (EVC) are enabled. However, EVC is not a prerequisite
for vMotion. EVC guarantees that the CPUs of the hosts are compatible. For container objects or
individual hosts that are not in a cluster, migration with vMotion cannot be performed.

VMware, Inc. 95
Managing Host and Cluster Lifecycle

To remediate vSphere objects, you must have the Remediate to Apply Patches, Extensions, and
Upgrades privilege. For more information about managing users, groups, roles, and permissions,
see the vSphere Security documentation.

For a list of all vSphere Lifecycle Manager privileges and their descriptions, see vSphere Lifecycle
Manager Privileges For Using Baslines.

Remediation Pre-Check
Before you remediate an object, you can perform a remediation pre-check on the object. During
that check, vSphere Lifecycle Manager identifies possible issues that might prevent successful
remediation and suggests actions to fix the issues.

For more information about the possible issues that might prevent successful remediation, see
Remediation Pre-Check Report.

Remediation of PXE Booted ESXi Hosts

vSphere Lifecycle Manager lets you remediate PXE booted ESXi hosts. vSphere Lifecycle
Manager does not apply the patches that require a reboot to PXE booted ESXi hosts.

If there is any additional software installed on the PXE booted ESXi host, the software might be
lost if the host restarts. Update your image profile with the additional software so that it will be
present after the reboot.

To patch PXE booted ESXi hosts, you must enable the respective setting in the Edit Settings for
Host Remediation dialog box, which you open from the Settings tab in the vSphere Lifecycle
Manager home view.

Understanding the Remediation Operation

For ESXi hosts, updates are all-inclusive. The most recent update contains the patches from all
previous releases.

The ESXi image on the host maintains two copies. The first copy is in the active boot and the
second one is in the standby boot. When you patch an ESXi host, vSphere Lifecycle Manager
creates an image based on the content of the active boot and the content of the patch. The new
ESXi image is then located in the standby boot and vSphere Lifecycle Manager designates the
active boot as the standby boot and reboots the host. When the ESXi host reboots, the active
boot contains the patched image and the standby boot contains the previous version of the ESXi
host image.

When you upgrade an ESXi host, vSphere Lifecycle Manager replaces the backup image of the
host with the new image and replaces the active boot and the standby boot. During the upgrade,
the layout of the disk that hosts the boots changes. The total disk space for an ESXi host remains
1GB, but the disk partition layout within that 1GB disk space changes to accommodate the new
size of the boots where the ESXi 7.0 image is stored.

For rollback purposes, the term update refers to all ESXi patches, updates, and upgrades. Each
time you update an ESXi host, a copy of the previous ESXi build is saved on your host.

VMware, Inc. 96
Managing Host and Cluster Lifecycle

If an update fails and the ESXi 7.0 host cannot boot from the new build, the host reverts to
booting from the original boot build. ESXi permits only one level of rollback. Only one previous
build can be saved at a time. In effect, each ESXi 7.0 host stores up to two builds, one boot build
and one standby build.

The remediation of ESXi 6.5 and 6.7 hosts to their respective ESXi update releases is a patching
process, while the remediation of ESXi hosts from version 6.5 or 6.7 to 7.0 is an upgrade process.

From the vSphere Lifecycle Manager settings, you can configure the host remediation process to
skip a host reboot during host patch and host upgrade operations. This configuration setting is
called Quick Boot. For more information about configuring the vSphere Lifecycle Manager
remediation settings, see Chapter 6 Configuring the vSphere Lifecycle Manager Remediation
Settings.

Types of Host Remediation

Host remediation runs in different ways depending on the types of baselines that you attach to
an object and whether the remediated host is in a cluster or not.

Host Upgrade Remediation

When you upgrade an ESXi 6.5 or ESXi 6.7 host to ESXi 7.0, all supported custom VIBs remain
intact on the host after the upgrade, regardless of whether the VIBs are included in the installer
ISO.

You can upgrade hosts by using custom ESXi images that contain third-party modules for ESXi
7.0. In such a case, third-party modules that are compatible with ESXi 7.0 stay available on the
upgraded host.

Host upgrade in a high-latency network in which vSphere Lifecycle Manager and the hosts are at
different locations might take a few hours because the upgrade file is copied from the vSphere
Lifecycle Manager depot to the host before the upgrade. During this time, the host stays in
maintenance mode.

vSphere Lifecycle Manager 7.0 supports upgrade from ESXi 6.5 and ESXi 6.7 to ESXi 7.0.

Upgrading to ESXi 7.0 requires a boot device that is a minimum of 4 GB. When booting from a
local disk, SAN or iSCSI LUN, up to 128 GB of disk space is used to create ESXi system partitions.
You can create a VMFS datastore on a boot disk larger than 128 GB.

Note After you upgrade your host to ESXi 7.0, you cannot roll back to the previous ESXi
versions, ESXi 6.5, ESXi 6.7. So, back up your host configuration before performing an upgrade. If
the upgrade fails, you can reinstall the ESXi 6.5 or ESXi 6.7 software that you upgraded from and
restore your host configuration. For more information about backing up and restoring your ESXi
configuration, see the VMware ESXi Upgrade documentation. To upgrade ESXi hosts, you must
first import ESXi ISO images to the vSphere Lifecycle Manager depot. You then create baselines
and baseline groups to manage the upgrades for the ESXi hosts.

VMware, Inc. 97
Managing Host and Cluster Lifecycle

Host Patch Remediation

Patching is the process of remediating ESXi hosts against patch baselines.

The remediation of ESXi 6.5 and 6.7 hosts to their respective ESXi update releases is a patching
process, while the remediation of ESXi hosts from version 6.5 or 6.7 to 7.0 is an upgrade process.

vSphere Lifecycle Manager handles host patches in the following ways:

n If a patch in a patch baseline requires the installation of another patch, vSphere Lifecycle
Manager detects the prerequisite in thedepot and installs it together with the selected patch.

n If a patch is in a conflict with other patches that are installed on the host, the conflicting patch
might not be staged or installed. However, if another patch in the baseline resolves the
conflicts, the conflicting patch is installed. For example, consider a baseline that contains
patch A and patch C, and patch A conflicts with patch B, which is already installed on the
host. If patch C obsoletes patch B, and patch C is not in a conflict with patch A, the
remediation process installs patches A and C.

n If a patch is in a conflict with the patches in the vSphere Lifecycle Manager depot and is not in
a conflict with the host, after a compliance check, vSphere Lifecycle Manager reports this
patch as a conflicting one. You can stage and apply the patch to the host.

n When multiple versions of the same patch are selected, vSphere Lifecycle Manager installs
the latest version and skips installing the earlier versions.

During patch remediation, vSphere Lifecycle Manager automatically installs the prerequisites of
the patches.

With vSphere Lifecycle Manager 7.0, you can remediate hosts of version ESXi 6.5 and ESXi 6.7
against patches from offline bundles, which you import to the vSphere Lifecycle Manager depot
manually.

You can stage patches before remediation to reduce host downtime.

Host Extension Remediation

During extension remediation, vSphere Lifecycle Manager does not automatically install the
prerequisites of the extension. Missing extension prerequisites cause some remediation
operations to fail. If the missing prerequisite is a patch, you can add it to a patch baseline. If the
missing prerequisite is an extension, you can add it to the same or another extension baseline.
You can then remediate the host against the baseline or baselines that contain the prerequisite
and the original extension baseline.

Remediating Hosts in a Cluster

For ESXi hosts in a cluster, the remediation process is sequential by default.

When you remediate a cluster of hosts sequentially and one of the hosts fails to enter
maintenance mode, vSphere Lifecycle Manager reports an error and the remediation process
stops and fails. The hosts in the cluster that are remediated stay at the updated level. The ones
that are not remediated after one host fails remain unupdated.

VMware, Inc. 98
Managing Host and Cluster Lifecycle

The host upgrade remediation of ESXi hosts in a cluster proceeds only if all hosts in the cluster
can be upgraded.

If you initiate remediation at a data center level, the remediation processes for the clusters run in
parallel. Clusters that you manage with a single vSphere Lifecycle Manager image are not
remediated against the attached baselines or baseline groups. If the remediation process fails for
one of the clusters within a data center, the remaining clusters are still remediated.

Before you start remediation, you can generate a report that shows which cluster, host, or virtual
machine has the cluster features enabled. For more information, see Remediation Pre-Check
Report.

Remediation and Cluster Settings

If a host in a DRS-enabled cluster runs a virtual machine on which vCenter Server is installed, DRS
first attempts to migrate the virtual machine running vCenter Server to another host, so that the
remediation succeeds. If the virtual machine cannot be migrated to another host, the remediation
fails for the host, but the remediation process for the cluster does not stop. vSphere Lifecycle
Manager proceeds to remediate the next host in the cluster.

Remediation of hosts in a cluster requires that you temporarily disable cluster features such as
VMware DPM and HA admission control. Also, you must turn off Fault Tolerance if it is enabled on
any of the virtual machines on a host, and disconnect the removable devices connected to the
virtual machines on a host, so that they can be migrated with vMotion. For more information
about configuring the vSphere Lifecycle Manager remediation settings, see Chapter 6
Configuring the vSphere Lifecycle Manager Remediation Settings.

If a vCenter HA failover is initiated during the remediation of a cluster, the remediation task is
canceled. After the failover finishes, you must restart the remediation task on the new node.

When you perform remediation on a cluster that consists of not more than two hosts, disabling
HA admission control might not be enough to ensure successful remediation. You might need to
disable vSphere High Availability (HA) for the cluster. If you keep HA enabled, the remediation
attempts on hosts in the cluster fail, because HA cannot provide recommendation to vSphere
Lifecycle Manager to place any of the hosts into maintenance mode. The reason is that if one of
the two hosts is placed into maintenance mode there is no failover host left available in the
cluster. To ensure successful remediation on a two-node cluster, you must disable HA for the
cluster or place the hosts in maintenance mode manually and then remediate the two hosts in the
cluster.

vSAN Clusters
vSphere Lifecycle Manager remediates hosts that are part of a vSAN cluster sequentially. The
reason is that by design only one host from a vSAN cluster can be in a maintenance mode at any
time. For more information about using vSphere Lifecycle Manager with vSAN clusters, see
Chapter 14 vSAN Clusters and vSphere Lifecycle Manager.

VMware, Inc. 99
Managing Host and Cluster Lifecycle

Remediating Hosts That Contain Third-Party Software

Hosts might contain third-party software, such as Cisco Nexus 1000V VEMs or EMC PowerPath
modules. When you upgrade an ESXi 6.5 or ESXi 6.7 host to ESXi 7.0, all supported custom VIBs
are migrated and remain intact, regardless of whether the VIBs are included in the installer ISO.

If the host or the installer ISO image contains a VIB that creates a conflict and prevents the
upgrade, an error message identifies the VIB that creates the conflict.

To discover potential problems with third-party software before an upgrade operation, scan the
hosts against an upgrade baseline and review the scan messages in the vSphere Lifecycle
Manager compliance view. See Host Upgrade Compliance Messages and Host Upgrade
Compliance Messages When Cisco Nexus 1000V Is Present.

For information about upgrading with third-party customization, see the VMware ESXi Upgrade
documentation.

For information about using vSphere ESXi Image Builder to make a custom ISO, see the VMware
ESXi Installation and Setup documentation.

Remediating ESXi 6.5 or ESXi 6.7 Hosts Against an ESXi 7.0 Image
When you upgrade an ESXi 6.5 or ESXi 6.7 host to ESXi 7.0, all supported custom VIBs remain
intact on the host after the upgrade, regardless of whether the VIBs are included in the installer
ISO.

When you perform a compliance check, the target host is scanned against a set of VIBs from the
upgrade image. If you check the compliance of a host against an upgrade baseline that contains
an ISO image of the same version as the target host, vSphere Lifecycle Manager displays
Compliant or Non-compliant compliance status. If the upgrade image is the basic one distributed
by VMware, or is a custom ISO image that contains the same set of VIBs as the ones already
installed on the target host, the scan result is Compliant. If the upgrade ISO contains VIBs that are
of different kind or version than the VIBs that are already on the target host, the scan result is
Non-compliant.

The remediation process of an ESXi 6.5 or ESXi 6.7 host against an ESXi 7.0 image is an upgrade
process.

Note Upgrading to ESXi 7.0 requires a boot device that is a minimum of 4 GB. When booting
from a local disk, SAN or iSCSI LUN, up to 128 GB of disk space is used to create ESXi system
partitions. You can create a VMFS datastore on a boot disk larger than 128 GB.

You can use an ISO 7.0 image in an upgrade operation of an ESXi 7.0 host. The remediation
process of ESXi 7.0 host by using ESXi 7.0 image with additional VIBs is equivalent to a patching
process. Because the upgrade image is of the same version as the target host, upon completing
the upgrade operation, the additional VIBs are added to the target host.

VMware, Inc. 100

Managing Host and Cluster Lifecycle

Table 8-4. Scan and Remediation Situations for ESXi 6.5 and ESXi 6.7 Hosts Against ESXi 7.0
Images
Action Description

Compliance check and remediation of ESXi 6.5 or ESXi 6.7 vSphere Lifecycle Manager displays a Non-Compliant
hosts against an ESXi 7.0 image that contains additional compliance status for the host. Remediation succeeds. All
non-conflicting and non-obsoleting VIBs with the target VIBs on the target host before remediation remain on the
host. host. All VIBs from the upgrade image that are not present
on the target host before remediation are added to the
host.

Compliance check and remediation of ESXi 6.5 or ESXi 6.7 vSphere Lifecycle Manager displays a Non-Compliant
hosts against an ESXi 7.0 image that contains VIBs of a compliance status for the host. Remediation succeeds. VIBs
version later than the version of the same VIBs on the on the target host are updated to the later version.
target host.

Compliance check and remediation of ESXi 6.5 or ESXi 6.7 vSphere Lifecycle Manager displays an Incompatible
hosts against an ESXi 7.0 image that contains conflicting compliance status for the host. Remediation fails. The host
VIBs with the target host. remains intact.

Scan and remediation of ESXi 6.5 or ESXi 6.7 hosts against n If the vendor-tagged VIBs do not match the host
an ESXi 7.0 image that contains vendor-tagged VIBs. hardware, vSphere Lifecycle Manager displays an
Incompatible compliance status for the host.
Remediation fails.
n If the vendor-tagged VIBs match the host hardware,
vSphere Lifecycle Manager displays a Non-Compliant
compliance status for the host and remediation
succeeds.

Scan and remediation of ESXi 6.5 or ESXi 6.7 hosts against Remediation succeeds. All VIBs that have been installed on
an ESXi 7.0 image that contains VIBs that obsolete the VIBs the target host before remediation are replaced by the
installed on the host. newer VIBs from the ESXi image.

Remediation Pre-Check Report

The remediation pre-check report shows the results of a check that is performed on a cluster or a
host before remediation. During that check, vSphere Lifecycle Manager identifies possible issues
that might prevent successful remediation. Depending on the type of issue, vSphere Lifecycle
Manager suggests actions that you must take to fix the issue or resolves the issue automatically.

You can generate a pre-check remediation report in the vSphere Lifecycle Manager compliance
view for an object.

VMware, Inc. 101

Managing Host and Cluster Lifecycle

Table 8-5. Cluster Issues

Current Configuration/
Issue Recommended Action Details

DRS is disabled on the Enable DRS on the cluster. DRS enables vCenter Server to place and migrate virtual
cluster. machines automatically on hosts to attain the best use of
cluster resources.

vSAN health check fails Navigate to the vSAN Health The vSAN health check performs a series of tests on the
during the pre-check. page and address any health hosts in the vSAN cluster. The vSAN health check must
issues before proceeding with succeed to ensure the hosts are successfully remediated. If
remediation. you start a remediation task in a vSAN cluster that failed the
vSAN health check during the remediation pre-check, the
hosts enter maintenance mode, get upgraded, but might fail
to exit maintenance mode. The remediation eventually fails.

Insufficient licenses for Ensure that you have multiple Starting with vSphere 7.0, one CPU license covers up to 32
one or multiple ESXi licenses for the ESXi hosts physical cores. If a CPU has more than 32 cores, you must
hosts in the cluster. that have more than 32 cores assign additional CPU licenses to the respective ESXi host.
per CPU. For more information, see https://www.vmware.com/
company/news/updates/cpu-pricing-model-update-
feb-2020.html.

DPM is enabled on the None. If a host has no running virtual machines, DPM might put the
cluster. vSphere Lifecycle Manager host in standby mode before or during remediation and
disables DPM automatically. vSphere Lifecycle Manager cannot remediate them.

