What this does. Applies individual product fixes and Express Patches to a running VCF 9.1 fleet between full maintenance releases. Depends on: a healthy fleet already on VCF 9.1.0 or later, software depot access, and a current backup of every component you touch.
- Prerequisites: a VCF 9.1.0 fleet, depot access (online or offline), a current backup, and admin credentials for VCF Operations and SDDC Manager.
- Express Patches carry security and product fixes between maintenance releases and can be applied in any order, since each is cumulative.
- Sync the depot metadata from VCF Operations first, then download the binaries through the patch planner or the VCF Download Tool.
- Patch VCF management components from Build, then Lifecycle, then VCF Management, and apply a Fleet Lifecycle patch first when one is offered.
- Patch VCF core components, meaning vCenter, NSX, ESXi, and vSAN, one workload domain at a time from the Plan Component Upgrade wizard.
- Use the Async Patch Tool on the SDDC Manager appliance for a critical component fix released outside a VCF patch.
You patch a VCF 9.1 fleet without waiting for the next full upgrade. In the unified versioning model, Broadcom ships scheduled maintenance releases and, between them, Express Patches, sometimes called express or async patches, whenever a fix is ready. VCF Operations owns the software depot and the patch planner, so most patching now runs from one console. This part walks through synchronizing the depot, downloading binaries, and applying patches to management and core components, then covers the Async Patch Tool for out-of-band component fixes.
Two prerequisites matter before you start. Confirm the fleet already runs VCF 9.1.0 or later, because the patch planner reads the VCF manifest to offer only the patch versions that apply to your build. Then confirm depot access and a current backup, since a patch changes appliance software in place and a clean rollback depends on that backup. If you are still moving up from 9.0.x, apply the full upgrade in Part 2 first, then return here for ongoing patching.
Plan a patch like any change. Pick a maintenance window, back up each appliance you will touch, and patch one component group at a time so you can watch health between stages. Express Patches are small, but they still restart services, so treat a security fix with the same care you give a maintenance release. Keep the release notes open while you work, since they call out any component you must patch together.
Prerequisites
Confirm each item below before you open the patch planner. A missing prerequisite is the most common reason a precheck fails partway through. Take a few minutes to walk the table top to bottom, since fixing a stale credential or a low disk warning now is far quicker than clearing a failed precheck later.
| Requirement | Target | Where to check |
|---|---|---|
| Fleet version | VCF 9.1.0 or later | VCF Operations, Build, Lifecycle |
| Depot access | Online depot token, or a populated offline depot | VCF Operations, Depot settings |
| Backups | Recent SDDC Manager, vCenter, and NSX Manager backups | Backup target and job history |
| Health state | No blocking alerts on any component | VCF Operations health view |
| Credentials | Admin access to VCF Operations and SDDC Manager | Your credential store |
It helps to know the four release types you will meet in the depot, since each is applied a little differently. A major or minor release moves the whole stack. A maintenance release follows a defined component sequence. An Express Patch delivers a single fix and can be applied on its own. A critical component patch that has not yet reached a VCF release is staged with the Async Patch Tool.
Most Day-2 patching falls into the middle two rows of this table. You reach for a maintenance release a few times a year, and you apply Express Patches more often as fixes land. A critical async patch is rare and applies only when a component needs a fix before it reaches a VCF release.
| Release type | Scope | Order | Applied with |
|---|---|---|---|
| Maintenance release | Full stack | Fixed component sequence | VCF Operations patch planner |
| Express Patch | One or more components | Any order, cumulative | VCF Operations patch planner |
| Async patch | vCenter, NSX, or ESXi | Staged before it blocks upgrades | Async Patch Tool and SDDC Manager |
Step 1, Review the patch release notes
Read the release notes before you touch the depot, because they list which components a given patch level updates and any known issues. Not every component ships a patch at every level.
- Open the VCF 9.1.0.x patch release notes on Broadcom TechDocs and read the entry for the patch level you plan to apply.
- Note each affected component, since one Express Patch may update only VCF Operations while another updates SDDC Manager or a core component.
- In VCF Operations, click Build, then Lifecycle, and record the current version shown for each component.
Step 2, Synchronize the software depot metadata
A patch planner only shows patches the depot already knows about, so refresh the metadata first. This step reads the manifest from your online or offline depot.
- Log in to VCF Operations with an administrator account.
- On the top navigation bar, click Build.
- In the left navigation pane, click Lifecycle.
- Click VCF Management, then click the Upgrade tab.
- In the upper right corner, click Sync to refresh the VCF metadata from the depot.
Step 3, Download the patch binaries
Metadata alone lists what is available. Binaries must be present in the depot before a patch can run. How you fetch them depends on how the environment reaches the internet.
- If you use an online depot, open the patch planner and confirm the binaries show as available for the target patch version.
- If binaries are missing, click Download next to the target version to pull them into the depot.
- If you run a disconnected site, download the bundles with the VCF Download Tool on a connected host, then move them to your depot.
