Patching hosts through errata

Hosts receive security and bugfix updates through errata. Review applicable and installable errata, generate status reports, install updates, and run custom code before or after installation.

Additional resources

Prerequisites for installing errata on hosts

Installing errata on hosts requires synchronized repositories, installable errata in the content view environment, registered hosts, and remote execution configuration.

  • Repositories on orcharhino Server are synchronized with the latest errata available from upstream.

  • The host is registered to a content view environment.

  • The host is configured for remote execution.

  • Errata are installable.

    Applicable errata have updates for packages on hosts, but you can only install errata included in the content view environment of the host. If errata are applicable but not installable, the content view must be incrementally updated and promoted to the lifecycle environment of the host.

Additional resources

Viewing errata by applicable and installable

You can view errata by applicable or installable status to see which updates affect your hosts and which are ready to install.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > All Hosts.

  2. Select the host name.

  3. Click the Overview tab. Under the Errata card, there are two types of Errata.

  4. Click Applicable to view errata that apply to a package installed on your host.

  5. Click Installable to view applicable errata that are available in the content view environments of the host.

  6. Click the link with number of errata under each type to see the list of all available errata of that type.

  7. Click security advisories, bug fixes, or enhancements under each type to view only the respective type of errata.

Generating a report for installable and applicable errata

You can generate a report of installable or applicable errata on hosts to review update status across your environment before installing errata on hosts.

Procedure

  1. In the orcharhino management UI, navigate to Monitor > Reports > Report Templates.

  2. Click Generate for the Host – Applicable Errata template.

  3. Optional: To schedule a report, click the calendar icon to the right of the Generate at field and choose the date and time you want for the generated report.

  4. Optional: To send a report to an e-mail address, select the Send report via e-mail checkbox, and in the Deliver to e-mail addresses field, enter the required e-mail address.

  5. Optional: Select another Output format for the report file. The default is CSV.

  6. Optional: To limit the report only to hosts found by the search query, click on Hosts filter and search from the available list of hosts. For a report on all available hosts, leave Hosts filter empty.

  7. Optional: To limit the report only to errata found by the search query, click on Errata filter and search from the available list of errata. For a report on all available errata, leave Errata filter empty.

  8. From the Installability list, select one of these options:

    • Applicable to show all applicable errata.

    • Installable to limit the report exclusively to errata that are accessible in the content view environments of your host that may be installed.

  9. Click Generate. Your browser automatically downloads the report file after orcharhino creates it. If you have selected the Send report via e-mail option, the report is sent to your e-mail address.

Filter errata by type and severity

You can filter errata by type or severity to focus on security updates, bug fixes, or enhancements when planning or applying errata.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > All Hosts.

  2. Select your host.

  3. On the Contents tab, Errata lists the errata associated with the selected host.

  4. Click Type to filter errata by type.

  5. You can filter to display errata of type Security, Bugfix, or Enhancement

  6. Click Severity to filter by severity.

  7. You can filter to display errata of severity N/A, Low, Moderate, Important, or Critical.

  8. To deselect your choice, return to the list of options and click the selected option again.

    You can also use the Errata card on the host page to pre-filter errata for type before display.

Installing errata on hosts by using orcharhino management UI

You can use the orcharhino management UI to review and install installable errata on hosts so that security and bugfix updates are installed on selected hosts.

Prerequisites
Procedure

  1. In the orcharhino management UI, navigate to Content > Content Types > Errata.

  2. Click the name of an erratum you want to install.

  3. On the to Content Hosts tab, select all hosts that you want to install errata on.

  4. Click Apply to Hosts and click Confirm.

Verification

  1. In the orcharhino management UI, navigate to Monitor > Jobs.

  2. Select the most recent Install errata job.

  3. Verify that the remote execution to install errata on all selected hosts succeeded.

Installing errata on hosts by using CLI

You can use Hammer CLI to review and install installable errata on hosts so that security and bugfix updates are installed on selected hosts.

Prerequisites
Procedure

  1. List all errata:

    $ hammer erratum list --organization "My_Organization"

    You can limit the output to applicable by adding --errata-restrict-applicable or to installable errata by adding --errata-restrict-installable.

  2. Optional: View information of an erratum:

    $ hammer erratum info --id My_Erratum_ID

  3. Install errata on your hosts.

    You can use Remote Execution:

    $ hammer job-invocation create \
--feature katello_errata_install \
--inputs errata=My_Erratum_ID_1,My_Erratum_ID_2 \
--search-query "name = host.example.com"

    If you want to install errata on all hosts in a host collection, use "host_collection = My_Host_Collection_Name" as the search query. If you want to install a specific erratum on all hosts, use "applicable_errata = My_Erratum_ID" as the search query.

    You can use a Bash script that installs an erratum on each host for which this erratum is available:

    for HOST in hammer --csv --csv-separator "|" host list --search "applicable_errata = My_Erratum_ID" --organization "My_Organization" | tail -n+2 | awk -F "|" '{ print $2 }' ;
do
  echo "== Installing on $HOST ==" ; hammer job-invocation create --feature katello_errata_install --search-query "name = $HOST" --inputs errata=My_Erratum_ID_1,My_Erratum_ID_2 ;
done

    This command identifies all hosts with My_Erratum_ID as an applicable erratum and then installs the erratum on each host.

Verification

  1. Locate the task ID of your errata installation in task listing:

    $ hammer task list

  2. Inspect the state of the selected task:

    $ hammer task progress --id My_Task_ID
Additional resources

Running custom code while installing errata by using orcharhino management UI

Create custom snippets to run code before or after errata installation when you need to prepare hosts or verify updates.

Prerequisites

  • The job template that installs errata must conditionally include custom snippets ending in custom pre or custom post.

    You can view job templates in use under Administer > Remote Execution Features.

Procedure

  1. In the orcharhino management UI, navigate to Hosts > Templates > Job Templates.

  2. Click Create Template.

  3. In the Name field, enter a name for your custom snippet. The name must start with the name of a template that supports custom snippets:

    • Append custom pre to the name of a template to run code before installing errata on hosts.

    • Append custom post to the name of a template to run code after installing errata on hosts.

    For example, if your template is called Install Errata - Katello Ansible Default, name your template Install Errata - Katello Ansible Default custom pre or Install Errata - Katello Ansible Default custom post.

  4. On the Type tab, select Snippet.

  5. Click Submit to create your custom snippet.

Running custom code while installing errata by using Hammer CLI

Create custom snippets that run code before or after errata installation when you need to prepare hosts or verify updates.

Prerequisites

  • The job template that installs errata must conditionally include custom snippets ending in custom pre or custom post.

    You can view job templates in use under Administer > Remote Execution Features.

Procedure

  1. Create a plain text file that contains your custom snippet.

  2. Upload the snippet file to orcharhino Server:

    $ hammer template create \
--file "~/My_Snippet" \
--locations "My_Location" \
--name "My_Template_Name_custom_pre" \
--organizations "_My_Organization" \
--type snippet

    The name must start with the name of a template that supports custom snippets: Append custom pre to the name of a template to run code before installing errata on hosts. Append custom post to the name of a template to run code after installing errata on hosts.

    For example, if your template is called Install Errata - Katello Ansible Default, name your snippet Install Errata - Katello Ansible Default custom pre or Install Errata - Katello Ansible Default custom post.

The text and illustrations on this page are licensed by ATIX AG under a Creative Commons Attribution Share Alike 4.0 International ("CC BY-SA 4.0") license. This page also contains text from the official Foreman documentation which uses the same license ("CC BY-SA 4.0").