HA admission control is None. HA admission control prevents the migration of virtual

enabled on the cluster. vSphere Lifecycle Manager machines with vSphere vMotion and the hosts cannot enter
disables HA admission control maintenance mode.
automatically.

EVC is disabled on the None. vSphere Lifecycle If EVC is disabled for a cluster, the migration of virtual
cluster. Manager enables EVC machines with vSphere vMotion cannot proceed. The result
automatically, although no is downtime of the machines on the hosts that you
notification or message remediate with vSphere Lifecycle Manager.
appears in the vSphere Client.

Table 8-6. Host Issues

Current Configuration/Issue Recommended Action Details

A CD/DVD drive is attached to a Disconnect the CD/DVD Any CD/DVD drives or removable devices connected to
virtual machine on the ESXi drive. the virtual machines on a host might prevent the host from
host. entering maintenance mode. When you start a
remediation operation, the hosts with virtual machines to
which removable devices are connected are not
remediated.

A floppy drive is attached to a Disconnect the floppy Any floppy drives or removable devices connected to the
virtual machine on the ESXi drive. virtual machines on a host might prevent the host from
host. entering maintenance mode. When you start a
remediation operation, the hosts with virtual machines to
which removable devices are connected are not
remediated.

VMware, Inc. 102

Managing Host and Cluster Lifecycle

Table 8-6. Host Issues (continued)

Current Configuration/Issue Recommended Action Details

Fault Tolerance (FT) is enabled Disable FT for the virtual If FT is enabled for any of the virtual machines on a host,
for a virtual machine on the ESXi machine. vSphere Lifecycle Manager cannot remediate that host.
host.

A powered on virtual machine is "Disable Virtual Flash Starting with vSphere 7.0, Virtual Flash Read Cache is not
configured to use Virtual Flash Read Cache before supported. During an upgrade operation, vSphere
Read Cache. proceeding with the Lifecycle Manager removes Virtual Flash Read Cache for
upgrade. all virtual machines on the host. Before remediation,
consult https://kb.vmware.com/s/article/2057840.

VMware vCenter Server is Enable DRS on the One of the virtual machines in the cluster runs the vCenter
installed on a virtual machine on cluster and ensure that Server instance that you currently use. If you enable DRS
the ESXi host and DRS is virtual machines can be on the cluster, vSphere vMotion can migrate the virtual
disabled on the cluster. migrated with vSphere machine where vCenter Server runs to ensure that the
vMotion. remediation of the hosts is successful.

An ESXi host in the cluster has a Assign as many licenses Starting with vSphere 7.0, one CPU license covers up to 32
CPU wih more than 32 cores as the host needs. physical cores. If a CPU has more than 32 cores, you must
and requires multiple licenses. obtain additional CPU licenses. For more information, see
https://www.vmware.com/company/news/updates/cpu-
pricing-model-update-feb-2020.html.

Generate a Pre-Remediation Check Report

When you generate a pre-remediation check report, vSphere Lifecycle Manager generates a list
with actions that you must perform to ensure successful remediation of the hosts in your cluster.

The remediation pre-check report contains information about issues at the cluster, host, and VM
level that might prevent the completion of remediation.

For information about the possible issues that might prevent successful remediation, see
Remediation Pre-Check Report.

Procedure

1 In the vSphere Client, navigate to the vSphere Lifecycle Manager compliance view for an
individual host or a container object.

a Navigate to a host, cluster, or a container object.

b Click the Updates tab.

2 Select Host > Baselines.

3 In the Baselines pane, click Pre-Check Remediation.

The Remediation Pre-check dialog box opens.

4 Review the results from the pre-check and click Done.

In the bottom pane of the Remediation Pre-check dialog box, you see a list of issues at the
host and virtual machine level.

VMware, Inc. 103

Managing Host and Cluster Lifecycle

Results

The Remediation Pre-check dialog box lists the issues with cluster, hosts, and virtual machines
that might prevent successful remediation of the selected object.

In the upper pane of the Remediation Pre-check dialog box, you see a list of issues at a cluster
level.

In the bottom pane of the Remediation Pre-check dialog box, you see a list of issues at the host
and virtual machine level.

What to do next

Fix all issues that vSphere Lifecycle Manager identifies during the pre-remediation check and
remediate the selected object.

Remediate ESXi Hosts Against a Single Baseline or Multiple Baselines

You can remediate hosts against attached patch, upgrade, and extension baselines or baseline
groups.

You can remediate a host against a single baseline, multiple baselines of the same type, or
against a baseline group. To remediate against baselines of different types, you must create a
baseline group. Baseline groups might contain multiple patch and extension baselines, or an
upgrade baseline combined with multiple patch and extension baselines.

Note Because in vSphere 7.0 the official VMware online depot hosts certified partner content in
addition to VMware content, a broader set of OEM bulletins are available in the vSphere Lifecycle
Manager depot. As a result, a broader set of OEM bulletins are included in the vSphere Lifecycle
Manager predefined bulletins. During remediation, always inspect the contents of those baselines
to exclude the bulletins that you do not need in the baseline. For the bulletins that you do need,
consult the corresponding KB articles for information about deployment specifics and
dependencies. Verify that dependent bulletins are also included in the baselines that you use for
remediation.

You can remediate ESXi hosts against a single attached upgrade baseline at a time. You can
upgrade all hosts in your vSphere inventory by using a single upgrade baseline that contains an
ESXi 7.0 image.

You can remediate a single ESXi host or a group of ESXi hosts in a container object, such as a
folder, a cluster, or a data center. You can also initiate remediation at a vCenter Server level.

Note If a vCenter HA failover is initiated during the remediation of a cluster, the remediation task
is canceled. After the failover finishes, you must restart the remediation task on the new node.

Prerequisites

n Required privileges: VMware vSphere Lifecycle Manager.Manage Patches and

Upgrades.Remediate to Apply Patches, Extensions, and Upgrades.

VMware, Inc. 104

Managing Host and Cluster Lifecycle

n Attach a patch, upgrade, or extension baseline or a baseline group containing patches,

upgrades, and extensions to the host.

n Resolve any issues that occur during Remediation Pre-check.

n In upgrade scenarios, verify that the ESXi hosts to upgrade have a boot disk of at least 4 GB.
When booting from a local disk, SAN or iSCSI LUN, up to 128 GB of disk space is used to
create ESXi system partitions. You can create a VMFS datastore on a boot disk larger than
128 GB.

Procedure

1 In the vSphere Client, navigate to the vSphere Lifecycle Manager compliance view for an
individual host or a container object.

a Navigate to a host, cluster, or a container object.

b Click the Updates tab.

2 Select Hosts > Baselines.

3 In the Attached Baselines and Baseline Groups pane, select the baselines and baseline
groups to use for remediation.

You can select a single baseline or baseline group. You can also select multiple baselines and
baseline groups. Your selection of baselines and baseline groups must contain only one
upgrade baseline.

4 Click Remediate.

If the selected baselines and baseline groups do not contain an upgrade image, the
Remediate dialog box opens.

If the selected baselines and baseline groups contain an upgrade image, the End User
License Agreement dialog box opens.

5 If the selection of baselines and baseline groups contains an upgrade baseline, accept the
terms and the license agreement in the End User License Agreement dialog box.

After you accept the agreement and click OK to close the dialog box, the Remediate dialog
box opens.

VMware, Inc. 105

Managing Host and Cluster Lifecycle

6 In the Remediate dialog box, review the remediation settings and make any necessary
changes.

a Review the list of actions that vSphere Lifecycle Manager must perform to ensure
successful remediation.

b (Optional) To generate a full pre-remediation check report, click Show Full Remediation
Pre-Check Report.

If you select this option, the Remediate dialog box closes and vSphere Lifecycle Manager
does not proceed with the remediation process. Instead, the Remediation Pre-Check
dialog box opens. After you review the results from the pre-remediation check, you must
initiate remediation again.

c Review the list of hosts to be remediated and deselect any host that you do not want to
remediate.

The list contains all the hosts to which the selected baselines and baseline groups are
attached. Even if you navigated to a single host before initiating remediation, the list
might display multiple hosts to be remediated. All hosts in the list are selected by default.
Deselecting hosts from the list changes the overall number of hosts to be remediated.

7 (Optional) To view information about the updates that will be installed during the remediation,
expand the Install list.

If the selection of baselines and baseline groups contains an upgrade baseline, information
about the ESXi image is also displayed.

8 (Optional) To schedule the remediation task for a later time, expand Scheduling Options and
configure the scheduled task.

By default, the remediation task starts immediately after closing the Remediate dialog box.

9 Expand Remediation settings and review the remediation settings.

n To disable Quick Boot, deselect the respective check box in the table.

n To disable health checks after remediation, disable the respective check box in the table.

n To ignore warnings about unsupported hardware devices, select the respective check
box in the table.

n To change any other of the remediation settings, click the Close Dialog And Go To
Settings link above the table.

If you select this option, the Remediate dialog box closes and vSphere Lifecycle Manager
does not proceed with the remediation process. Instead, you are redirected to the
Baselines Remediation Settings pane on the Settings tab of the vSphere Lifecycle
Manager home view. To change any of the remediation settings, click the Edit button.
Remediation does not resume automatically. After you make the desired changes, you
must initiate remediation again.

10 Click Remediate.

VMware, Inc. 106

Managing Host and Cluster Lifecycle

Results

Depending on the remediation schedule, the remediation task starts immediately or runs later.

VMware, Inc. 107

Using Images
9
Starting with vSphere 7.0, you can manage the software and firmware lifecycle of the ESXi hosts
in a cluster with a single image. vSphere Lifecycle Manager images are a new functionality that
provides a simplified and unified workflow for patching and upgrade of ESXi hosts. You can also
use vSphere Lifecycle Manager images for bootstrapping purposes and firmware updates.

An image defines the exact software stack to run on all ESXi hosts in a cluster.

Using images to apply software and firmware updates to ESXi hosts is a multi-stage process.

1 Software updates must become available in the vSphere Lifecycle Manager depot.

To set up and use an image, you use the software updates that are available in the vSphere
Lifecycle Manager depot. The depot contains base images, vendor add-ons, and additional
components.

Updates get into the vSphere Lifecycle Manager local depot through synchronization with
configurable download sources. By default, vSphere Lifecycle Manager is configured to
synchronize with the official VMware depot. You can also import updates into the depot
manually.

You can see the contents of the vSphere Lifecycle Manager depot in the vSphere Lifecycle
Manager home view.

For more information, see Chapter 5 Working with the vSphere Lifecycle Manager Depot.

2 You start using vSphere Lifecycle Manager images.

vSphere Lifecycle Manager provides you with the option to start using images with the very
creation of a cluster. If you do not set up an image during the creation of a cluster, you can
switch from using vSphere Lifecycle Manager baselines to using vSphere Lifecycle Manager
images at a later time.

Even when you save the image, no software is installed on the ESXi hosts during image
setup.

For more information, see Chapter 7 Cluster Operations and vSphere Lifecycle Manager and
Chapter 10 Switching from Baselines to Images.

3 You check the compliance of the ESXi hosts in the cluster against the image specification.

VMware, Inc. 108

Managing Host and Cluster Lifecycle

The compliance check compares the current image on the ESXi hosts in the cluster against
the desired image that you specified during the setup process, and defines compatibility
status of the hosts.

For more information, see Check Cluster Compliance Against an Image.

4 You review the compliance statuses of the hosts in the cluster.

5 You can run a remediation pre-check on an ESXi host to ensure software and hardware
compatibility with the image.

Running a remediation pre-check is optional. The remediation pre-check ensures that all
requirements for successful remediation are met. For more information, see Run a
Remediation Pre-Check .

6 You remediate the non-compliant ESXi hosts in the cluster.

Remediation is the process through which the software specification defined by the vSphere
Lifecycle Manager image that you use for a cluster is actually applied to the hosts in the
cluster.

For more information about remediating hosts against an image, see Remediate a Cluster
Against a Single Image.

This chapter includes the following topics:

n Working with Images

n Checking Compliance Against a Single Image

n Run a Remediation Pre-Check

n Remediating a Cluster Against a Single Image

n Manage Depot Overrides for a Cluster

Working with Images

When you manage a cluster with a single image, you can change the image at any time. You can
edit the image by changing the software that it includes, for example, you can add or remove
components, and you can also change the version of the included components.

Using vSphere Lifecycle Manager images starts with setting up an image for a cluster. You can
set up an image during the creation of the cluster or later.

After you start managing a cluster with a single image, you can edit the image at any time. You
can validate the image before saving it to verify that it includes no conflicting components or
missing dependencies.

You can export and import images. For example, you can export an image as an installable ISO
file, which you can use for bootstrapping purposes. You can also export the image as a JSON file
and reuse it for another cluster that uses images.

VMware, Inc. 109

Managing Host and Cluster Lifecycle

Setting Up an Image
To take advantage of all new functionalities that vSphere Lifecycle Manager provides in vSphere
7.0, for example, software recommendations and firmware updates, you must start using images
for the clusters in your environment. You can set up an image during the creation of a cluster or
later.

During the creation of a cluster, you can only define the ESXi version and, optionally, a vendor
add-on to be included in the image for the cluster. You can later edit the image to include
additional components or a firmware add-on. For detailed information about creating a cluster
and adding hosts to it, see the vCenter Server and Host Management documentation.

Note When you set up an image, you select an ESXi version and a vendor add-on from the
vSphere Lifecycle Manager depot. If no ESXi base images and vendor add-ons are available in
the vSphere Lifecycle Manager depot, you must populate the depot with software updates by
synchronizing the depot or uploading updates to the depot manually. For detail information
about the corresponding procedures, see Synchronize the vSphere Lifecycle Manager Depot and
Import Updates to the vSphere Lifecycle Manager Depot.

If you do not set up an image during the creation of the cluster, it uses baselines, but you can
switch to images at any time. When you set up an image during the transition workflow, you can
define the full stack of software to run on the hosts in the cluster. For more information about
switching from baselines to images, see Chapter 10 Switching from Baselines to Images.

Whereas switching from baselines to images is possible, the reverse operation is not. If a cluster
uses a single image, regardless of whether you set up the image during the cluster creation or
transition, you cannot switch to using baselines for that cluster.

Viewing Image Details

You can view details about the image that a cluster uses as well as compliance information for
that cluster in the vSphere Lifecycle Manager compliance view.

You access the vSphere Lifecycle Manager compliance view from the Updates tab for a cluster.

The Image pane consists of two cards.

The Image card contains information about the image that the cluster uses. In that card, you
perform all image-related operations. You edit the image, you export the image, you validate
your selections, and so on. You can also check and view the recommendations that VMware
provides.

The Image Compliance card contains compliance information about the hosts in the cluster. In
that card, you perform host-related operations. You check the compliance of the hosts in the
cluster, you run remediation pre-checks, you remediate the hosts, and so on.

In the Image Compliance card, you edit remediation settings for that cluster and manage depot
overrides.

VMware, Inc. 110

Managing Host and Cluster Lifecycle

Editing Images
For a cluster that you manage with a single image, you can edit the image at any time to add,
remove, or update an image element. For example, you can edit the image to update the vendor
add-on version that it includes, to add or remove a driver, to upgrade the ESXi version in the
image, and so on.

Working with Drafts

When you edit an image, vSphere Lifecycle Manager saves the working copy of the image as a
draft. The draft is an edited but unsaved version of an image. If you edit an image but for some
reason you do not save the new image set-up, when you restart editing the image, you can use
the saved draft version as a starting point or you can altogether discard the changes that you
previously made.

Validation
You can validate an image draft before you save it. Validation checks whether the image is
correct and complete. During validation, vSphere Lifecycle Manager checks for missing
dependencies and conflicting components. In case of issues, vSphere Lifecycle Manager returns
messages with information about the existing issues. You must resolve all issues before you can
save the image.

Edit an Image
If a cluster uses a single image, you can edit that image at any time. You can add, remove, or
modify the elements included in the image.

Prerequisites

Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For Using
Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 In the Image card, click the Edit button.

VMware, Inc. 111

Managing Host and Cluster Lifecycle

4 In the Edit Image card, modify the image set-up.

Image Element Possible Modifications

ESXi Version From the ESXi Version drop-down menu, select a new ESXi base image.

Vendor Add-On n To add a vendor add-on to the image, click Select and select a vendor
add-on.
n To change the version of the vendor add-on in the image or to select a
new vendor add-on, click the pencil icon and make your changes .
n To remove the vendor add-on from the image altogether, click the trash
icon .

