How to update when it's only a change in the LCM Image?

[Jim Millard]

Scenario: we have VCF 9.0.2 deployed with three different instances, each in its own physical DC.

We just went through the lifecycle patching process to get all the domains to 9.0.2.0100. When we built the new images for the ESXi hosts on the first instance we updated, we didn't realize that the 9.0.2.0100 base image had VMTools 13.0.10 baked into it, not the current 13.1.0. We manually added the latest release in subsequent updates.

So now the question is: How do we get the image for that first instance--both the management & workload domains--updated to have the latest version of VMtools?

Similarly: how would we update the clusters if the hardware vendor bundle needs to be updated, particularly if a sev1 hardware bug needs remediation or a CVE needs to be addressed? With vSphere LCM, it's super straightforward to update the image & remediate hosts, but VCF doesn't seem to have any function for this scenario.

Edit: There's no difficulty in getting a new image created & imported into the VCF instance. The issue is applying it. Doesn't seem to be any way to do that independent of a supplied patch or upgrade.

[John Howell]

I believe you can modify the vendor addon and add the vm tools as a custom component in the management domains vcentre LCM image, then when doing the domain updates import the modified image into the update (Sddc manager). 

[Allan Solomon Mejia]

Hi Jim,

 

I think the key distinction here is between creating/importing the desired vLCM image and actually applying it to an existing VCF-managed cluster.

 

You can create a new desired image containing the same ESXi 9.0.2.0100 base image and update only the component you need, for example VMware Tools 13.1.0 or an updated vendor add-on, and then import that image into the VCF lifecycle workflow.

 

However, I would be careful about simply changing the image in vCenter and remediating the cluster directly. Because the cluster is managed by VCF/SDDC Manager, lifecycle state needs to remain synchronized with VCF. Broadcom specifically warns against performing certain vLCM lifecycle operations independently of SDDC Manager in VCF-managed environments.

 

So your observation is valid: the difficult part isn't creating the new image; it's applying an image that only changes VMware Tools, a vendor add-on, firmware integration, or another component without performing a normal VCF release upgrade.

 

VCF 9.x does support importing vLCM images from vCenter into the VCF lifecycle workflow. In fact, Broadcom has a KB specifically covering cases where VCF Operations fails to display images created in vCenter during the Import Image operation.

 

I would therefore use the VCF-supported image import/apply workflow rather than independently remediating the cluster from vSphere Lifecycle Manager. If the imported image isn't being offered as an applicable update because the ESXi base version hasn't changed, that may be a limitation of the current VCF 9.0.2 lifecycle workflow rather than something you're overlooking.

 

This becomes particularly important with your second example. A critical OEM driver/vendor add-on or firmware fix may need to be deployed independently of a full VCF release, so VCF needs a supported mechanism for reconciling that updated desired image with the existing cluster.

 

I wouldn't modify/remediate the VCF-managed cluster directly through vCenter unless Broadcom Support confirms that specific operation is supported for VCF 9.0.2.

 

Hope this helps.