VMware vDefend FirewallVMware vDefend Firewall with Advanced Threat Prevention
Issue/Introduction
After deploying SSP, this workflow could be used to patch the deployed SSP setups. Hot patches are given to particular customers on need basis.
Environment
SSP 5.1
Cause
SSP bundles consist of Helm charts and Container images. Helm charts consume to the co-packaged container images. Each image is referred by their immutable digest
Hot patch Bundles allow updating a single SSP chart or image. Aimed at addressing customer specific issues to meet SLAs. Allows shipping the “diff” (<1 GB) and only change what’s needed
Hot patch bundles are tied to a certain base bundle version. Installing a Hot patch Bundle is analogous to installing a regular Bundle. Upgrading to a Hot patch bundle functions exactly like upgrading to another regular SSP version. But only a subset of the SSP Helm charts/K8S resources will be updated
The main difference lies in the build/packaging process
Considerations:
Uploading a Hot patch bundle is only allowed if the associated base version exists Deleting a Hot patch bundle is not allowed; it will be deleted once the base version is deleted Hot patch bundles may not be fresh-installed - they must always be upgraded to
Troubleshooting Methodologies
Standard SSP upgrade troubleshooting methods apply. Hot Patch bundle specific considerations:
Upon upload:
"Incompatible bundle, required base version 5.1.0-0.0-24973004 does not exist"
Upon consumption:
Both Hot Patch bundles and their base versions will be marked as “In use” in the UI
Upon delete:
"Patch bundles cannot be deleted directly"
Resolution
How to apply a SSP patch:
In SSPI, upload the patch bundle similar to uploading a regular bundle.
Switch to SSP UI and navigate to Upgrade section.
Choose the patch version and start "Upgrade"
Verify that the components in the patch are upgraded (version in UI reflects the patch version). Rest of the components would be at the base version.