Firmware and Drivers Add-On n To add a firmware add-on to the image, click Select. In the Select
Firmware and Drivers Addon dialog box, specify a hardware support
manager and select a firmware add-on to add to the image.
n To select a new firmware add-on, click the pencil icon and make your
changes.
n To remove the firmware add-on element from the image altogether,
click the trash icon.
Selecting a firmware add-on for a family of vendor servers is possible only if
the respective vendor-provided hardware support manager is registered as
an extension to the vCenter Server where vSphere Lifecycle Manager runs.

Components Click Show details and view the list of additional components in the image.
n To add components to the image, click Add Components and select the
components and their corresponding versions to add to the image.
n To delete a component from the image, click the trash icon in the table
with components.
n To delete a manually added component that overrides a component in
the selected vendor add-on or base image, click the undo icon in the
table with components.

This action reverts the override.

5 (Optional) To validate the image, click the Validate button.

You validate an image to check for missing dependencies and component conflicts.

6 Click Save.

The save operation triggers validation. If the image is valid, vSphere Lifecycle Manager saves
it and runs a compliance check against the new image. You can view compliance information
in the Image Compliance card.

If the image is invalid, saving the image fails and vSphere Lifecycle Manager returns an error.

Results

The new image is validated and displayed in the Image card. You are prompted to re-run the
hardware compatibility check against the new image.

VMware, Inc. 112

Managing Host and Cluster Lifecycle

If there are recommended images generated for the cluster, those recommendations become
invalidated. To get recommendations based on the new image, you must initiate the Check for
recommended images task manually. For more information, see Check for Recommended
Images.

Reusing Existing Images

A vSphere Lifecycle Manager image can be distributed within the same vCenter Server instance
where vSphere Lifecycle Manager runs or across vCenter Server instances. You can reuse an
image that you already set up by exporting it from its cluster and importing it to the target
cluster.

To reuse an existing image for a cluster in the same vCenter Server system, you must export the
image as a JSON file and then import the JSON file to the target cluster.

However, when you want to use an existing image for a cluster in another vCenter Server
instance, exporting the image as a JSON file might not be enough. You might also need to export
the image as a ZIP file. At the target location, you must import the JSON file as an image to the
target cluster. You might also need to import the ZIP file to the target vSphere Lifecycle Manager
depot to make sure that all components included in the image are available to the target vSphere
Lifecycle Manager instance.

Distribution Formats for vSphere Lifecycle Manager Images

You can use vSphere Lifecycle Manager to customize an ESXi base image by adding vendor add-
ons and additional components. Depending on your goal, a vSphere Lifecycle Manager image
can be distributed and consumed in three different formats.

ISO Image
Distributing an image created with vSphere Lifecycle Manager in an ISO format is useful when
you need the image to perform clean installs of ESXi and for bootstrapping purposes, for
example the kickstart workflow.

You cannot use an image exported as an ISO file with another cluster that uses vSphere Lifecycle
Manager images.

You can import the ISO image into the local depot of the target vSphere Lifecycle Manager
instance, but you can only use the ISO file to create upgrade baselines. You cannot use ISO files
with vSphere Lifecycle Manager images.

ZIP File
Distributing an image created with vSphere Lifecycle Manager as an offline bundle is useful when
you want to import the components that the image contains into the depot of the target vSphere
Lifecycle Manager instance.

Unlike the ISO image, you cannot use a ZIP file to create upgrade baselines.

VMware, Inc. 113

Managing Host and Cluster Lifecycle

JSON File
Distributing an image created with vSphere Lifecycle Manager as a JSON file is useful when you
want to reuse the same image for other clusters that use images for host management.

When you distribute the JSON file to clusters in a different vCenter Server instance, you must
make sure that the depot of the target vSphere Lifecycle Manager instance contains all
components that the JSON file contains.

The JSON file contains only metadata and not the actual software payloads.

Export an Image
You export an image when you want to use the same image for another cluster in the same or in
a different vCenter Server instance.

Depending on your goals, you can export an image in three different formats. You can export the
image as a JSON file, as an installable ISO image, or as an offline bundle that contains all software
packages included in the image. For more information about the different distribution formats,
see Distribution Formats for vSphere Lifecycle Manager Images.

Prerequisites

Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For Using
Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 Click the horizontal ellipsis icon and select Export.

4 In the Export Image dialog box, select a file format, and click Export.

You can export the image in one file format at a time. The export format depends on your
needs and goals.

If you intend to use the image for a cluster in another vCenter Server, you must export it as a
JSON file and as a ZIP file. Afterwards, you must import both the JSON file and the ZIP file to
the target vCenter Server system.

Results

The exported file is saved on your local machine.

What to do next

Import the image to a target cluster in the same or in a different vCenter Server instance. For
more information, see Import an Image .

For information about importing updates to the vSphere Lifecycle Manager depot, see Import
Updates to the vSphere Lifecycle Manager Depot.

VMware, Inc. 114

Managing Host and Cluster Lifecycle

Import an Image
Instead of setting up a new image manually, you can reuse an existing image by importing it to a
cluster. Upon remediation, the imported image is applied to all hosts in the cluster.

You can import an image only if it is in a JSON format. The JSON file contains only the image
metadata, but not the actual software payloads. To successfully import an image to a cluster and
apply the software specification to the hosts in the cluster, all the components must specified in
the image be available in the vSphere Lifecycle Manager depot.

So, if you want to distribute and reuse an image across vCenter Server instances, importing the
JSON file might not be enough if the components from the image are not available in the target
vSphere Lifecycle Manager depot. In such cases, before you import the JSON file to the target
cluster, you must first import to the target vSphere Lifecycle Manager depot an offline bundle
that contains all components included in the image. If you try to import a JSON file to a cluster
but the target vSphere Lifecycle Manager depot does not contain the corresponding
components, the import operation fails due to validation errors.

For information about importing updates to the vSphere Lifecycle Manager depot, see Import
Updates to the vSphere Lifecycle Manager Depot.

Prerequisites

n Verify that the vSphere Lifecycle Manager depot contains all components included in the
image that you import.

n Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For
Using Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 Click the horizontal ellipsis icon and select Import.

4 In the Import Image dialog box, select a JSON file and click Next.

n Enter a URL address to the JSON file that you want to import.

n Browse to a JSON on your local machine.

5 (Optional) In the Edit Image card, modify the image set-up.

Image Element Possible Modifications

ESXi Version From the ESXi Version drop-down menu, select a new ESXi base image.

Vendor Add-On n To add a vendor add-on to the image, click Select.

n To change the version of the vendor add-on in the image or to select a
new vendor add-on, click the pencil icon.
n To remove the vendor add-on element from the image altogether, click
the trash icon .

VMware, Inc. 115

Managing Host and Cluster Lifecycle

Image Element Possible Modifications

Firmware and Drivers Add-On n To add a firmware add-on to the image, click Select.
n To select a new firmware add-on, click the pencil icon.
n To remove the firmware add-on element from the image altogether,
click the trash icon.
Selecting a firmware add-on for a family of vendor servers is possible only if
the respective vendor-provided hardware support manager is registered as
an extension to the vCenter Server where vSphere Lifecycle Manager runs.

Components Click Show details and view the list of additional components in the image.
n To add components to the image, click Add Components and select
components to add to the image.
n To delete a component from the image, click the trash icon in the table
with components.
n To delete a manually added component that overrides a component in
the selected vendor add-on, click the undo icon in the table with
components.

This action reverts the override.

6 If the image contains conflicting components or unresolved dependencies, resolve the issues
and retry the procedure.

7 (Optional) To validate the image, click the Validate button.

You validate an image to check for missing dependencies and component conflicts.

8 Click Save.

A compliance check task is automatically triggered. You can view compliance information in
the Image Compliance card.

Results

The imported JSON file is imported and set as your new image for the target cluster. At that
stage, nothing is installed on the hosts in the cluster. The installation of software on the hosts
happens during remediation.

What to do next

Remediate the hosts in the cluster against the new image. See Run a Remediation Pre-Check and
Remediate a Cluster Against a Single Image.

Checking Compliance Against a Single Image

When you check the compliance of a cluster against an image, vSphere Lifecycle Manager
compares the software on each host in the cluster with the software specified in the image. If the
image contains a firmware and drivers add-on, the compliance check also calculates the firmware
compliance of the hosts with the image.

For example, vSphere Lifecycle Manager compares the ESXi version on each host to the ESXi
version in the image for the cluster.

VMware, Inc. 116

Managing Host and Cluster Lifecycle

In addition to the calculating the compliance state for each host, the compliance check gives you
information about the impact that the remediate operation will have on the host, for example if
remediation will cause host reboot or if maintenance mode is needed for the host.

Compliance information about the hosts in a cluster is displayed on the Updates tab for that
cluster, in the Image Compliance card. The Image Compliance card displays a list of all hosts in
the cluster. When you select a host, the compliance information about the host appears on the
right.

Compliance States
During a compliance check, the software on each of the hosts in a cluster is compared to the
software specification in the image that you set up for the entire cluster. The compliance check
defines the compliance of each host with the image for the cluster.

A host can have any of the four compliance states: compliant, non-compliant, incompatible, and
unknown.

Compliant

A host is complaint if the image on the host matches the image that you set for the cluster.

Non-Compliant

A host is non-compliant if the image on the host does not match the image that you set for
the cluster. A compliant host becomes non-compliant when you set a new image for the
cluster or manually add or remove components on the host. You remediate non-compliant
hosts to make them compliant.

For example, a host is non-compliant in the following cases.

n The ESXi version on the host is earlier than the ESXi version included in the image for the
cluster.

n The firmware on the host is different from the firmware add-on in the image for the
cluster.

n The host has a component that is not included in the image for the cluster.

n The host contains a standalone VIB.

Incompatible

A host is incompatible when the image for the cluster cannot be applied to the host.

For example, a host is incompatible in the following cases.

n The ESXi version on the host is later than the ESXi version included in the image for the
cluster.

n The host does not have sufficient resources, for example RAM.

VMware, Inc. 117

Managing Host and Cluster Lifecycle

n The hardware of the host is incompatible with the vSphere Lifecycle Manager image for
the cluster.

Unknown

The unknown compliance state indicates that there is no compliance information about the
host.

For example, the compliance state of a host is unknown in the following cases.

n You add a new host to the cluster. The compliance state of the newly added hosts is
unknown until you perform a compliance check operation on the cluster.

n You edit the image for the cluster and save the modifications. The compliance state of all
hosts in the cluster is unknown until you check the compliance of the cluster against the
new image.

Check Cluster Compliance Against an Image

You check the cluster compliance against an image to understand how each of the hosts in the
cluster compares to the specified image.

When you perform the check compliance operation on an object that contains multiple clusters
that you manage with a single image, for example a data center or vCenter Server instance,
vSphere Lifecycle Manager performs compliance checks on all those clusters.

Prerequisites

Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For Using
Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 In the Image Compliance card, click the Check Compliance button.

Results

The Image Compliance card displays information about the overall number of non-compliant and
incompatible hosts in the cluster. For details about a particular host and its compliance state, you
must click the host. The information panel appears on the right.

What to do next

Remediate the cluster to make the non-compliant hosts compliant. See Run a Remediation Pre-
Check and Remediate a Cluster Against a Single Image.

VMware, Inc. 118

Managing Host and Cluster Lifecycle

View Host Compliance Information

You can view compliance information for each host in a cluster that you manage with a single
image. The compliance state of the host indicates whether the software that runs on the selected
host matches the software specification expressed in the image.

In the vSphere Lifecycle Manager compliance view, you can see how all elements of the vSphere
Lifecycle Manager image for the cluster compare to the software installed on the host.
Alternatively, for non-compliant hosts, you can check exactly what causes the image drift.

For hosts that have the incompatible compliance state, vSphere Lifecycle Manager shows in a
signpost information about what causes the compatibility issues.

Prerequisites

Verify that the host is not added to the cluster after your last compliance check.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 In the Image Compliance card, select a host from the list.

An information panel appears on the right. In the Software compliance table, you can see
what software runs on the selected host and what is the software specification in the image
for the cluster.

4 To view the full comparison between the image on the host and the image for the cluster,
select Full image comparison from the drop-down menu for the Software compliance table.

5 To view only the image elements that make the host non-compliant with the image for the
cluster, select Only drift comparison from the drop-down menu for the Software compliance
table.

Run a Remediation Pre-Check

To ensure that cluster health is optimal and that no problems occur during the remediation of the
cluster against a single image, you can perform a remediation pre-check.

The remediation pre-check operation includes a series of checks for the cluster and for each host
in the cluster. These checks include extensive health checks to determine whether the cluster is
in a stable state and to ensure successful remediation. Also, the remediation pre-check triggers a
compliance check for the cluster. As a result, after the remediation pre-check, you can view
compliance information for each host and whether host reboot or maintenance mode are
necessary for successful remediation.

Prerequisites

Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For Using
Images.

VMware, Inc. 119

Managing Host and Cluster Lifecycle

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 In the Image Compliance card, click the Run pre-check button.

You can observe the progress of the pre-check task. When the task finishes, vSphere
Lifecycle Manager displays information about the issues found during the pre-check.

What to do next

If vSphere Lifecycle Manager reports no issues, remediate the cluster. See Remediate a Cluster
Against a Single Image.

If issues are reported, resolve the issues before you remediate the cluster.

Remediating a Cluster Against a Single Image

When you set up or import a vSphere Lifecycle Manager image to use with a cluster, the
software specified in the image is not immediately installed on the hosts in that cluster. To apply
the software specification from the image to the hosts, you must remediate the cluster against
that image.

To initiate remediation of a cluster, you must have the required privileges. For a list of all vSphere
Lifecycle Manager privileges and their descriptions, see vSphere Lifecycle Manager Privileges For
Using Images. For more information about managing users, groups, roles, and permissions, see
the vSphere Security documentation.

In vSphere 7.0, the hosts in a cluster are remediated sequentially. Parallel remediation is not
supported. So, if the remediation for a single host in the cluster fails, the remediation of the entire
cluster stops.

During remediation, the image that you set up for the cluster is installed on all ESXi hosts in the
cluster.

When you remediate a cluster that contains a single ESXi host or that has vSphere Storage DRS
disabled or in manual mode, the remediation process cannot put that host into maintenance
mode. So, to proceed with the remediation, you must power off the virtual machines that are
running on the host, move them to another host, or select a user policy that allows the
remediation process to power off the virtual machines. You can also set a user policy to power
on the virtual machines after the host is remediated.

VMware, Inc. 120

Managing Host and Cluster Lifecycle

Maintenance Mode
If the update requires, hosts are put into maintenance mode before remediation. Virtual machines
cannot run when a host is in maintenance mode. To ensure a consistent user experience,vCenter
Server migrates the virtual machines to other hosts within the cluster before a host is put into
maintenance mode. vCenter Server can migrate the virtual machines if the cluster is configured
for vMotion and if DRS and VMware Enhanced vMotion Compatibility (EVC) are enabled. EVC
guarantees that the CPUs of the hosts are compatible, but it is not a prerequisite for vMotion.

Edit the Remediation Settings for a Cluster

You can customize the remediation settings for a particular cluster while the global remediation
settings remain intact and apply to all other clusters that you manage with vSphere Lifecycle
Manager images.

The vSphere Lifecycle Manager remediation settings define how ESXi hosts and virtual machines
behave before and during a remediation of a cluster. You configure the vSphere Lifecycle
Manager remediation settings in the vSphere Lifecycle Manager home view. The remediation
settings are valid for all clusters in the vCenter Server instance where vSphere Lifecycle Manager
runs. For more information about how to configure the vSphere Lifecycle Manager remediation
settings, see Configure Remediation Settings for vSphere Lifecycle Manager Images .

Additionally, you can modify and override the global remediation settings for a single cluster. The
overrides are used during the remediation of that specific cluster. For all other clusters, the global
remediation settings apply.

Prerequisites

Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For Using
Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 In the Image Compliance card, click the horizontal ellipsis icon and select Edit remediation
settings.

VMware, Inc. 121

Managing Host and Cluster Lifecycle

4 In the Edit Remediation Settings dialog box, configure the remediation settings of the target
cluster and click Save.

Option Description

Quick Boot Quick Boot reduces the host reboot time during remediation. Before you
enable Quick Boot, you must make sure that the ESXi host is compatible
with the feature.

VM power state The VM power stateoption lets you control the behavior of the virtual
machines that run on the ESXi host. You can configure vSphere Lifecycle
Manager to power off or suspend all running virtual machines before host
remediation. Alternatively, you can choose not to change the power state of
the virtual machines.

VM migration You can configure vSphere Lifecycle Manager to migrate the suspended
and powered off virtual machines from the hosts that must enter
maintenance mode to other hosts in the cluster.

Maintenance mode failures You can configure how vSphere Lifecycle Manager behaves if a host fails to
enter maintenance mode before remediation. You can configure vSphere
Lifecycle Manager to wait for a specified retry delay period and to retry to
put the host into maintenance mode as many times as you indicate in the
Number of retries text box.

