LAB 58 ‐ Patching in OCI - DevWithNehaCloud/Oracle-Cloud-Infrastructure-wiki GitHub Wiki

What is Patching in OCI?

Patching is the process of applying updates, security fixes, bug fixes, and performance improvements to operating systems and software running on OCI compute instances.

Organizations perform patching regularly to keep servers secure, stable, and compliant with organizational security standards.

Why Do We Use Patching?

  • Security Enhancement – Fixes known vulnerabilities and protects systems from security threats.
  • Bug Fixes – Resolves software defects and operational issues.
  • Performance Improvement – Improves system stability and overall performance.
  • Compliance Requirements – Helps meet security and regulatory standards.
  • Feature Updates – Provides access to new enhancements and supported functionalities.
  • System Reliability – Reduces the risk of failures caused by outdated packages and software.

OCI OS Management Hub (OSMH)

In OCI, patching can be automated and centrally managed using OS Management Hub (OSMH). It allows administrators to organize instances into groups, create patch jobs, schedule maintenance windows, monitor patch status, and maintain consistent patch levels across environments such as Dev, Test, and Production.

Suggested Setup

Instance Purpose
ol-dev-1 Dev Group
ol-dev-2 Dev Group
ol-test-1 Test Group

With this setup, you can:

  • Onboard multiple instances
  • Test grouping functionality
  • Create separate Dev and Test groups
  • Run group-level patch jobs
  • Verify Work Requests

Step 1: Create 3 Oracle Linux Instances

  • OS: Oracle Linux 8/9
  • Shape: VM.Standard.E4.Flex (1 OCPU, 6 GB RAM is sufficient)
  • Can be kept in the same VCN
  • Assign Public IPs to keep the setup straightforward

Instance Names:

  • ol-dev-1
  • ol-dev-2
  • ol-test-1

Step 2: Create Dynamic Group

  • Navigate to: Identity & Security → Domains → Dynamic Groups
  • Rule:
ALL {instance.compartment.id = '<Compartment_OCID>'}

(Alternatively, you can create rules targeting specific instance OCIDs)

Step 3: Create IAM Policy

  • Create a compartment-level policy:
Allow dynamic-group OSMH-DG to use osmh-managed-instances in compartment <compartment-name>
Allow dynamic-group OSMH-DG to read instances in compartment <compartment-name>
Allow dynamic-group OSMH-DG to use instance-agent-command-execution-family in compartment <compartment-name>

Step 4: Enable Oracle Cloud Agent Plugins

  • Navigate to: Instance → Oracle Cloud Agent
  • Enable:
    • OS Management Hub Agent
    • Run Command
  • Wait 5–10 minutes for initialization.

Step 5: Open OS Management Hub

  • Navigate to: Menu → Compute → OS Management Hub
  • Check: Managed Instances
  • All 3 instances should be visible and active.

Step 6: Create Groups

  • Navigate to: OS Management Hub → Groups

Dev Group

  • Add:
    • ol-dev-1
    • ol-dev-2

Test Group

  • Add:
    • ol-test-1

Step 7: Check Available Updates

  • Navigate to: Managed Instance → View Updates
  • OSMH will display available packages and updates.

Step 8: Create Patch Job

  • Navigate to: OS Management Hub → Jobs → Create Job
  • Configuration:
    • Update Type: Security Updates
    • Target: Dev Group
    • Execution: Run Now or Schedule Later

Step 9: Schedule Job

  • Example:
    • Every Sunday at 02:00 AM
    • Or run immediately for lab testing purposes.

Step 10: Monitor Work Requests

  • Navigate to: OSMH → Jobs → Work Requests
  • Verify lifecycle states:
    • Accepted
    • In Progress
    • Succeeded

Step 11: Validate

Log in to the instance and execute:

sudo dnf check-update

or

rpm -qa | tail

Verify that the updates are installed.

create instances

create dynamic group

give the compartment OCID(in which your VM's are) and click on create

create policy

first create profile

Enable Oracle Cloud Agent Plugins

Instance → Oracle Cloud Agent

Enable:

OS Management Hub Agent Run Command

Wait 5–10 minutes. by clicking on 3 dots enable it

go to every instances and enable it

“For new instances, we enable the OS Management Hub Agent during instance creation. If a Default Profile is configured for the required Oracle Linux version in that compartment, eligible new instances are automatically onboarded without manually setting the profile. For existing VMs, we use OCI CLI and Bash scripting to automate the agent enablement and bulk onboarding instead of configuring each VM manually.”

once enable

Create a group

Create Patch Job

OS Management Hub → Jobs → Create Job

Select:

Update Type = Security Updates Target = Dev Group

Run Now or Schedule Later

Step 10: Monitor Work Requests

OSMH → Jobs → Work Requests

Verify:

Accepted In Progress Succeeded

Validate

login on Instance :

sudo dnf check-update

OR

rpm -qa | tail

Check that updates are installed.

Interview Summary

"We created Oracle Linux instances, enabled the Oracle Cloud Agent and OS Management Hub plugin, configured the required IAM policies, and onboarded the instances into OSMH. After the instances appeared as managed instances, we created Dev and Test groups, checked available updates, and created patch jobs targeting specific groups. The jobs were scheduled during maintenance windows, monitored through Work Requests, and post-patch validation was performed to ensure application and service availability."