Managing Patch Updates for Air-Gapped SLES15 Servers in Azure

SUSE Linux Enterprise Server
1

I’m currently managing a small environment of around 150 SLES15 servers in Azure, using a pay-as-you-go licensing model. These VMs are built from official SLES for SAP images. One challenge I’ve been facing is patching these servers since they are in an air-gapped environment with no direct internet connection.

The proposed solution from SUSE/Azure is SUSE Manager, but this hasn’t been approved in my company. I’ve been exploring using RMT as a lightweight solution, but it doesn’t support our licensing model.

The alternative I’m considering is using zypper with the --download-only option to download all the necessary packages on dedicated host and create custom repositories. However, I have some concerns:

  1. How can I ensure that zypper update --download-only will download all required packages?
  2. If the command is run at different intervals, and initially it downloads some_package.1.0.0.rpm, and in the next run it downloads some_package.1.0.1.rpm, will both versions of the package be available?
  3. Is it a recommended approach to create a new directory for each zypper update run to keep things organized?

I’d appreciate any advice or suggestions on managing this process effectively.

2

@rummy Hi, SUSE manager 5.0 would be the way to go (you can always get an eval license to test?). Perhaps consider upstream https://www.uyuni-project.org/

3

Sadly SUMA is not in scope, Uyuni being the upstream is excluded also.

4

@rummy then it would be RMT, an external and internal one and use the offline mode.

5

My license is through Azure, so I don’t have an account or access to scc.susecloud.com, which seems to be a requirement for RMT.

6

@rummy so an instance on Azure won’t work to pull updates?

7

It already pulls updates that way. I’m trying to ensure all instances are patched to the same level. RMT seems like the right choice, but it tries to sync with scc.suse.com, while I’m pulling all updates from smt-azure.susecloud.net. Additionally, all Azure repositories use the libzypp plugin, with URLs that look like plugin:/susecloud?credentials.

8

@rummy Then perhaps look at SALT Salt install guide

9

What does SALT has to do with patching? Are you referring to config management tool that stands behind the uyuni?

10

@rummy yes, could it be used to provide a way to update your systems with a record of patches applied etc.