Results

These settings are the remediation settings for the selected cluster. vSphere Lifecycle Manager
uses those settings for that cluster for all future remediation tasks. The global remediation
settings remain unchanged and are applied to all other clusters.

In the Image Compliance card, vSphere Lifecycle Manager displays a message that the global
remediation settings are overriden. Also, an option to reset the values appears in the card.

Remediate a Cluster Against a Single Image

By remediating a cluster against an image, you apply the software specified in the image to all
the hosts in the cluster. So, by remediating a cluster, you make the non-compliant hosts
compliant with the image that you set for the cluster.

During remediation, the hosts in the cluster are remediated in sequence. The hosts that have the
incompatible compliance state are not remediated.

If a vCenter HA failover is initiated during the remediation of a cluster, the remediation task is
canceled. After the failover finishes, you must restart the remediation task on the new node.

Prerequisites

n Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For
Using Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

VMware, Inc. 122

Managing Host and Cluster Lifecycle

2 On the Updates tab, select Hosts > Image.

3 In the Image Compliance card, click the Remediate All button.

The Review Remediation Impact dialog box appears. The dialog box contains detailed
information about all changes that remediation will enforce on the hosts in the cluster.

4 In the Review Remediation Impact dialog box, review the impact summary, the applicable
remediation settings, and the EULA.

5 To save and review the impact details later, click Export Impact Details

6 Accept the EULA by selecting respective check box.

The check box is selected by default.

7 Click the Start remediation button.

The Remediate Cluster task appears in the Recent Tasks pane. You can also observe the
progress of the remediation task in the Image Compliance card. If remediation fails, vSphere
Lifecycle Manager gives information about the reasons for the failure.

View Last Remediation or Remediation Pre-Check Results for a

Cluster that Uses a Single Image
You can view the remediation results from the last remediation or remediation pre-check that
vSphere Lifecycle Manager performed.

Prerequisites

Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For Using
Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 In the Image Compliance card, click the horizontal ellipsis icon and select your task.

n To view the results from the last remediation pre-check performed on the cluster, select
Last pre-check results.

n To view the results from the last remediation of the cluster, select Last remediation
results.

Results

The Image Compliance displays detailed information about the last remediation or remediation
pre-check task that ran on the cluster.

VMware, Inc. 123

Managing Host and Cluster Lifecycle

Manage Depot Overrides for a Cluster

Instead of accessing the vSphere Lifecycle Manager depot in vCenter Server, clusters in Remote
Office and Branch Office (ROBO) deployments can download data from a depot that is local for
them. You can configure vSphere Lifecycle Manager to use local depots for any cluster that uses
images.

A ROBO cluster is a cluster that has limited or no access to the Internet or limited connectivity to
vCenter Server. As a result, clusters in ROBO deployments might have limited access to the
vSphere Lifecycle Manager depot during the compliance check, remediation pre-check, and
remediation operations.

With vSphere Lifecycle Manager images, you can use a local depot for ROBO clusters and
configure vSphere Lifecycle Manager to use the local depot during the compliance check,
remediation pre-check, and the remediation tasks. The local depot overrides the vSphere
Lifecycle Manager depot. Using local depots with ROBO clusters saves time and network
bandwidth.

For each cluster that you manage with a single image, you can add and use multiple local depots
instead of the default vSphere Lifecycle Manager depot. You can also delete the depot overrides
that you configure. If depot overrides are not active for a cluster, the cluster uses the general
vSphere Lifecycle Manager depot in vCenter Server.

Prerequisites

n Set up an online depot to which the cluster can connect.

n Export an offline bundle with components from a vSphere Lifecycle Manager image and
import the offline bundle to the target local depot.

n Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For
Using Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 In the Image Compliance card, click the horizontal ellipsis icon and select Manage depot
overrides.

The Manage depot overrides dialog box appears.

VMware, Inc. 124

Managing Host and Cluster Lifecycle

4 Select your task.

Option Description

Add depot overrides Enter a URL or a file path to a local depot and click Add.
The depot is added to the Depot override URL list.

Delete a depot override Click the horizontal ellipsis icon for a depot override from the list and click
Delete.
The depot is removed from the Depot override URL list.

5 Click Close .

Results

In the Image Compliance pane, you see a notification if depot overrides are active for the cluster.

VMware, Inc. 125

Switching from Baselines to
Images 10
In vSphere 7.0, you can manage a cluster with either baselines or images. You cannot use both at
the same time for a single cluster. Even if you did not set up an image for the cluster during the
cluster creation, you can at any time switch from using baselines to switching images for the
cluster.

To switch to vSphere Lifecycle Manager images, you must set up a new image or import an
existing one. Before you proceed with setting up or importing an image, vCenter Server checks
and reports if the cluster is eligible for using images. For more information about cluster eligibility,
see Cluster Eligibility to Use vSphere Lifecycle Manager Images.

With standalone hosts, you can only use baselines. For more information about the difference
between baselines and images, see Chapter 3 vSphere Lifecycle Manager Baselines and Images.

Requirements
To switch to using images, the cluster must meet multiple requirements.

n All ESXi hosts in the cluster must be of version 7.0 and later.

n All ESXi hosts in the cluster must be stateful.

A stateful install is one in which the the host boots from a disk.

n No host in the cluster can contain any unknown components.

If a host is of version earlier than 7.0, you must first use an upgrade baseline to upgrade the host
and then you can successfully switch to using images. For more information about using
baselines for host patching and upgrade operations, see Chapter 8 Using Baselines and Baseline
Groups .

For more information about converting a stateless host into a stateful host, find information
about Auto Deploy in the VMware ESXi Installation and Setup documentation.

VMware, Inc. 126

Managing Host and Cluster Lifecycle

Specifics
Several behavioral specifics exist when you switch to using vSphere Lifecycle Manager images.

n If you switch to using images, you cannot revert to using baselines for the cluster. You can
move the hosts to a cluster that uses baselines, but you cannot change a cluster that already
uses a single image for management purposes.

n When you set up and save an image for a cluster, the image is not applied to the hosts in the
cluster unless you remediate the hosts. The mere action of changing the management
method does not alter the hosts in the cluster.

n After you set up an image for the cluster and remediate the hosts in the cluster against the
image, standalone VIBs are deleted from the hosts.

n After you set up an image for the cluster and remediate the hosts in the cluster against the
image, non-integrated solution agents are deleted from the hosts.

Before you switch to using vSphere Lifecycle Manager images, learn what the new functionality
lets you do and what the differences between using baselines and using images are.

Using Baselines Using Images

Validation Not supported. Supported.

You do not validate a baseline before You can validate a vSphere Lifecycle
applying the updates to the hosts. Manager image to check if it is
You can only perform a remediation applicable to all hosts in the cluster.
pre-check. You can also perform a remediation
pre-check.

Compliance checks With baselines, you can check the With vSphere Lifecycle Manager
compliance of an object against a images, you can check the compliance
single or against multiple baselines. of the hosts against a single image. To
check the compliance against another
image, you must first set up the new
image.

Staging You can stage updates to the hosts Not supported.

before actually installing them.

Remediation With vSphere Lifecycle Manager With vSphere Lifecycle Manager

baselines, you can remediate an images, you can add, remove, or
object against a single baseline or modify the components in the image
against multiple baselines. So, with a that you use for a cluster. When you
single operation, you can patch and remediate the hosts against the new
upgrade a host. image, all modified components are
applied to the host. So, you can
upgrade and patch a host with a single
remediation operation.

VMware, Inc. 127

Managing Host and Cluster Lifecycle

Using Baselines Using Images

Firmware updates Not supported. With vSphere Lifecycle Manager

images, firmware updates are carried
out through firmware and drivers add-
ons, which you add to the image that
you use to manage a cluster. Updating
firmware with images requires an OEM-
provided hardware support manager
plug-in, which integrates with vSphere
Lifecycle Manager.

Hardware compatibility checks Not supported. You can check the hardware
compatibility of the hosts in a cluster
against the VMware Compatibility
Guide (VCG).
You can also check the compatibility of
all hosts in a vSAN-enabled cluster
against the vSAN Hardware
Compatibility List (vSAN HCL).

Software recommendations Not supported. Supported.

Based on the hardware of the hosts in
the cluster, you get recommendations
about available and applicable ESXi
updates or upgrades.

vCenter Server /Datacenter-level With vSphere Lifecycle Manager With vSphere Lifecycle Manager
operations baselines, you can trigger any of the images, you cannot operate at a
main operations at the vCenter vSphere Lifecycle Manager or data
Server or data center level. center level.

Virtual machine management You can upgrade the VMware Tools You can upgrade the VMware Tools
and virtual hardware versions of the and virtual hardware versions of the
virtual machines in a cluster that you virtual machines in a cluster that you
manage with vSphere Lifecycle manage with vSphere Lifecycle
Manager baselines. Manager images.

Update Manager Download Service Supported. Supported.

(UMDS)

This chapter includes the following topics:

n Cluster Eligibility to Use vSphere Lifecycle Manager Images

n Set Up a New Image

n Import an Existing Image

Cluster Eligibility to Use vSphere Lifecycle Manager Images

Switching from baselines to images requires that you set up or import a vSphere Lifecycle
Manager image to manage the cluster with. As part of the transition, before you set up the
image, vCenter Server triggers an automatic task that checks whether the cluster is eligible to
use vSphere Lifecycle Manager images.

VMware, Inc. 128

Managing Host and Cluster Lifecycle

The Check cluster's eligibility to be managed with a single image task ensures that the cluster is
not undergoing remediation against a baseline and checks whether all requirements for using
vSphere Lifecycle Manager images are met.

Also, the task checks for standalone VIBs and ensures that no unintegrated solutions are enabled
for the cluster.

You cannot switch to vSphere Lifecycle Manager images if unintegrated solutions are enabled on
the cluster. With the following unintegrated solutions you can use vSphere Lifecycle Manager
baselines only.

n VMware NSX ® for vSphere ®

n VMware NSX-T™ Data Center

n VMware vSphere Replication

n vSphere with Kubernetes

n Dell EMC VxRail

n vSAN file services

The task returns three types of notifications: error, warning, and info.

Errors
The Check cluster's eligibility to be managed with a single image task reports an error if the
cluster contains at least one host that is not stateful or that is not of a compatible ESXi version,
that is 7.0 and later.

Also, the Check cluster's eligibility to be managed with a single image returns an error if the
cluster contains VIBs of unintegrated solutions, for example NSX. In that case, you must disable
the unintegrated solution and retry the transition.

Warnings
The Check cluster's eligibility to be managed with a single image task issues a warning if the
cluster contains at least one host with a standalone VIB or an unknown VIB. Warnings do not
block the transition to using vSphere Lifecycle Manager images, but they require special attention
or a user action.

For example, you see a warning notification if a host in the cluster contains a standalone VIB, for
example a driver, for which a component is available in the vSphere Lifecycle Manager depot. If
you want to keep the VIB, you must add the respective component to the vSphere Lifecycle
Manager image. Otherwise, the standalone VIB is deleted upon remediation.

You also get a warning if a host in the cluster contains an unknown VIB. Unknown VIBs are
standalone VIBs for which no component is available in the vSphere Lifecycle Manager depot. If
vSphere Lifecycle Manager detects an unknown VIB, you must import a component that contains
the VIB into the vSphere Lifecycle Manager depot and restart the transition. Otherwise, the
unknown VIB is deleted upon remediation.

VMware, Inc. 129

Managing Host and Cluster Lifecycle

Info
The Check cluster's eligibility to be managed with a single image task gives an info notification
if the cluster contains at least one host with a standalone VIB, but you can still proceed to setting
up a vSphere Lifecycle Manager image for the cluster without any additional actions.

For example, you see an info notification if the cluster is enabled for an integrated solution, for
example vSphere HA or vSAN.

Set Up a New Image

To take advantage of all new functionalities that vSphere Lifecycle Manager introduces in
vSphere 7.0, you must switch to using vSphere Lifecycle Manager images instead of baselines.

If you switch to using images, you cannot revert to using baselines for the cluster. You can move
the hosts to another cluster, which uses baselines, but you cannot change the cluster that
already uses a single image.

For conceptual information about vSphere Lifecycle Manager images, see vSphere Lifecycle
Manager Images .

For information about how to use vSphere Lifecycle Manager images to manage hosts and
cluster, see Chapter 9 Using Images .

Prerequisites

n Verify that all ESXi hosts in the cluster are of version 7.0 and later.

n Verify that all ESXi hosts in the cluster are stateful. A stateful install is one in which the the
host boots from a disk.

n Verify that all ESXi hosts in the cluster are from the same hardware vendor.

n Verify that no unintegrated solution is enabled for the cluster.

n Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For
Using Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with baselines and baseline
groups.

2 On the Updates tab, click Image.

3 Click the Set up image button.

vSphere Lifecycle Manager starts checking if the cluster is eligible for using images. If no
problems are reported, the Convert to an Image pane appears.

4 If the Check cluster's eligibility to be managed with a single image tasks reports an error or
a warning that requires an action, resolve the issue and restart the procedure.

5 From the ESXi Version drop-down menu, select an ESXi image.

VMware, Inc. 130

Managing Host and Cluster Lifecycle

6 (Optional) Add a vendor add-on to the image.

a Click Select.

The Select Vendor Addon appears.

b Select an add-on from the list.

An information panel appears on the right. The information panel shows information
about the components that the add-on adds to the ESXi image and the components that
it removes from the image.

c From the Version drop-down menu for the selected add-on, select the add-on version.

d Click Select.

7 (Optional) Add a firmware and drivers add-on to the image.

a Click Select.

The Select Firmware and Drivers Addon appears.

b Select a hardware support manager from the respective drop-down menu.

A list of firmware and drivers add-ons appears.

c Select an add-on from the list.

An information panel appears on the right. The information panel shows information
about the supported ESXi versions and whether the add-on contains a driver or not.

d From the Version drop-down menu for the selected add-on, select the add-on version.

e Click Select.

8 (Optional) Add additional components to the image.

a Click Show details.

b Click Add components.

The Add Components dialog box appears.

c (Optional) Use the Show drop-down menu to sift out the components that are not part of
the selected vendor add-on.

d Select one or multiple components from the list.

An information panel appears on the right. The information panel shows information
about the component that you selected first.

e From the Version drop-down menu for the selected component, select the component
version.

f Click Select.

The selected components appear in the list of components that the image contains. You
can use the Show drop-down menu to sift out the additional components.

g (Optional) Click Hide details to hide the list of components.

VMware, Inc. 131

Managing Host and Cluster Lifecycle

9 (Optional) To validate the image, click the Validate button.

You validate an image to check for missing dependencies and component conflicts.

10 Click Save.

Saving the image triggers an automatic compliance check. All hosts in the cluster are checked
against the image.

11 In the Convert to an Image pane, finish the image setup.

a Click the Finish image setup button.

b In the Finish image setup dialog box, click Yes, finish image setup.

Results

You set up an image for the cluster. You now manage all hosts in the cluster collectively with a
single image for the cluster. Upon remediation, the image is installed on all hosts in the cluster.

What to do next

To apply the image to all hosts in the cluster, remediate the cluster against the image.

Import an Existing Image

To take advantage of all new functionalities that vSphere Lifecycle Manager introduces in
vSphere 7.0, you must switch to using vSphere Lifecycle Manager images instead of baselines.

If you switch to using images, you cannot revert to using baselines for the cluster. You can move
the hosts to another cluster, which uses baselines, but you cannot change the cluster that
already uses a single image.

For conceptual information about vSphere Lifecycle Manager images, see vSphere Lifecycle
Manager Images .

For information about how to use vSphere Lifecycle Manager images to manage hosts and
clusters, see Chapter 9 Using Images .

Prerequisites

n Verify that all ESXi hosts in the cluster are of version 7.0 and later.

n Verify that all ESXi hosts in the cluster are stateful. A stateful install is one in which the the
host boots from a disk.

n Verify that all ESXi hosts in the cluster are from the same hardware vendor.

n Verify that no unintegrated solution is enabled for the cluster.

n Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For
Using Images.

VMware, Inc. 132

Managing Host and Cluster Lifecycle

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with baselines and baseline
groups.

2 On the Updates tab, click Image.

3 Click the Import Image button.

The Import Image dialog box appears.

4 Select a JSON file to import and click Next.

n Click the Browse button and select a JSON file on your local machine.

n Enter a valid URL to a JSON file on a remote web server.

vSphere Lifecycle Manager starts checking if the cluster is eligible for using images. If no
problems are reported, the Convert to an Image pane appears. The elements of the
imported image appear in the Define Image card.

