Using the KernelCare plugin

You can use the KernelCare plugin to patch the Linux kernel on hosts without rebooting them. The plugin provides job templates to view and live-patch the Linux kernel on hosts and ensures hosts do not report to orcharhino Server that a reboot is required through tracer. For more information, see tuxcare.com/live-patching-services and docs.tuxcare.com/live-patching-services.

The KernelCare plugin is a technical preview. ATIX AG does not recommend running this in your production environment.

Installing the KernelCare plugin

Use the following procedure to install the KernelCare plugin.

Procedure

  • Install the plugin on your orcharhino Server:

    $ orcharhino-installer --enable-foreman-plugin-kernel-care

KernelCare client

You need to provide the KernelCare client to your hosts. Synchronize the required repositories depending on the operating system of your hosts.

After synchronization, ensure to make the content consumable to your hosts.

Creating KernelCare repositories for CentOS 7

You need to provide the KernelCare client on your hosts to live-patch their Linux kernel.

Procedure

  1. In the orcharhino management UI, navigate to Content > Products.

  2. Click Create Product to create a product named KernelCare CentOS. For more information, see Creating a Product in Managing Content.

  3. On the Repositories tab, click New Repository to create a repository of type yum as follows:

    For more information, see Adding RPM Repositories in Managing Content.

Installing the KernelCare package on hosts

You can use kernelcare to patch the Linux kernel on hosts without rebooting them.

Prerequisites

  • Your hosts have access to the KernelCare repository. For more information, see KernelCare Client.

Procedure

  1. In the orcharhino management UI, navigate to Monitor > Jobs and click Run job.

  2. Select Katello as Job category and Install Package – Katello Script Default as Job template and click Next.

  3. Select hosts on which you want to run the job. If you do not select any hosts, the job will run on all hosts you can see in the current context.

  4. In the package field, enter kernelcare and click Next.

  5. Optional: To configure advanced settings for the job, fill in the Advanced fields. To learn more about advanced settings, see advanced settings in the job wizard.

  6. Click Next.

  7. Select Immediate execution to execute the job immediately and click Next.

  8. Review job details. You have the option to return to any part of the job wizard and edit the information.

  9. Click Run to install kernelcare on your hosts.

Viewing patched kernel version

You can use a job template to view the patched kernel version on hosts.

Prerequisites
Procedure

  1. In the orcharhino management UI, navigate to Monitor > Jobs and click Run job.

  2. Select LivePatching – Script Default as Job category and LivePatching – Kernel version as Job template and click Next.

  3. Select hosts on which you want to run the job. If you do not select any hosts, the job will run on all hosts you can see in the current context.

  4. Click Next.

  5. Optional: To configure advanced settings for the job, fill in the Advanced fields. To learn more about advanced settings, see advanced settings in the job wizard.

  6. Click Next.

  7. Select Immediate execution to execute the job immediately and click Next.

  8. Review job details. You have the option to return to any part of the job wizard and edit the information.

  9. Click Run to view the running Kernel version on your hosts.

Live patching hosts using KernelCare plugin

You can use kcarectl provided by TuxCare to live-patch the Linux kernel on your hosts. By default, kcarectl checks for updates every four hours. If the automatic installation of patches is disabled or if you want to install patches manually at a certain time, you can start the process using a remote execution job.

Prerequisites

  • Ensure your hosts have the kernelcare package installed.

  • Ensure your hosts run CentOS 7, CentOS 8, or CentOS 9.

  • Ensure your hosts have access to the internet to connect to cloudlinux.com.

    If your host is in a disconnected environment, you can use ePortal by Tuxcare to provide Linux kernel patches. For more information, see docs.tuxcare.com/eportal.

Procedure

  1. In the orcharhino management UI, navigate to Monitor > Jobs and click Run job.

  2. Select LivePatching – Script Default as Job category and LivePatching – Update kernel as Job template and click Next.

  3. Select hosts on which you want to run the job. If you do not select any hosts, the job will run on all hosts you can see in the current context.

  4. Click Next.

  5. Optional: To configure advanced settings for the job, fill in the Advanced fields. To learn more about advanced settings, see advanced settings in the job wizard.

  6. Click Next.

  7. Select Immediate execution to execute the job immediately and click Next.

  8. Review job details. You have the option to return to any part of the job wizard and edit the information.

  9. Click Run to update to the latest Linux kernel on your hosts.

Additional resources

The text and illustrations on this page are licensed by ATIX AG under a Creative Commons Attribution Share Alike 4.0 International ("CC BY-SA 4.0") license. This page also contains text from the official Foreman documentation which uses the same license ("CC BY-SA 4.0").