patch_esxi_function

[jvm2016]

Hi Luc ,

few days back we discussed about patching esxi using powercli .

i am trying to convert that to function so that it can be added to module to make it monolithic.

however i have few questions related to colred lines (blue,green,red)

1:if i dont save these three in variables(and run commands without storing them in variables) will it cause any issues .?

2:also i dont want to use  -runasync switch or sleep  and then use do untill loop for getting counter .because once blue is completed then it will proceed to green and then to red .

do you think this code will work fine looping from one esxi host to finish patch, reboot and proceeding to next.

sorry if i asked this previously.

function Patch-Esxi

   {

     [cmdletbinding()]

    param (

        [parameter(mandatory = $true,

            valuefrompipeline = $true,

            valuefrompipelinebypropertyname = $true)]

        [string]$clustername

    )

   if((get-module).name -notcontains "vmware.vumautomation")

   {

   Import-Module -Name VMware.VumAutomation

   $cluster=get-cluster -Name $clustername

   $patch=Get-Baseline -BaselineType Patch -Name "TBD"

   foreach($esxi in (get-vmhost -Location $cluster))

   {

  $maint = Set-VMHost -VMHost $esxi -State Maintenance -WhatIf

   $AtBL=Attach-Baseline -Entity $esxi -Baseline $patch -WhatIf

$update_esxi=Update-Entity -Baseline $patch -Entity $esxi -WhatIf

   }

   }

below is what we did last time to get percentage of maint mode operation but wht i observed that there is counter for powercli commnds .only thing is that it works sometime .

   <#

   Do

  {

    Write-Host -NoNewline '.'

    sleep 1

    $esxi = Get-VMHost -Name $esxi.name

  } until ($esxi.State -eq "maintenance" -and $maint.PercentComplete -eq 100)

Write-Host "`rDone"

Write-Output "Task '$($maint.Description)/$($maint.Id)' for $($maint.Result.Name) ended with status $($maint.State)"

#>

[LucD]

You might want to check if the ESXi node is in a valid state (connected), before continuing with the next node.

[jvm2016]

thanks.iam going to check this .

[jvm2016]

i think below shud work fine considering no restriction on vmtion of vmsin drs enabled cluster.

function Push-PatchEsxi

   {

     [cmdletbinding()]

    param (

        [parameter(mandatory = $true,

            valuefrompipeline = $true,

            valuefrompipelinebypropertyname = $true)]

        [string]$clustername

    )

   Import-Module -Name "VMware.VumAutomation"

   $cluster=get-cluster -Name $clustername

   Set-Cluster -Cluster $cluster -HAAdmissionControlEnabled:$false

   $patch=Get-Baseline -BaselineType Patch -Name "tbd"

   foreach($esxi in (get-vmhost -Location $cluster|?{$_.connectionstate -eq "connected"}))

   {

   $maint = Set-VMHost -VMHost $esxi -State Maintenance -WhatIf -Verbose

   Attach-Baseline -Entity $esxi -Baseline $patch -WhatIf -Verbose

$update_esxi=Update-Entity -Baseline $patch -Entity $esxi

set-vmhost -VMHost $esxi -State Connected

sleep -Seconds 120

   }

[LucD]

I would not use the sleep at the end, but use a Do-While loop, where you wait till the VMHost state says connected.

You could also introduce a timeout in that Do-While loop, just to avoid to loop forever when the connection fails.

[jvm2016]

iam trying to test this using different condition as putting maintenence mode even drs is enabled is having some issues .

however i tried to make this analogous to following condition .

could you tell me what is going to be difference between do while  and do until in below scenerio.

[LucD]

The major difference would be the test that you have to use.

With Do-Until, the test has to evaluate if you reached the end.

Do{

  # your code

} Until ($snap.Percentage -eq 100)

With Do-While, the test has to evaluate that you haven't reached the end yet.

Do {

  # your code

} While ($snap.Percentage -lt 100)

[jvm2016]

so for the snapshot creation scenerio using do until

it should write progress after every one second  and  stop once we reach the end(i.e snapshot creation is done or 100 percent).

but that is not happening it is writing 'progress' endlesly even after snapshot creation is completed (or reached the end )

[LucD]

We had this discussion before, that is because it is most probably a Client Side Task (CST).

You can see the progress.