5 (Optional) Customize the imported image by changing any of its elements.

6 (Optional) To validate the image, click the Validate button.

You validate an image to check for missing dependencies and component conflicts.

7 Click Save.

Saving the image triggers an automatic compliance check. All hosts in the cluster are checked
against the image.

8 In the Convert to an Image pane, finish the image setup.

a Click the Finish image setup button.

b In the Finish image setup dialog box, click Yes, finish image setup.

Results

You now manage all hosts in the cluster collectively with a single image for the cluster. Upon
remediation, the image is installed on all hosts in the cluster.

What to do next

To apply the image to all hosts in the cluster, remediate the cluster against the image.

VMware, Inc. 133

Recommended Images
11
For the clusters that you manage with images, vSphere Lifecycle Manager can generate and
provide you with software recommendations in the form of pre-validated images that are
compatible with the hardware of the hosts in a cluster. Recommended images are valid images
that are based on the latest ESXi major or minor release.

When you set up or edit an image, you manually combine the image elements (ESXi version,
vendor add-on, firmware add-on, and additional components) in such a way as to define the full
software stack to run on all hosts in the cluster. You must manually check whether a particular
image set-up is complete and valid, and suitable to your environment. The vSphere Lifecycle
Manager recommendations save you the effort of exploring the possible and applicable
combinations of image elements.

Recommended images are validated through a series of checks that ensure that a recommended
image has no missing dependencies or conflicting components. For vSAN clusters, the validation
also runs a hardware compatibility check against the vSAN Hardware Compatibility List (vSAN
HCL). The extensive validation checks ensure that if you decide to use a recommended image for
a cluster, the remediation against the recommended image is successful.

To generate recommendations, vSphere Lifecycle Manager checks what software is available in

the vSphere Lifecycle Manager depot and what firmware is available in the depot that the
selected hardware support manager makes available. Based on the available software, firmware,
and, for vSAN clusters, the hardware compatibility checks, for each cluster that you manage with
a single image, vSphere Lifecycle Manager provides you with up to two recommended images.

n Latest image

The latest image contains the latest major ESXi version. For example, if the current image for
a cluster contains a base image of version ESXi 7.0 and base images of version 7.5 and 8.0
are available in the vSphere Lifecycle Manager depot, the latest image recommendation
contains ESXi version 8.0.

n Latest image in the current series

The latest image in a series contains the latest minor ESXi. For example, if the current image
for a cluster contains a base image of version ESXi 7.0 and base images of version 7.0a, 7.0
U1, 7.5, and 8.0 are available in the vSphere Lifecycle Manager depot, the latest image in the
current series recommendation contains ESXi version 7.0 U1.

VMware, Inc. 134

Managing Host and Cluster Lifecycle

The ESXi version in a recommended image might be the same as the ESXi version in the current
image for a cluster. But the recommended image might contain a later version of the vendor add-
on, component, or firmware add-on.

Sometimes, the latest ESXi version available in the depot might not be recommended, because it
causes hardware compatibility issues. In that cases, vSphere Lifecycle Manager reports that no
recommended images are available for the cluster.

You can replace the current image of a cluster with one of the recommended images for that
cluster.

Starting with vSphere 7.0, ESXi releases have the following naming format:

n General Availability: 7.0

n Update: 7.0 U1, 7.0 U2

n Patch: 7.0 a / 7.0 b

n Security patch: 7.0 sa, 7.0 sb

n Patch after update: 7.0 U1 a, 7.0 U1 sa, 7.0 b, 7.0 sb

This chapter includes the following topics:

n Check for Recommended Images

n Use a Recommended Image

Check for Recommended Images

By using recommended images for your clusters, you ensure that your environment runs the
latest verified software. Because the recommendations that vSphere Lifecycle Manager
generates for a cluster are not automatically updated when the cluster changes or when new
software is available in the vSphere Lifecycle Manager depot, you must periodically perform the
check for recommendations task.

A recommended image contains updates for your cluster. Recommendations are based on the
ESXi versions available in the vSphere Lifecycle Manager depot. When you trigger the check for
recommendations task, vSphere Lifecycle Manager first determines the recommended ESXi
versions for the cluster. After that, vSphere Lifecycle Manager checks sequentially for newer
versions of the vendor add-on, additional components, and firmware add-on that are compatible
with the recommended ESXi version and the hardware of the hosts in the cluster. So, sometimes,
a recommended image might contain the same ESXi version as the ESXi version in the current
image for the cluster but combined with an updated vendor add-on, component, or firmware
add-on.

The check for recommendation task is non-cancellable. You must rerun the task periodically to
ensure that the recommendations are valid and still suitable to the cluster.

VMware, Inc. 135

Managing Host and Cluster Lifecycle

Before you check for recommended images, you must ensure that the cluster is not being
remediated. Recommendations generation and remediation are mutually exclusive operations.
They cannot run simultaneously.

Prerequisites

n Verify that remediation is not running for the cluster.

n Verify that you have connection to the Internet.

n Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For
Using Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 In the Image card, click the horizontal ellipsis icon and select Check for recommended
images.

When the task finishes, a blue badge appears in the Image card.

4 To view the recommended images, click the horizontal ellipsis icon and select View
recommended images.

Results

vSphere Lifecycle Manager generates recommendations. vSphere Lifecycle Manager might list up
to two recommended images applicable to the cluster. Sometimes, no recommended images are
available. In such cases, vSphere Lifecycle Manager displays detailed information about why no
recommendations are available.

What to do next

View the recommendations. You can import a recommended image to the cluster and replace
the current image that the cluster uses. See Use a Recommended Image.

Use a Recommended Image

For any cluster that you manage with a single image, you can view the images that vSphere
Lifecycle Manager recommends and you can replace the current image for the cluster with a
recommended image. Using recommended images saves you the time and effort of identifying
valid images that are applicable to all hosts in a cluster.

Prerequisites

n Check for recommended images for a cluster. See Check for Recommended Images.

n Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For
Using Images.

VMware, Inc. 136

Managing Host and Cluster Lifecycle

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 In the Image card, click the horizontal ellipsis icon and select View recommended images.

If the View recommended images option is dimmed, no recommended images are available
for this cluster.
Sometimes, even if newer versions of ESXi are available in the vSphere Lifecycle Manager
depot, they are not included in a recommended image because of hardware compatibility
issues.

The Recommended Images dialog box appears.

4 In the Recommended Images dialog box, select a recommended image by clicking the
respective radio button and click Continue.

Option Description

Latest in current series The recommended image is based on the latest ESXi version in the current
series of releases. For example, if the ESXi version in your current image is
7.0, this option might include ESXi version 7.0 Update 1 and a related vendor
add-on.

Latest and greatest The recommended image is based on the latest major ESXi version. For
example, if the ESXi version in your current image is 7.0, this option might
include ESXi version 8.0 and a related vendor addon.

The selected image is imported to the cluster as a draft. The Edit Image card appears.

5 (Optional) Edit the image and validate the new image set-up.

6 Click Save.

If you do not save the image, it is saved as a draft. The next time you start editing the image
for that cluster, you can use the draft as a starting point.

Results

The recommended image is saved for that cluster. If a draft exists for the cluster, the draft is
overriden by the recommended image. No software is installed on the hosts in the cluster at this
stage.

What to do next

To apply the software specification that the image defines, remediate the cluster against the new
image. See Run a Remediation Pre-Check and Remediate a Cluster Against a Single Image.

VMware, Inc. 137

Firmware Updates
12
You can use vSphere Lifecycle Manager images to perform firmware updates on the ESXi hosts
in a cluster. Using vSphere Lifecycle Manager images simplifies the host update operation. With a
single operation, you update both the software and the firmware on the host.

In earlier vSphere releases, you could perform firmware updates on vSAN clusters by using
system-managed baselines. For non-vSAN clusters, firmware updates had to be manual.

Starting with vSphere 7.0, you can easily update the firmware in any cluster that you manage
with a single image. Firmware updates are not available for clusters that you manage with
baselines.

To apply firmware updates to the hosts in a cluster that you manage with a single image, you
must include a special type of add-on, the firmware and drivers add-on, in the image and
remediate the cluster to apply the image to all hosts. The firmware and drivers add-on is a
vendor-provided add-on that contains the components that encapsulate firmware update
packages. The firmware and drivers add-on might also contain the necessary drivers.

Unlike vendor add-ons, firmware and drivers add-ons are not distributed through the official
VMware online depot or as offline bundles available at my.vmware.com. For a given hardware
vendor, firmware updates are available in a special vendor depot, whose content you access
through a software module called a hardware support manager. The hardware support manager
is a plug-in that registers itself as a vCenter Server extension. Each hardware vendor provides
and manages a separate hardware support manager that integrates with vSphere. For each
cluster that you manage with a single image, you select the hardware support manager that
provides the firmware updates for the cluster. After you determine the hardware support
manager that you want to use for a cluster, the hardware support manager provides you with a
list of the available firmware updates. When you select and include a firmware add-on to an
image, that add-on might modify the specified image by adding or removing components. The
firmware add-on also defines the firmware versions to be installed on the hosts. During
remediation, vSphere Lifecycle Manager applies the image to the hosts and requests the selected
hardware support manager to update the firmware on the hosts in accordance with the firmware
add-on specified in the image.

VMware, Inc. 138

Managing Host and Cluster Lifecycle

Selecting a hardware support manager and including a firmware add-on in your image
guarantees that during a compliance check, vSphere Lifecycle Manager also determines the
firmware compliance for the cluster. So, you can easily detect and remediate any unwanted
drifts. The hardware support manager is also responsible for retrieving the firmware versions on
the host hardware, and, in some cases, determining the appropriate drivers for the updated
firmware version.

For vSAN clusters, the hardware support manager inspects the hosts in the cluster to determine
their current I/O device controllers and firmware. During a hardware compatibility check for the
cluster, vSphere Lifecycle Manager checks whether the firmware in the image is compatible with
the hardware in the cluster as per vSAN Hardware Compatibility List (vSAN HCL). The hardware
compatibility check ensures that when vSphere Lifecycle Manager remediates the cluster and
applies the image to all hosts, the firmware and drivers on the hosts are certified for use with
vSAN.

This chapter includes the following topics:

n Deploying Hardware Support Managers

n Use an Image for Firmware Updates

Deploying Hardware Support Managers

The deployment method and the management of a hardware support manager plug-in is
determined by the respective OEM.

In vSphere 7.0, you can deploy and use hardware support managers from the following vendors.

n Dell

The hardware support manager that Dell provides is part of their host management solution,
OpenManage Integration for VMware vCenter (OMIVV), which you deploy as an appliance.

n HPE

The hardware support manager that HPE provides is part of their management tool, iLO
Amplifier, which you deploy as an appliance.

Deploying and Configuring Hardware Support Managers

Regardless of the hardware vendor, you must deploy the hardware support manager appliance
on a host with sufficient disk space. Hardware support manager appliances are distributed as
OVF or OVA templates. You might deploy them on any host in any vCenter Server server.

After you deploy the appliance, you must power on the appliance virtual machine, log in to the
appliance as an administrator, and register the appliance as a vCenter Server extension. Each
hardware support manager might register with only one or multiple vCenter Server systems.

VMware, Inc. 139

Managing Host and Cluster Lifecycle

A vCenter Server plug-in UI might become available in the vSphere Client after you deploy a
hardware support manager appliance, but the hardware support manager might also have a
separate user interface of its own. In vSphere 7.0, both OMIVV and iLO Amplifier have a vCenter
Server plug-in UI, which helps you configure and work with the respective hardware support
manager.

Each hardware support manager has its own mechanism of managing the actual firmware
packages and making firmware add-ons available for you to choose.

The successful integration between the hardware support manager and vSphere Lifecycle
Manager might require a specific configuration of the hardware support manager. For example,
with OMIVV, you must first create a connection profile. Then, you must create a cluster profile
and associate it with a cluster before you can add a firmware add-on from Dell to the image for
that cluster. For detailed information about deploying, configuring, and managing hardware
support managers, refer to the OEM-provided documentation.

Use an Image for Firmware Updates

vSphere Lifecycle Manager allows you to manage the firmware lifecycle on ESXi hosts that are
part of a cluster that you manage with a single image.

Prerequisites

n Deploy the vendor-provided hardware support manager and register it as a vCenter Server
extension. For more information about deploying and managing a hardware support
manager, see the respective OEM documentation.

n If you use the hardware support manager provided by Dell, create a cluster profile and
associate it with the cluster. For more information , review the OpenManage Integration for
VMware vCenter (OMIVV) documentation.

n Verify that all hosts in the cluster are from the same vendor.

n Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For
Using Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Image.

3 In the Image card, click the Edit button.

4 In the Edit Image card, for the Firmware and Drivers Addon, click Select.

The Firmware and Drivers Addon dialog box appears.

VMware, Inc. 140

Managing Host and Cluster Lifecycle

5 In the Firmware and Drivers Addon dialog box, select a hardware support manager from the
drop-down menu.

The selected hardware support manager must be from the same hardware vendor as the
hosts in the cluster. Otherwise, during a compliance check, the hardware support manager
reports the selected firmware and drivers add-on to be incompatible with the host or hosts
that are from a different vendor. Firmware remediation fails.

A list of all available firmware add-ons appears.

6 Select a firmware add-on from the list.

An information panel appears on the right. The panel contains information about the
supported ESXi versions and whether the selected add-on contains the necessary drivers.

7 Click Select.

The selected firmware and drivers add-on is included in the image.

8 In the Image card, validate and save the image.

After the image is saved, a compliance check against the new image is triggered for the
cluster.

9 In the Image Compliance card, review the compliance check results for the cluster and for
each host.

10 If any host in the cluster has firmware that is non-compliant with the new image firmware,
remediate the respective host or the cluster.

a (Optional) In the Image Compliance card, run a remediation pre-check to ensure that
remediation finishes successfully.

n To run a pre-check for all hosts in the cluster, click the Run Pre-check button.

n To run a pre-check for a single host, click the vertical ellipsis icon for the host and
select Run Pre-check.

b In the Image Compliance card, initiate remediation.

n To remediate all hosts in the cluster, click the Remediate All button.

During cluster remediation, if the remediation of a single host fails, the remediation for
the cluster ends prematurely.

n To remediate a single host, click the vertical ellipsis icon for the host and select
Remediate.
You are not obliged to start remediation immediately after setting up an image for a cluster.
However, nothing is installed on the hosts unless you remediate them against the image for
the cluster. The firmware on the hosts is actually updated only after successful remediation.
You can remediate the objects in your environment at any time that is convenient for you.

VMware, Inc. 141

Managing Host and Cluster Lifecycle

Results

The firmware on the hosts in the cluster is updated to the firmware version specified in the
firmware add-on for the image.

VMware, Inc. 142

Hardware Compatibility Checks
13
vSphere Lifecycle Manager automates the process of validating the hardware compliance of
hosts and clusters against a selected ESXi version. Hardware compatibility checks ensure that the
host or cluster hardware is compliant with the VMware Compatibility Guide (VCG) and vSAN
Hardware Compatibility List (vSAN HCL).

VCG and vSAN HCL

Hardware compatibility lists are lists of hardware certified for use with various vSphere releases.
VCG contains information about server models and I/O devices that are certified for use with
particular vSphere releases. Besides VCG, vSAN maintains a separate hardware compatibility list
that lists all I/O device controller hardware and the respective firmware versions certified for use
with vSAN.

With vSphere Lifecycle Manager, you can perform the following tasks.

n Check the hardware compatibility of a single host

The hardware compatibility check for a host validates the server model and the host I/O
devices against the current or future ESXi version. The check is performed against the VCG or
the vSAN HCL.

n Check the hardware compatibility of a vSAN cluster

The hardware compatibility check for a cluster validates only the I/O devices against the
software specification in the image for the cluster. Unless all hosts are remediated against
that image, the hardware compatibility check might not reflect accurately their current status.
The hardware compatibility check for a cluster is performed against the vSAN HCL only.

Hardware incompatibility does not prevent remediation and is not resolved upon remediation.

Hardware Compatibility Checks for Clusters

In vSphere 7.0, you can check the compatibility between a vSphere Lifecycle Manager image and
the underlying hardware of the hosts in the respective cluster. Checking the hardware
compatibility of your clusters before remediating them helps you avoid unsupported and
unwanted configurations.

VMware, Inc. 143

Managing Host and Cluster Lifecycle

When you run a hardware compatibility check at the cluster level, vSphere Lifecycle Manager
checks for potential hardware compatibility issues between the storage controllers of the hosts in
the cluster and the software specification defined in the image for that cluster. The compatibility
check is performed against the vSAN HCL. Hardware compatibility checks are available only for
vSAN clusters that you manage with a single image.

