Support hot patching mechanism in SSP
search cancel

Support hot patching mechanism in SSP

book

Article ID: 413883

calendar_today

Updated On:

Products

VMware vDefend Firewall VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

After deploying SSP, this workflow could be used to patch the deployed SSP setups. Hot patches are given to particular customers on need basis.

Environment

SSP 5.1

Cause

  • SSP bundles consist of Helm charts and Container images. Helm charts consume to the co-packaged container images. Each image is referred  by their immutable digest
  • Hot patch Bundles allow updating a single SSP chart or image. Aimed at addressing customer specific issues to meet SLAs. Allows shipping the “diff” (<1 GB) and only change what’s needed
  • Hot patch bundles are tied to a certain base bundle version. Installing a Hot patch Bundle is analogous to installing a regular Bundle. Upgrading to a Hot patch bundle functions exactly like upgrading to another regular SSP version. But only a subset of the SSP Helm charts/K8S resources will be updated
  • The main difference lies in the build/packaging process  


    Considerations:

Uploading a Hot patch bundle is only allowed if the associated base version exists
Deleting a Hot patch bundle is not allowed; it will be deleted once the base version is deleted
Hot patch bundles may not be fresh-installed - they must always be upgraded to


Troubleshooting Methodologies

Standard SSP upgrade troubleshooting methods apply. Hot Patch bundle specific considerations:

  • Upon upload:

"Incompatible bundle, required base version 5.1.0-0.0-24973004 does not exist"

  • Upon consumption:

Both Hot Patch bundles and their base versions will be marked as “In use” in the UI

  • Upon delete:

"Patch bundles cannot be deleted directly"

Resolution

How to apply a SSP patch:

  • In SSPI, upload the patch bundle similar to uploading a regular bundle.
  • Switch to SSP UI and navigate to Upgrade section.
  • Choose the patch version and start "Upgrade"
  • Verify that the components in the patch are upgraded (version in UI reflects the patch version). Rest of the components would be at the base version.