[jvm2016]

i am checking it one more time .however only way to check is to run that task with -async .

[jvm2016]

Hi Luc,

could you plese complete this as right now i dont have test environment to check CST or SST. vmware labs esxi are not going to maint mode.:smileyplain:

function Push-PatchEsxi

   {

     [cmdletbinding()]

    param (

        [parameter(mandatory = $true,

            valuefrompipeline = $true,

            valuefrompipelinebypropertyname = $true)]

        [string]$clustername

    )

   Import-Module -Name "VMware.VumAutomation"

   $cluster=get-cluster -Name $clustername

   set-cluster -Cluster $cluster -DrsAutomationLevel FullyAutomated

   Set-Cluster -Cluster $cluster -HAAdmissionControlEnabled:$false

   $patch=Get-Baseline -BaselineType Patch -Name "CH30125224_3rd Nov"

   foreach($esxi in (get-vmhost -Location $cluster|?{$_.connectionstate -eq "connected"}))

   {

   $maint = Set-VMHost -VMHost $esxi -State Maintenance -WhatIf -Verbose

   Attach-Baseline -Entity $esxi -Baseline $patch -WhatIf -Verbose

$update_esxi=Update-Entity -Baseline $patch -Entity $esxi

set-vmhost -VMHost $esxi -State Connected

sleep -Seconds 120

   }

}

all iam able to think and imagine that last command "set-vmhost -VMHost $esxi -State Connected" in for each loop wiil put the host out of maintenace and once host is in conncted it will loop to next

esxi .

[LucD]

The Set-VMHost with RunAsync will be a CST, which means that the PercentComplete is updated automatically.

So you can do

function Push-PatchEsxi {

  [cmdletbinding()]

  param (

   [parameter(mandatory = $true,

   valuefrompipeline = $true,

   valuefrompipelinebypropertyname = $true)]

   [string]$clustername

  )

  Import-Module -Name "VMware.VumAutomation"

  $cluster = Get-Cluster -Name $clustername

  Set-Cluster -Cluster $cluster -DrsAutomationLevel FullyAutomated

  Set-Cluster -Cluster $cluster -HAAdmissionControlEnabled:$false

  $patch = Get-Baseline -BaselineType Patch -Name "CH30125224_3rd Nov"

  foreach ($esxi in (Get-VMHost -Location $cluster|? {$_.connectionstate -eq "connected"})) {

   $maint = Set-VMHost -VMHost $esxi -State Maintenance -WhatIf -Verbose

  Attach-Baseline -Entity $esxi -Baseline $patch -WhatIf -Verbose

   $update_esxi = Update-Entity -Baseline $patch -Entity $esxi

   $t = Set-VMHost -VMHost $esxi -State Connected -RunAsync

   while ($t.PercentComplete -ne 100) {

  sleep 2

   }

  }

}

[jvm2016]

Thankyou sir .iamgoing to  test this in change window.

[jvm2016]

i see a very basic problem here when we run

Set-VMHost -VMHost $esxi -State Maintenance

it is not going to maintenance mode even drs is fully automatic.and all the prerequisites are met.

[LucD]

How did you configure HA Admissoin Control in that cluster?

Is there anything in the Task and Events that gives more information?
Eventually have a look in the vpxd log for clues.

[jvm2016]

HA admission control has to be disabled before starting patching operation so it is already disabled .

however what i meant to ask is

set-vmhost -vmhost $esxi -state maintenance is the complete syntax to put host in maintence mode or can it be altered to add more switch.

[LucD]

Yes, the State parameter on the Set-VMHost cmdlet is all you need.

Make sure to read the remarks on the State parameter in the Help page.

For example if DRS is not fully automated, you will have to make sure that the VMs on the ESXi node are moved to another ESXi node in the cluster.

[jvm2016]

iam going to check this.however most of the time all prereuistes are checked .and problem happens when we try to put host in maintence by powercli.

but when using vsphere client there is no issue.

i some times feel attck from enemy of automation:smileylaugh:.

[LucD]

If an ESXi node doesn't want to go into maintenance mode there must be a reason.

That reason can often be found in the Task and Events, or eventually the vpxd log.

To automate something you do in the vSphere Client, you must of course include everything the vSphere Client does :smileygrin:

[jvm2016]

let me check one more time.