If a vSAN cluster uses baselines, hardware compatibility checks are not available. Also, if a cluster
uses a single vSphere Lifecycle Manager image but vSAN is not enabled for that cluster,
hardware compatibility checks for that cluster are also not available.

Hardware Compatibility Checks for Hosts

With vSphere Lifecycle Manager, you can perform a hardware compatibility check for a single
host. The hardware compatibility check ensures that the host hardware, that is server model and
I/O devices, is certified for use with a selected ESXi version. The hardware compatibility check for
a host is performed against the VCG, unless the host is in a vSAN cluster.

Note If the host is in a vSAN cluster, the hardware compatibility of the I/O devices that are used
by vSAN is checked against the vSAN HCL. All other I/O devices are checked against the VCG.

You can check the hardware compatibility of any host, whether it is in a cluster that uses a single
image or baselines. You can also check the hardware compatibility of a standalone host.

This chapter includes the following topics:

n Check the Hardware Compatibility of a Cluster

n Check the Hardware Compatibility of a Host

Check the Hardware Compatibility of a Cluster

For a vSAN cluster that you manage with a single image, you can check the compliance of the
image components with the hardware in the cluster. The check is performed against the vSAN
Hardware Compatibility List (vSAN HCL) and ensures that if the image is applied to the hosts, the
result after remediation is in accordance with vSAN HCL.

When you initiate a hardware compatibility check for a cluster, vSphere Lifecycle Manager
verifies that the components in the image are compatible with all storage controllers on the hosts
in the cluster as per vSAN HCL. vSphere Lifecycle Manager scans the image and checks whether
the physical I/O device controllers are compatible with the ESXi version specified in the image.
The task also checks whether the driver and firmware versions that are specified in the image are
compatible with the cluster hardware as per vSAN HCL.

Hardware compatibility issues are reported as warnings, but they do not prevent you from
remediating the hosts in the cluster against the image.

VMware, Inc. 144

Managing Host and Cluster Lifecycle

During a hardware compatibility check for a cluster, vSphere Lifecycle Manager checks performs
the following tasks.

n Verifies that all storage device drivers are certified for the ESXi version specified in the image.

n Verifies that the image contains the correct driver and firmware versions as per vSAN HCL.

n Suggests a compatible driver version for the cluster as per vSAN HCL.

To perform a hardware compatibility check for a vSAN cluster, the HCL data that is available
vSphere Lifecycle Manager must be up to date. For more information about updating the vSAN
HCL data, see the vSAN documentation.

Prerequisites

n Verify that vSAN is enabled for the cluster.

n Verify that the cluster uses a single image.

n Verify that all hosts in the cluster are from the same vendor.

n To validate the compatibility between the I/O device hardware and the firmware version,
verify that the image for the cluster includes a firmware add-on.

n Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For
Using Images.

Procedure

1 In the vSphere Client, navigate to a cluster that you manage with a single image.

2 On the Updates tab, select Hosts > Hardware Compatibility.

In the Hardware Compatibility pane, you see the results from the previous compatibility
check.

3 In the Hardware Compatibility pane, click Run Checks.

Results

vSphere Lifecycle Manager displays all compatibility information and issues in the Hardware
Compatibility pane. You can see detailed compatibility information for each device by clicking it.
The information panel appears on the right.

What to do next

Review the result from the hardware compatibility check.

Resolve any issues before you remediate the cluster.

Check the Hardware Compatibility of a Host

You can heck the hardware compatibility of a host to determine whether the host hardware is
certified for use with a selected ESXi version. The hardware compatibility check is performed

VMware, Inc. 145

Managing Host and Cluster Lifecycle

against the VMware Compatibility Guide (VCG) or, if the host is in a vSAN cluster, against the
vSAN Hardware Compatibility List (HCL)

The hardware compatibility check that you initiate for a single host checks whether the server
and the physical devices on the host are Certified for use with a selected ESXi version. The check
is performed against the VCG.

Note If the host is in a vSAN cluster, the hardware compatibility of the I/O devices that are used
by vSAN is checked against the vSAN Hardware Compatibility List (HCL). All other I/O devices are
checked against the VCG.

After the check, vSphere Lifecycle Manager shows the status for the server and hardware
devices. The server and devices might have one of the three different states: compatible,
incompatible, and unknown. For more information about compatibility statuses, see Hardware
Compatibility Report for a Host.

If the server status is incompatible, vSphere Lifecycle Manager does not proceed with checking
the compatibility for the hardware devices.

Prerequisites

n If needed, synchronize hardware compatibility data. See Sync Hardware Compatibility Data.

n Verify that the Customer Experience Improvement Program is enabled.

n Verify that vCenter Server is connected to the Internet.

n Verify that the host is not part of an VxRail environment.

n Verify that you have the proper privileges. See vSphere Lifecycle Manager Privileges For
Using Images.

Procedure

1 In the vSphere Client, navigate to a standalone host or a host in a cluster.

2 On the Updates tab, select Hosts > Hardware Compatibility.

3 In the Hardware Compatibility pane, select your task.

n To run a hardware compatibility check for the host for the first time, select a target ESXi
from the drop-down menu and click Apply.

n To check the hardware compatibility between the host and the already selected target
ESXi version, click Re-run Checks.

n To choose a new target ESXi version for the hardware compatibility check, click Edit and
select a new target ESXi version.

n To export the hardware compatibility report in a CSV format, click the Export button.

VMware, Inc. 146

Managing Host and Cluster Lifecycle

Results

vSphere Lifecycle Manager displays the result from the compatibility check. You can see a list of
the compatible, incompatible, and unknown devices. For each device, you can see full details by
clicking the expand button.

Sync Hardware Compatibility Data

To initiate a hardware compatibility check for a host, the hardware compatibility data from
VMware Compatibility Guide (VCG) must become available to vSphere Lifecycle Manager.

Synchronizing compatibility ensures that the compatibility information from VCG becomes
available to vSphere Lifecycle Manager. The synchronization task is not automated. When no
compatibility data is available for use to vSphere Lifecycle Manager, you must trigger the
compatibility data synchronization manually.

vSAN HCL data is not updated through synchronization. If you want to check the hardware
compatibility of a host that is in a vSAN cluster, you must first verify that vSAN HCL data is up to
date. For more information about updating vSAN HCL data, see the vSAN documentation.

Procedure

1 In the vSphere Client, navigate to a standalone host or a host in a cluster.

2 On the Updates tab, select Hosts > Hardware Compatibility.

3 In the Hardware Compatibility pane, click Sync compatibility data.

4 In the Sync hardware compatibility data dialog box, click Go to Lifecycle Manager.

You are redirected to the vSphere Lifecycle Manager home view.

5 Select Actions > Sync HCL.

The Update HCL data task appears in the Recent Taks pane.

Results

After the Update HCL data task finishes, the compatibility data from the VCG becomes available
to vSphere Lifecycle Manager.

What to do next

Check the hardware compatibility of your hosts against VCG before you update or upgrade them
to a later ESXi version.

Hardware Compatibility Report for a Host

The hardware compatibility report gives you information whether for a selected server model
and hardware devices, vSphere Lifecycle Manager finds records for a target ESXi version in the
VMware Compatibility Guide (VCG).

VMware, Inc. 147

Managing Host and Cluster Lifecycle

Server Hardware Compatibility

Host Model is Not Compatible

This compatibility status indicates that there are no records for the selected ESXi version in
the VCG. If the host is not compatible with the selected ESXi version, vSphere Lifecycle
Manager does not proceed to checking the compatibility of the devices.

In the Host Model Compatibility card, you can see details about the host: server model
name, CPU model, and the BIOS version running on the host. At the bottom of the card, you
see a list of all certified CPU series for the target ESXi version.

Host Model is Compatible

This compatibility status indicates that the host is certified for use with the selected ESXi
version as per VCG. When the host is compatible, vSphere Lifecycle Manager proceeds with
the device validation.

In the Host Model Compatibility card, you can see details about the host: server model
name, CPU model, and the BIOS version running on the host. Because in VCG the information
about CPUs is based on CPU series, and not specific models, you might need to manually
check if the CPU of the host is part of the supported CPU series. You might also need to
manually check if the BIOS version on the host matches any of the compatible BIOS versions
for the CPU series as per VCG.

Hardware Compatibility Checks Not Supported for the Host Vendor Model

When the server model is not part of the list of certified OEMs, vSphere Lifecycle Manager
does not perform a hardware compatibility check and you do not see a hardware
compatibility report for the selected host.

Device Hardware Compatibility

The compatibility statuses for devices are: compatible, incompatible, and unknown.

Unknown

Unknown devices are devices for which no records exist in VCG. When you click the expand
button for the device, you see the following device information: device IDs, driver and
firmware currently running on the device. No compatibility data is generated and displayed.

The unknown status might also indicate that multiple matches exist in the VCG for the
respective device. In such cases, use the device ID to manually check if the hardware device
matches any of the supported devices for the target ESXi version in the VCG.

Incompatible

The incompatible status indicates that no records exist in the VCG for the selected ESXi
version. When you click the expand button for the device, you see information about the
ESXi versions that are compatible with the device as per VCG.

Compatible

VMware, Inc. 148

Managing Host and Cluster Lifecycle

The compatible status indicates that the device is compatible with the selected ESXi version
as per VCG. When you click the expand button for the device, you see the following device
information: device IDs, driver and firmware currently running on the device. For compatible
devices, you might need to manually confirm that the driver-firmware combination running on
the device is supported as per VCG.

VMware, Inc. 149

vSAN Clusters and vSphere
Lifecycle Manager 14
Starting with vSphere 7.0, in addition to using baselines, you can also use images to manage the
hosts and clusters in your vSphere inventory. The introducion of images affects the way you
manage and work with vSAN clusters.

In earlier vSphere releases, you could update and upgrade the hosts in a vSAN cluster by using
system-managed baselines grouped in an automatically generated recommendation baseline
group. By using recommendation baseline groups, you could also perform firmware and driver
updates on the hosts in the cluster.

In vSphere 7.0, you can manage vSAN clusters with vSphere Lifecycle Manager baselines or
vSphere Lifecycle Manager images.

What's New in vSphere 7.0

When you manage a vSAN cluster with vSphere Lifecycle Manager baselines and baseline
groups:

n You can still use baselines and baseline group to manage vSAN clusters.

System-managed baseline groups are now called recommendation baseline groups.

Recommendation baseline groups no longer contain firmware and driver updates, but only a
patch baseline. For more information about using baselines to manage hosts and clusters, see
Chapter 8 Using Baselines and Baseline Groups .

n You cannot perform firmware updates by using a vendor-specific firmware tool and
remediating a cluster against the recommendation baselines that vSAN generates.

To update the firmware of a vSAN cluster, you must switch to using a single image instead of
baselines for that cluster. You must set up or import an image that contains a firmware add-
on and remediate the cluster against that image.

If an existing cluster contains ESXi hosts of versions earlier than 7.0, you must use an
upgrade baseline to upgrade the hosts before you can switch to using images for the cluster.

For more information about performing firmware updates by using vSphere Lifecycle
Manager images, see Chapter 12 Firmware Updates.

VMware, Inc. 150

Managing Host and Cluster Lifecycle

When you manage a vSAN cluster with a single image:

n The image can define the full software stack to run on the hosts in the cluster: ESXi version,
vendor customization, drivers, and firmware.

You set up an image for a cluster during cluster creation. If you do not set up an image during
cluster creation, the cluster uses baselines. You can switch to using images at any time,
provided the cluster is eligible for the transition. For more information about using vSphere
Lifecycle Manager images, see Chapter 9 Using Images .

n You can manually trigger a hardware compatibility check for the cluster.

The hardware compatibility check task verifies that the image for the cluster can be
successfully applied to all hosts and that it is compliant with the vSAN Hardware Compatibility
List (HCL). For more information about hardware compatibility checks, see Chapter 13
Hardware Compatibility Checks

n When you perform a compliance check against the image, firmware compliance is also
checked. As a result, you can easily notice if a driver or firmware in your cluster becomes
non-compliant. For more information about checking the compliance of a cluster against an
image, see Checking Compliance Against a Single Image.

n The recommendations that vSphere Lifecycle Manager generates in the form of pre-validated
images include a recommended firmware version for the hosts in your cluster. For more
information about vSphere Lifecycle Manager recommended images, see Chapter 11
Recommended Images.

This chapter includes the following topics:

n Remediation Specifics of vSAN Clusters

n Recommendation Baseline Groups

n Updating Firmware in vSAN Clusters

Remediation Specifics of vSAN Clusters

Whether you manage a vSAN cluster with baselines or with a single image, remediating the hosts
that are part of a vSAN cluster has its specifics.

When you remediate hosts that are part of a vSAN cluster, you must be aware of the following
behavior:

n Because vSphere Lifecycle Manager handles the remediation of the hosts sequentially, the
host remediation process might take an extensive amount of time to finish.

n By design, in a vSAN cluster, only one host at a time can be in maintenance mode.

n vSphere Lifecycle Manager remediates hosts that are part of a vSAN cluster sequentially.

VMware, Inc. 151

Managing Host and Cluster Lifecycle

Host Maintenance Mode and vSAN Clusters

You can remediate a host that is in a vSAN cluster in two ways, depending on how you want to
handle the virtual machines on the host:

n You can put the host in maintenance mode manually and remediate the host by using
vSphere Lifecycle Manager.

n You can have the host enter maintenance mode during the vSphere Lifecycle Manager
remediation process.

In the vSphere Client, when you put a host from a vSAN cluster into maintenance mode, you can
choose between multiple options: Ensure accessibility, Full data evacuation, and No data
evacuation. The Ensure accessibility option is the default option, and means that when you put a
host in maintenance mode, vSAN ensures that all accessible virtual machines on the host remain
accessible. To learn more about each of the options, see the "Place a Member of a vSAN Cluster
in Maintenance Mode" topic in the vSphere Storage documentation.

During remediation, vSphere Lifecycle Manager, puts the hosts from the vSAN cluster in
maintenance mode and handles the virtual machines on the host in the manner of the default
Ensure accessibility option.

If a host is a part of a vSAN cluster, and any virtual machine on the host uses a VM storage policy
with the setting for "Number of failures to tolerate=0", the host might experience unusual delays
when it enters maintenance mode. The delay occurs because vSAN has to migrate the virtual
machine data from one disk on the vSAN datastore cluster to another. Delays might take up to
hours. You can work around this by setting the "Number of failures to tolerate=1" for the VM
storage policy, which results in creating two copies of the virtual machine files on the vSAN
datastore.

vSAN Health Check

vSphere Lifecycle Manager performs a remediation pre-check of vSAN clusters to ensure
successful remediation. The vSAN health check is part of the remediation pre-check.

The vSAN health check gives you information about the cluster state and whether you must take
extra actions to ensure successful remediation. Even if you do not take the recommended
actions, you can still remediate the vSAN cluster or a host from the cluster. vSphere Lifecycle
Manager successfully puts the host in maintenance mode and applies software updates on the
host successfully. However, the host might fail to exit maintenance mode, and the remediation
process might fail. As a result, the host from the vSAN cluster is upgraded, but you must take
manual steps to take the host out of maintenance mode.

Recommendation Baseline Groups

vSAN creates system-managed baseline groups, called recommendation baseline groups. You
use recommendation baseline groups to upgrade the hosts in a vSAN cluster to the latest
supported ESXi version, to patch the hosts with critical patches, or to update drivers on the host.

VMware, Inc. 152

Managing Host and Cluster Lifecycle

vSAN generates recommendation baseline groups automatically. If your vSphere environment

does not contain any vSAN clusters, no recommendation baseline groups are generated.
vSphere Lifecycle Manager automatically attaches the recommendation baseline group to the
vSAN clusters in your environment. For each vSAN cluster in the vSphere inventory, vSphere
Lifecycle Manager displays a single recommendation baseline group. You cannot edit or delete a
recommendation baseline group and you cannot add it to custom baseline groups.

Recommendation baseline group can contain any of the following updates:

n Upgrade baseline that contains an ESXi upgrade image by a certified vendor with the latest
tested and recommended version for the vSAN cluster.

n Patch baseline that contains recommended critical patches for the ESXi version of the hosts
in the vSAN cluster.

n Recommended drivers for the ESXi hosts in the vSAN cluster.

Starting with vSphere 7.0, recommendation baseline groups no longer contain firmware updates.
To update the firmware on your hosts, you must convert to using a single image for the vSAN
cluster.