Step 4, Apply an Express Patch to a VCF management component
VCF management components include Fleet Lifecycle and SDDC Lifecycle, which live inside the VCF management services. Patch these from the VCF Management pane. When a patch level includes a Fleet Lifecycle fix, apply it first, because Fleet Lifecycle drives the patch and upgrade of the rest of the fleet. A management patch runs on the appliances that host the VCF management services, so expect a brief service restart as each one updates.
- In the Lifecycle pane, click VCF Management, then click the Upgrade tab.
- Click Change target version.
- In the Set Target Version dialog, select the patch version for your major version from the version menu, then click Customize.
- For the component to patch, select a version from the Target version menu, then click Set version.
- In the Management component target version section, for that component, click Run prechecks.
- After prechecks finish, remediate any reported error before you continue.
- For the component, click Upgrade to apply the patch.
Step 5, Apply a patch to a VCF core component
Core components are vCenter, NSX, ESXi, and vSAN. Patch them per workload domain from the Plan Component Upgrade wizard. If an upgrade plan already exists for the domain, cancel it first, because you cannot run the patch planner alongside an open upgrade plan. Patch one domain, confirm it is healthy, then repeat for the next domain rather than starting several at once.
- In the Lifecycle pane, expand VCF Instances and select the domain to patch.
- Click the Upgrades tab, then click Plan Component Upgrade.
- On the Select Components and Target Version screen, choose the component and its target patch version, then click Next.
- On the Plan Overview page, click Submit Plan.
- In the Upgrade Sequence section, on the component card, click Run Prechecks and resolve any issue.
- On the component card, click Schedule or Start Now to apply the patch.
Step 6, Apply a critical patch with the Async Patch Tool
When Broadcom releases a critical fix for vCenter, NSX, or ESXi outside a VCF patch, the Async Patch Tool stages it so SDDC Manager lifecycle management can apply it without blocking a later upgrade. This is a command-line utility that you run on the SDDC Manager appliance, and its precheck must run there too. Because an async patch is applied through SDDC Manager lifecycle management, the fleet keeps a consistent record of the change, so a later VCF upgrade recognizes the patched component and does not try to downgrade it.
- Download the Async Patch Tool and the target patch bundle from the Broadcom Support portal to a host that can reach the SDDC Manager appliance.
- Connect to the SDDC Manager appliance over SSH as shown below.
- Run the tool with its precheck option to confirm the operation will succeed, following the Async Patch Tool options reference.
- Run the enable option so the patch is staged for SDDC Manager lifecycle management.
- Log in to the SDDC Manager UI and apply the enabled patch to each workload domain.
ssh vcf@sddc-manager.vcf.example.com
Verify the patch applied cleanly
Confirm each patched component reports its new version and that the fleet stays healthy. Run these checks before you move to the next component. Give the fleet a few minutes to settle after a task reports success, because services restart and health data refreshes on a short delay. A patched fleet shows a consistent version across the domain and no open lifecycle alert.
- In VCF Operations, open Build, then Lifecycle, and confirm each patched component now shows the target version.
- Open the task or activity log and confirm the patch task completed with a success state.
- On a patched host, confirm the ESXi build from a shell as shown below.
- Return to the health view and confirm no new alert was raised by the patch.
esxcli system version get
Common errors and fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| Precheck fails on a credential | Expired or locked account password | Rotate the account in password management, covered in Part 6, then rerun prechecks |
| Target version not listed | Depot metadata is stale or binaries are missing | Click Sync, then Download the bundle, or import it through the offline depot in Part 4 |
| Patch planner is blocked | An upgrade plan already exists for the domain | Cancel the open upgrade plan, then create the patch plan |
| Precheck flags space or health | Low disk on an appliance or an open alert | Clear the flagged alert, free appliance space, then rerun prechecks |
Common questions
Whether Express Patches must be applied in order
No. Each Express Patch is independent and cumulative, so you can apply the latest patch for a component without applying earlier ones. When a level includes a Fleet Lifecycle fix, apply that one first.
Difference between a maintenance release and an Express Patch
A maintenance release moves the whole stack through a defined component sequence. An Express Patch delivers a single fix, often for security, and can be applied on its own between maintenance releases.
Whether every component must be patched at each level
No. A patch level touches only the components listed in its release notes. Patch what applies to your fleet and leave the rest at their current version.
Where offline depot setup is documented
Part 4 of this series covers building and populating an offline depot with the VCF Download Tool. This part assumes the binaries are already reachable in your depot.
References
VCF Async Patch Tool Options, Broadcom TechDocs
Applying Individual Product Updates Using the Async Patch Tool, Broadcom KB
VCF 9.1.0.x Patch Releases, Broadcom TechDocs
For a wider view of what changed between releases, see VMware Cloud Foundation 9.0 vs 9.1, and for the operating model behind this series, start with Part 1. If you have not built the fleet yet, the VCF 9.1 Deployment complete guide covers the mandatory build work.
About The Author