A vSAN recommendation engine regularly checks the current state of the software installed on
the hosts in the vSAN cluster against the vSAN Hardware Compatibility List (HCL). If update
recommendations are detected, the engine downloads all new critical patches and upgrade
images and generates a vSAN cluster-level baseline. All available baselines are packed together
in a recommendation baseline group and made available for use by vSphere Lifecycle Manager.

Every 24 hours, vSphere Lifecycle Manager runs an automatic check for a recommendation
baseline group with build recommendations coming from vSAN. If a new system baseline group is
detected, vSphere Lifecycle Manager automatically attaches the vSAN system baseline group to
the vSAN cluster.

After refreshing the vSAN recommendation baseline group, vSphere Lifecycle Manager
automatically performs a compliance check operation on the vSAN clusters against the updated
recommendation baseline group. Operations such as adding and removing hosts from an existing
vSAN cluster also trigger refresh of the attached recommendation baseline group, followed by a
compliance check.

System Requirements for Using vSAN Recommendation Baseline

Groups
n vCenter Server7.0.

vSphere Lifecycle Manager runs as a service in vCenter Server.

n vSAN cluster that contains hosts of ESXi version 6.0 Update 2 and later.

n Constant access of the vSphere Lifecycle Manager host machine to the Internet.

VMware, Inc. 153

Managing Host and Cluster Lifecycle

Updating Firmware in vSAN Clusters

Starting with vSphere 7.0, you can use vSphere vSphere Lifecycle Manager images to upgrade
the firmware of the servers that run in your vSAN clusters.

In a vSAN cluster, the SCSI controller firmware and the physical drive firmware are handling most
of the data communication. To ensure your vSAN cluster health, you must perform controller
firmware updates, when necessary.

Because firmware updates affect the hardware layer in your vSphere environment, they usually
are rare events. Firmware updates occur during initial ESXi host setup or during major updates of
vSphere or vSAN.

In earlier vSphere releases, firmware updates were delivered as baselines in the vSAN-managed
baseline group. You had to use a special vendor-provided tool that vSAN used to detect,
download, and install firmware updates.

In vSphere 7.0, the recommendation baseline group contains only patch updates and driver
updates. It no longer contains firmware updates. As a result, you cannot use baselines to update
the firmware in your vSAN clusters. To perform firmware updates on hosts that are in a vSAN
cluster, you must manage that cluster with a single image. You must also deploy an OEM-
provided hardware support manager and register it as a vCenter Server extension. The hardware
support manager inspects the hardware of the hosts in the cluster and lists available and
compatible firmware versions, which you can add to the image for the cluster. The actual
firmware update happens upon remediating the cluster against an image that contains a firmware
add-on.

For more information about the requirements for using images, see vSphere Lifecycle Manager
Requirements and Specifics.

For more information about performing firmware updates by using images, see Chapter 12
Firmware Updates.

VMware, Inc. 154

Backup and Restore Scenarios
When Using vSphere Lifecycle
Manager
15
Restoring a vCenter Server instance from a backup might impact the clusters in your environment
in a seemingly unexpected way. Whether you use images or baselines to manage your clusters,
vSphere Lifecycle Manager behaves in a specific manner during backup and restore operations.

When you back up a vCenter Server instance, you create a backup copy of all clusters in that
vCenter Server instance.

Restoring vCenter Server After Switching from Baselines to

Images for Cluster Lifecycle Management
Cluster A is a cluster that you manage by using baselines. You back up the vCenter Server
instance where the cluster is. After the backup, you switch from using baselines to using images
to manage cluster A and you remediate the cluster to apply the image to the hosts in the cluster.
You now manage the lifecycle of cluster A by using a single cluster image.

If for some reason you must restore the vCenter Server instance from the backup copy you
created, the restored vCenter Server instance contains cluster A. Because cluster A was
managed through baselines at the time when you backed up the vCenter Server system, the
restored vCenter Server instance contains cluster A, but you must again use baselines to manage
it.

Restoring vCenter Server After Remediating a Cluster

Managed by an Image
After remediation, cluster A uses image X with components Y to manage all hosts in the cluster
collectively. At a point in time T, you back up the vCenter Server system. Later, you remediate
the cluster against a new image X+1 with new components Y+1. Now all hosts in the cluster use
image X+1 with components Y+1.

VMware, Inc. 155

Managing Host and Cluster Lifecycle

If for some reason you must restore the vCenter Server system from the backup copy that you
created at time T, the restored vCenter Server instance contains cluster A, but the compliance
check lists the hosts in the cluster as incompatible with the image that cluster A uses. The reason
for the incompatibility is that after the restore operation, cluster A reverts back to using image X
with components Y, while the hosts in the cluster still run image X+1 with components Y+1.
Because you cannot downgrade ESXi, to make the hosts compliant with the cluster image, you
must upgrade the cluster to image X+1 with components Y+1.

VMware, Inc. 156

Upgrading Virtual Machines with
vSphere Lifecycle Manager 16
You can use vSphere Lifecycle Manager to upgrade virtual machine hardware and the VMware
Tools version of a virtual machine.

Whether you perform an upgrade of the virtual machine hardware version or the VMware Tools
version, the upgrade is a multi-stage process.

1 You check the status of individual virtual machines or a container object.

vSphere Lifecycle Manager checks the status of a virtual machine against the latest virtual
machine hardware version supported by the host on which the virtual machine runs. Similarly,
vSphere Lifecycle Manager checks the status of the virtual machine against the latest
VMware Tools version supported by the host on which the virtual machine runs.

For more information about checking virtual machine status, see Checking the Status of
Virtual Machines.

2 You review the status of the scanned virtual machines.

3 You upgrade the virtual machine to match the host where it resides.

With vSphere Lifecycle Manager, you can upgrade the virtual machine hardware version and
the VMware Tools version that a virtual machine has. With vSphere Lifecycle Manager 7.0
you can upgrade to hardware version vmx-17 and to the latest VMware Tools version on
hosts that are running ESXi 7.0.

For more information about upgrading virtual machines, see Upgrading Virtual Machines.

This chapter includes the following topics:

n Configure Virtual Machine Rollback Settings

n Checking the Status of Virtual Machines

n Upgrading Virtual Machines

Configure Virtual Machine Rollback Settings

By default, vSphere Lifecycle Manager takes snapshots of virtual machines before upgrading
them. If the upgrade fails, you can use the snapshot to return a virtual machine to its state before
the upgrade.

VMware, Inc. 157

Managing Host and Cluster Lifecycle

You can configure vSphere Lifecycle Manager to keep snapshots for an indefinite or fixed period
of time. Use the following guidelines when managing snapshots.

n Keeping snapshots indefinitely might consume a large amount of disk space and degrade
virtual machine performance.

n Keeping no snapshots saves space, ensures best virtual machine performance, and might
reduce the remediation time. However, keeping no snapshots limits the availability of a
rollback.

n Keeping snapshots for a fixed period of time uses less disk space and offers a backup for a
short time.

vSphere Lifecycle Manager does not take snapshots of fault tolerant virtual machines and virtual
machines of virtual machine hardware version 3. If you decide to take snapshots of such virtual
machines, the upgrade might fail.

If you configure vSphere Lifecycle Manager to automatically upgrade VMware Tools on power
cycle for selected virtual machines, vSphere Lifecycle Manager does not take snapshots of the
virtual machines before upgrading them and you cannot roll back.

Prerequisites

Required privileges: VMware vSphere Lifecycle Manager. Configure

Procedure

1 Navigate to the vSphere Lifecycle Manager home view.

a In the vSphere Client, select Menu > Lifecycle Manager.

b Select a vCenter Server system from the Lifecycle Manager drop-down menu.

The drop-down menu is available only when multiple vCenter Server systems are
connected by a common vCenter Single Sign-On domain. By selecting a vCenter Server
system, you specify which vSphere Lifecycle Manager instance you want to administer.

2 On the Settings tab, select Host Remediation > VMs.

3 Click the Edit button.

The Edit Default Settings for VM Rollback dialog box opens.

4 Select the Take snapshot of VMs check box.

5 Select the time period for keeping the snapshots.

n Do not delete snapshots

n Keep snapshots for a configurable, fixed period of time

6 Click Save to save your changes and close the Edit Default Settings for VM Rollback dialog
box.

VMware, Inc. 158

Managing Host and Cluster Lifecycle

Results

These settings become the default rollback option settings for virtual machines. You can specify
different settings when you configure individual remediation tasks.

Checking the Status of Virtual Machines

You use vSphere Lifecycle Manager to check the status of virtual machines before you upgrade
them. The status check shows if the virtual machine is up-to-date or can be upgraded.

With vSphere Lifecycle Manager, you can check the status of a single virtual machine or a group
of virtual machines in a parent container object.

Supported groups of virtual machines or ESXi hosts include virtual infrastructure container
objects such as folders, vApps, clusters, and data centers.

vSphere Lifecycle Manager checks the status of virtual machines in two aspects.

n You can use vSphere Lifecycle Manager to check the status of the virtual machines in respect
with the VMware Tools version that they have installed.

The status check is performed against the latest VMware Tools version that the parent host
supports.

n vSphere Lifecycle Manager checks the status of the virtual machines in respect with their VM
hardware compatibility.

vSphere Lifecycle Manager compares the hardware compatibility of the virtual machines with
the default VM hardware compatibility configured for the host.

Check the Status of an Individual Virtual Machine

You check the status of virtual machines to see whether the VMware Tools version they have is
up to date and whether their hardware compatibility matches the default VM hardware
compatibility for the host.

Procedure

1 In the vSphere Client, navigate to a virtual machine.

2 On the Updates tab, click Check Status.

The Scan entity task appears in the Recent Tasks pane. After the task finishes, status
information appears in the VMware Tools and VM Hardware Compatibility panels.

Results

The virtual machines are scanned for VMware Tools and VM hardware compliance.

VMware, Inc. 159

Managing Host and Cluster Lifecycle

Check the Status of the Virtual Machines in a Container Object

You check the status of virtual machines to see whether the VMware Tools version they have is
up-to-date and whether their hardware compatibility matches the default VM hardware
compatibility for the host where they reside.

When you perform a status check for a container object, vSphere Lifecycle Manager checks the
VMware Tools and VM Hardware Compatibility statuses for all child virtual machines. The larger
the virtual infrastructure and the higher up in the object hierarchy you initiate the status check,
the longer the task takes.

Procedure

1 In the vSphere Client, navigate to a virtual machine container object, such as a virtual machine
folder, host, cluster, and so on.

2 Click the Updates tab.

3 Select your task.

Option Action

Check the VMware Tools status of a Select Hosts > VMware Tools > .
the virtual machines in the container b Click Check Status.
object.
The information about the VMware Tools status appears in the Tools
Status column in the table that lists all virtual machines in the selected
container object. If the container object is a data center or a vCenter
Server instance, you must first specify the cluster that you want to see
results for.

Check the VM Hardware a Select Hosts > VM Hardware.

compatibility status of the virtual b Click Check Status.
machines in the container object.
The information about the VM Hardware Compatibility status appears in
the Status column in the table that lists all virtual machines in the
selected container object. For each virtual machine in the object, you
can also see the VM hardware compatibility and the host compatibility. If
the container object is a data center or a vCenter Server instance, you
must first specify the cluster that you want to see results for.

The VMware Tools Status

Check the VMware Tools status for information whether the current version of VMware Tools is
installed, supported, or whether upgrades are available.

Table 16-1. VMware Tools Status

VMware Tools
Status Description

Up to Date VMware Tools is installed, supported, and the version is compliant.

VMware Tools is installed, supported, and the version is newer than the version available on the
ESXihost.

VMware, Inc. 160

Managing Host and Cluster Lifecycle

Table 16-1. VMware Tools Status (continued)

VMware Tools
Status Description

Upgrade VMware Tools is installed, but the version is old.

Available
VMware Tools is installed and supported, but a newer version is available on the ESXi host.

Version VMware Tools is installed, but the version is old.

Unsupported
VMware Tools is installed, but the version has a known issue and must be immediately upgraded.

VMware Tools is installed, but the version is too new to work correctly with this virtual machine.

Not Installed VMware Tools is not installed on this virtual machine.

Guest Managed vSphere does not manage VMware Tools.

Unknown The status of the virtual machine is not checked.

Upgrading Virtual Machines

With vSphere Lifecycle Manager, you can upgrade the VMware Tools version and the hardware
version of a virtual machine. You can also upgrade multiple virtual machines simultaneously if the
virtual machines are in a container object, such as a folder or vApp. You can also upgrade
simultaneously all virtual machines that run on a host, in a cluster, or in a data center.

vSphere Lifecycle Manager supports upgrading powered on, suspended, and powered off virtual
machines.

During the upgrade of VMware Tools, the virtual machines must be powered on. If a virtual
machine is in the powered off or suspended state before remediation, vSphere Lifecycle
Manager powers it on. After the upgrade completes, vSphere Lifecycle Manager restarts the
machine and restores the original power state of the virtual machine.

During the virtual hardware upgrade, the virtual machines must be powered off. If a virtual
machine is powered on, vSphere Lifecycle Manager powers the machine off, upgrades the virtual
hardware, and then powers the virtual machine on.

You can also upgrade VMware Tools and the hardware version of a virtual machine template. A
template is a copy of a virtual machine that you can use to create and provision new virtual
machines.

You can set up automatic upgrades of VMware Tools on power cycle. For more information, see
Automatically Upgrade VMware Tools on Reboot.

You can configure vSphere Lifecycle Manager to take snapshots of virtual machines and to keep
the snapshots indefinitely or for a specific period of time. By using snapshots, you can roll back a
virtual machine to its previous state if upgrading the virtual machine with vSphere Lifecycle
Manager fails. After the upgrade finishes, you can delete the snapshots if you do not need them.
For more information about configuring virtual machine rollback settings, see Configure Virtual
Machine Rollback Settings.

VMware, Inc. 161

Managing Host and Cluster Lifecycle

You can upgrade virtual machines immediately or schedule an upgrade operation to run at a
convenient time.

If a host is connected to vCenter Server by using an IPv6 address, you cannot scan and
remediate virtual machines that run on the host.

Upgrade the VM Hardware Compatibility of Virtual Machines

You can upgrade the hardware of virtual machines to the latest hardware version that the host
supports. You can upgrade immediately or schedule an upgrade at a time that is convenient for
you.

With vSphere Lifecycle Manager, you can upgrade the hardware compatibility version of a single
virtual machine or multiple virtual machines simultaneously. Supported container objects for
virtual machines in the vSphere inventory are folders, vApps, data centers.

Procedure

1 In the vSphere Client, navigate to a single virtual machine or a container object.

You can also initiate upgrade at the level of any inventory object where virtual machines run.
For example, you can start the upgrade operation at a host or cluster level.

2 Open the Upgrade VM Hardware to Match Host dialog box.

Inventory Object Steps

Virtual Machine a Click the Updates tab.

b In the VM Hardware Compatibility panel, click Upgrade to Match Host.

Container Object, Host, Cluster, a Click the Updates tab.

Data Center, or vCenter Server b Select Hosts > VM Hardware.
Instance c If the selected inventory object is a data center or a vCenter Server
instance, select a cluster from the list.

A list of all virtual machines in the cluster appears in the bottom pane.
d Select the virtual machines to upgrade.
e Click Upgrade to Match Host.

A list of the virtual machines selected for upgrading is visible in the Upgrade VM Hardware to
Match Host dialog box.

3 (Optional) To change the selection of the virtual machines to upgrade, select or deselect
virtual machines from the list.

4 (Optional) To schedule the upgrade for a specific date and time, expand Scheduling Options
and configure the scheduled task.

a Enter a name and, optionally, a description for the scheduled upgrade task.

b Use the Powered On VMs, Powered Off VMs, and Suspended VMs drop-down menus to
configure the upgrade to run immediately or at a specific date and time.

VMware, Inc. 162

Managing Host and Cluster Lifecycle

5 (Optional) To configure the use of snapshots, expand Rollback Options and change the
default settings.

a To enable or disable taking of snapshots of virtual machines before upgrading them,

select or deselect the Take snapshot of VMs check box.

The option to take snapshots is selected by default.

b Select a period for keeping the snapshots.

n Keep the snapshots indefinitely.

n Keep the snapshots for a fixed period.

c Enter a snapshot name and, optionally, a description for the snapshot.

d Include the virtual machine memory in the snapshot by selecting the respective check
box.

6 Review your selections and click the Upgrade to Match Host button.

Results

The hardware versions of the selected virtual machines are upgraded and the virtual machine
status changes to Up to Date.

Upgrade the VMware Tools Version of Virtual Machines

You can upgrade the VMware Tools version of virtual machines to the latest version that the host
supports. You can upgrade immediately or schedule an upgrade at a time that is convenient for
you.

With vSphere Lifecycle Manager, you can upgrade the VMware Tools version of a single virtual
machine or multiple virtual machines simultaneously. Supported container objects for virtual
machines in the vSphere inventory are folders, vApps, data centers.

Procedure

1 In the vSphere Client, navigate to a single virtual machine or a container object.

You can initiate the upgrade at the level of any inventory object where virtual machines run.
For example, you can start the upgrade operation at a host or cluster level.

VMware, Inc. 163

Managing Host and Cluster Lifecycle

2 Open the Upgrade VMware Tools to Match Host dialog box.

Inventory Object Steps

Virtual Machine a Click the Updates tab.

b In the VMware Tools panel, click Upgrade to Match Host.

Container Object, Host, Cluster, a Click the Updates tab.

Data Center, or vCenter Server b Select Hosts > VMware Tools.
Instance c If the selected inventory object is a data center or a vCenter Server
instance, select a cluster from the list.

A list of all virtual machines in the cluster appears in the bottom pane.
d In the VMs in Cluster pane, select the virtual machines to upgrade.
e Click Upgrade to Match Host.

A list of the virtual machines selected for upgrading is visible in the Upgrade VMware Tools
to Match Host dialog box.

3 (Optional) To change the selection of the virtual machines to upgrade, select or deselect
virtual machines from the list.

4 (Optional) To schedule the upgrade for a specific date and time, expand Scheduling Options
and configure the scheduled task.

a Enter a name and, optionally, a description for the scheduled upgrade task.

b Use the Powered On VMs, Powered Off VMs, and Suspended VMs drop-down menus to
configure the upgrade to run immediately or at a specific date and time.

5 (Optional) To configure the use of snapshots, expand Rollback Options and change the
default settings.

a To enable or disable taking of snapshots of virtual machines before upgrading them,

select or deselect the Take snapshot of VMs check box.

The option to take snapshots is selected by default.

b Select a period for keeping the snapshots.

n Keep the snapshots indefinitely.

n Keep the snapshots for a fixed period.

c Enter a snapshot name and, optionally, a description for the snapshot.

d Include the virtual machine memory in the snapshot by selecting the respective check
box.

6 Review your selections and click the Upgrade to Match Host button.

Results

The VMware Tools version that runs on the selected virtual machines is upgraded and the
VMware Tools status changes to Up to Date.

VMware, Inc. 164

Managing Host and Cluster Lifecycle

Automatically Upgrade VMware Tools on Reboot

You can automate the process of upgrading VMware Tools for the virtual machines in your
inventory.

You can set up vSphere Lifecycle Manager to check the VMware Tools version of a virtual
machine when the virtual machine is rebooted. If necessary, vSphere Lifecycle Manager upgrades
VMware Tools to the latest version supported by the host on which the virtual machine runs.

Note When you perform a VMware Tools upgrade on power cycle, vSphere Lifecycle Manager
does not take a snapshot of the virtual machine and you cannot roll back to the previous version
of the virtual machine.

Procedure

1 In the vSphere Client, navigate to a single virtual machine or an inventory object that contains
virtual machines.

2 Configure vSphere Lifecycle Manager to automatically upgrade VMware Tools on reboot.

Inventory Object Steps

Virtual Machine a Click the Updates tab.

b In the VMware Tools panel, click Turn On.

Container Object, Host, Cluster, a Click the Updates tab.

Data Center, or vCenter Server b Select Hosts > VMware Tools.
Instance c If the selected inventory object is a data center or a vCenter Server
instance, select a cluster from the list.

A list of all virtual machines in the cluster appears in the bottom pane.
d In the VMs in Cluster pane, select the virtual machines for which you
want to enable the automatic upgrade of VMware Tools.
e Click Set Auto Update and select On.

The new status is visible in the Auto Update column.

Results

The next time you power on or restart a virtual machine, vSphere Lifecycle Manager checks the
version of VMware Tools installed on the virtual machines and performs an upgrade, if necessary.

VMware, Inc. 165

Installing, Setting Up, and Using
Update Manager Download
Service
17
VMware vSphere Update Manager Download Service (UMDS) is an optional module of vSphere
Lifecycle Manager. UMDS downloads patch metadata, patch binaries, and notifications that might
not otherwise be available to vSphere Lifecycle Manager.

For security reasons and deployment restrictions, vSphere, including vSphere Lifecycle Manager,
might be installed in a secured network that is disconnected from other local networks and the
Internet. vSphere Lifecycle Manager requires access to patch information to function properly. If
you are using such an environment, you can install UMDS on a computer that has Internet access
to download upgrades, patch binaries, and patch metadata, and then export the downloads to a
portable media drive so that they become accessible to the vSphere Lifecycle Manager.

If the server on which vCenter Server is installed has no Internet access, but is connected to a
server that has Internet access, you can automate the export process and transfer files from
UMDS to the vSphere Lifecycle Manager depot by using a Web server on the machine on which
UMDS is installed.

UMDS 7.0 supports patch recalls and notifications. A patch is recalled if the released patch has
problems or potential issues. After you download patch data and notifications with UMDS, and
export the downloads so that they become available to vSphere Lifecycle Manager, vSphere
Lifecycle Manager deletes the recalled patches.

Starting with vSphere 7.0, the UMDS is available for installation only on Linux-based operating
systems. Installing UMDS on a Windows machine is no longer supported. Administrator access is
not a requirement for downloading patches with UMDS that runs on Linux. The machine on which
you install UMDS must have Internet access.

vSphere Lifecycle Manager supports using UMDS for both images and baselines. That is, UMDS
downloads updates that are packaged and distributed as bulletins, but it also works with
components, which are the main software update package in vSphere 7.0

This chapter includes the following topics:

n Compatibility Between UMDS and vSphere Lifecycle Manager

n Installing UMDS

n Setting Up and Using UMDS

VMware, Inc. 166

Managing Host and Cluster Lifecycle

Compatibility Between UMDS and vSphere Lifecycle

Manager
UMDS must be of the same version as vSphere Lifecycle Manager.

For example, vSphere Lifecycle Manager 7.0 is compatible and can work only with UMDS 7.0. If
you are using vSphere Lifecycle Manager of an Update release version, UMDS must be of the
same Update release version.

Installing UMDS
In vSphere 7.0 release, the UMDS 7.0 is bundled with the vCenter Server appliance 7.0. You can
use the UMDS bundle from the vCenter Server appliance to install UMDS 7.0 on a separate Linux-
based system.

UMDS is a 64-bit application and requires a 64-bit Linux-based system.

Note You cannot upgrade UMDS that runs on a Linux-based operating system. You can uninstall
the current version of UMDS, perform a fresh installation of UMDS according to all system
requirements, and use the existing patch store from the UMDS that you uninstalled.

Supported Linux-Based Operating Systems for Installing UMDS

The Update Manager Download Service (UMDS) can run on a limited number of Linux-based
operating systems.

n Ubuntu 14.0.4

n Ubuntu 18.04

n Ubuntu 18.04 LTS

n Ubuntu 20.04 LTS

n Red Hat Enterprise Linux 7.4

n Red Hat Enterprise Linux 7.5

n Red Hat Enterprise Linux 7.7

n Red Hat Enterprise Linux 8.1

Note When you use Red Hate Enterprise Linux 8.1, you must install the libnsl package
version 2.28 or later on the system where UMDS is deployed. If the package is not present on
the system, UMDS operations might fail with the following error:

Error while loading shared libraries: libnsl.so.1: cannot open shared object file: No such file
or directory.

VMware, Inc. 167

Managing Host and Cluster Lifecycle

Install UMDS on a Linux OS

If the vCenter Server appliance 7.0 where vSphere Lifecycle Manager runs does not have access
to the Internet, you can install UMDS on a Linux-based operating system to download update
binaries and metadata.

Prerequisites

n Verify you have administrative privileges on the Linux machine where you install the UMDS.

n Mount the ISO file of the vCenter Server appliance 7.0 to the Linux machine.

Procedure

1 In the Linux machine, open the Command Shell.

2 From the vCenter Server ISO that you mounted to the Linux machine, copy the VMware-
UMDS-7.0.0-build_number.tar.gz file to the Linux machine.

3 Unarchive the VMware-UMDS-7.0.0-build_number.tar.gz file, and navigate to the newly

extracted directory /vmware-umds-distrib.

For example, if you unarchived the VMware-UMDS-7.0.0-build_number.tar.gz file, to a directory

you created with the name umds, your navigation path is /umds/vmware-umds-distrib.

4 Run the file UMDS installation script.

The script has the following filename: vmware-install.pl.

5 Read and accept the EULA.

6 Select a directory where to install the UMDS.

7 Enter the UMDS proxy settings.

You can also change proxy configuration after you install UMDS by using the following
command:

vmware-umds -S --proxy <proxyAddress:port>

8 Select a directory where to store the patches.

Important The patch store directory must be different from the UMDS installation directory.

Results

UMDS is installed.

Uninstall UMDS from a Linux OS

To use the latest UMDS version on your Linux-based system, you must first uninstall the current
version of UMDS. No direct upgrade path is available to a later version of UMDS.

VMware, Inc. 168

Managing Host and Cluster Lifecycle

Prerequisites

n Verify you have administrative privileges on the Linux machine where UMDS runs.

Procedure

1 In the Linux machine, open the Command Shell.

2 Navigate to the UMDS installation directory, and locate the file vmware-uninstall-umds.pl.

3 Run the following command:

./vmware-uninstall-umds.pl

4 To confirm that you want to uninstall UMDS from the system, enter Yes.

The UMDS uninstallation procedure starts.

5 (Optional) Remove PostgreSQL Database from you Linux machine.

For information about uninstalling PostgreSQL Database, go to the official PostgreSQL

documentation.

Results

UMDS is uninstalled from the Linux system.

What to do next

You can upgrade your Linux OS, and install a later compatible version of UMDS.

Setting Up and Using UMDS

You can set up UMDS to download patches for ESXi hosts. You can also set up UMDS to
download ESXi 6.5, ESXi 6.7, and ESXi 7.0 patch binaries, patch metadata, and notifications from
third-party portals.

Administrator access is not a requirement for downloading patches if UMDS runs on Linux.

After you download the upgrades, patch binaries, patch metadata, you can export the data to a
Web server or a portable media drive and set up vSphere Lifecycle Manager to use a folder on
the Web server or the media drive (mounted as a local disk) as a shared repository.

You can also set up UMDS to download ESXi 6.5, ESXi 6.7, and ESXi 7.0 patches from third-party
portals.

To use UMDS, the machine on which you install it must have Internet access. After you download
the data you want, you can copy it to a local Web server or a portable storage device, such as a
CD or USB flash drive.

The best practice is to create a script to download the patches manually and set it up as a
Windows Scheduled Task that downloads the upgrades and patches automatically.

VMware, Inc. 169

Managing Host and Cluster Lifecycle

Set Up the Data to Download with UMDS

By default, UMDS downloads patch binaries, patch metadata, and notifications for hosts. You can
specify which patch binaries and patch metadata to download with UMDS.

Procedure

1 Log in to the machine where UMDS is installed, and open a Command Prompt window.

2 Navigate to the directory where UMDS is installed.

The default location in 64-bit Linux is /usr/local/vmware-umds.

3 Specify the updates to download.

n To set up a download of all ESXi host updates run the following command:

vmware-umds -S --enable-host

n To disable the download of host updates, run the following command:

vmware-umds -S --disable-host

What to do next

Download the selected data.

Change the UMDS Patch Repository Location

UMDS downloads upgrades, patch binaries, patch metadata, and notifications to a folder that
you can specify during the UMDS installation.

The default folder to which UMDS downloads patch binaries and patch metadata on a Linux
machine is /var/lib/vmware-umds .

You can change the folder in which UMDS downloads data after you install UMDS.

If you have already downloaded host updates, copy all the files and folders from the old location
to the new patch store location. The folder in which UMDS downloads patch binaries and patch
metadata must be located on the machine on which UMDS is installed.

Procedure

1 Log in as an administrator to the machine where UMDS is installed, and open a Command
Prompt window.

2 Navigate to the directory where UMDS is installed.

The default location in 64-bit Linux is /usr/local/vmware-umds.

3 Change the patch repository directory by running the command:

vmware-umds -S --patch-store your_new_patchstore_folder

VMware, Inc. 170

Managing Host and Cluster Lifecycle

In this example, your_new_patchstore_folder is the path to the new folder in which you
want to download the patch binaries and patch metadata.

Results

You successfully changed the directory in which UMDS stores patch data.

What to do next

Download data using UMDS.

Configure URL Addresses for Hosts

You can configure UMDS to connect to the websites of third-party vendors to download ESXi
6.5, ESXi 6.7, and ESXi 7.0 host patches and notifications.

Procedure

1 Log in to the machine where UMDS runs, and open a Command Prompt window.

2 Navigate to the directory where UMDS is installed.

The default location in 64-bit Linux is /usr/local/vmware-umds.

3 Configure UMDS to download data from the new URL address.

u To add a new URL address for downloading patches and notifications for ESXi 6.5, ESXi
6.7, or ESXi 7.0 hosts, run the following command:

vmware-umds -S --add-url https://host_URL/index.xml --url-type HOST

4 (Optional) Remove a URL address, so that UMDS does not download data from it anymore.

Downloaded data is retained and can be exported. Use the following command:

vmware-umds -S --remove-url https://URL_to_remove/index.xml

Results

You configured UMDS to download host patches and notifications from specific URL addresses.

What to do next

Download the patches and notifications by using UMDS.

Download the Specified Data Using UMDS

After you set up UMDS, you can download upgrades, patches and notifications to the machine
on which UMDS is installed.

Administrator level access is not a requirement for downloading data with UMDS that runs on
Linux.

VMware, Inc. 171

Managing Host and Cluster Lifecycle

Procedure

1 Log in to the machine where UMDS is installed, and open a Command Prompt window.

2 Navigate to the directory where UMDS is installed.

The default location in 64-bit Linux is /usr/local/vmware-umds.

3 Download the selected updates.

vmware-umds -D

This command downloads all the upgrades, patches and notifications from the configured
sources for the first time. Subsequently, it downloads all new patches and notifications
released after the previous UMDS download.

4 (Optional) If you have already downloaded upgrades, patches, and notifications and want to
download them again, you can include the start and end times to restrict the data to
download.

The command to re-download patches and notifications deletes the existing data from the
patch store (if present) and re-downloads it.
To re-download the upgrades, patches and notifications that were downloaded in November
2010, for example, run the following command:

vmware-umds -R --start-time 2010-11-01T00:00:00 --end-time 2010-11-30T23:59:59

The data previously downloaded for the specified period is deleted and downloaded again.

What to do next

Export the downloaded upgrades, patches, and notifications.

Export the Downloaded Data

You can export downloaded upgrades, patches, and notifications to a specific location that
serves as a shared repository for vSphere Lifecycle Manager. You can configure vSphere
Lifecycle Manager to use the shared repository as a patch download source. The shared
repository can also be hosted on a Web server.

Administrator level access is not a requirement for exporting the downloaded data with UMDS
that runs on Linux.

Prerequisites

If you installed UMDS with an existing download directory, verify that you perform at least one
download by using UMDS 7.0 before you export updates.

Procedure

1 Log in to the machine where UMDS is installed and open a Command Prompt window.

VMware, Inc. 172

Managing Host and Cluster Lifecycle

2 Navigate to the directory where UMDS is installed.

The default location in 64-bit Linux is /usr/local/vmware-umds.

3 Specify the export parameters and export the data.

vmware-umds -E --export-store repository_path

In the command, you must specify the full path of the export directory.

If you are working in a deployment in which the vCenter Server is installed on a machine
connected to the machine on which UMDS is installed, repository_path can be the path to the
folder on the Web server that serves as a shared repository.

If the vCenter Server is installed on a machine in an isolated and secure environment,

repository_path can be the path to a portable media drive. Export the downloads to the
portable media drive to physically transfer the patches to the machine on which vCenter
Server is installed and vSphere Lifecycle Manager runs.

The data you downloaded by using UMDS is exported to the path you specify. Make sure
that all files are exported. You can periodically export from UMDS and populate the shared
repository so that vSphere Lifecycle Manager can use the new patch binaries and patch
metadata.

4 (Optional) You can export the ESXi patches that you downloaded during a specified time
window.

For example, to export the patches downloaded in November 2010, run the following
command:

vmware-umds -E --export-store repository-path --start-time 2010-11-01T00:00:00 --end-time

2010-11-30T23:59:59

What to do next

Configure vSphere Lifecycle Manager to use a shared repository as a patch download source.
For more information, see Configure vSphere Lifecycle Manager to Use a Shared Repository as a
Download Source.

VMware, Inc. 173