Update the Operating System of a Virtual Machine

Virtual Machines on Oracle Data Infrastructure Cloud@Customer have dnf configured through Oracle OS Management Hub. This article describes how to apply Oracle Linux package updates from within the VM by using dnf. This procedure does not update Oracle Grid Infrastructure or Oracle AI Database software. For those updates, see Update the Grid Infrastructure of a VM Cluster and Update a Database Home.

VMs on Oracle Data Infrastructure Cloud@Customer include Ksplice for supported kernel and user-space security updates without restarting the VM. Ksplice is disabled by default. Use the scripts in Configure automatic Ksplice updates to enable it.

Before you begin

Plan a maintenance window. Some package updates require a restart and can interrupt applications or databases running on the VM.
For a two-node VM cluster, update one VM at a time. Verify cluster and database health before updating the other VM.
VMs are configured to access Oracle OS Management Hub yum repositories through the system and CPS networks. For network requirements, see Network Setup. No additional configuration is required to access these repositories.
If you configure a third-party repository, verify that the VM can access it through the client network.
Connect to the VM as the opc user, which has sudo privileges.

Apply operating system package updates

Connect to the VM by using SSH.
Check for available updates:
```
sudo dnf check-update
```
The dnf command lists available package updates from the repositories enabled on the VM. Review the list and confirm that the enabled repositories are appropriate for this VM.
To update all installed packages for which updates are available, run:
```
sudo dnf upgrade
```
Review the proposed transaction and confirm it to continue.

To update one package and any required dependencies, specify the package name. For example, to update the bash package, run:
```
sudo dnf upgrade bash
```
For more information about dnf commands, see DNF Command References and Updating Software on Oracle Linux.
If many packages were updated, Oracle recommends restarting the VM so that core packages are running with the updated versions. To check whether a restart is required, run:
```
sudo dnf needs-restarting -r
```
If a restart is required, restart the VM during the planned maintenance window and verify that its applications and databases are available afterward.

Configure an additional Oracle Linux repository

Oracle OS Management Hub (OSMH) manages the repository configuration in /etc/yum.repos.d/osmh.repo. Do not add repositories to this file. Add any additional repositories in a separate repository file.

On the Oracle Linux Yum Server, get the repository URL for the VM’s Oracle Linux release.
Convert the URL for use by the VM:
- Replace yum.oracle.com with ${oci_osmh_yum}, the dnf variable provided on the VM.
- Remove index.html from the end of the URL.
- Keep the rest of the repository path unchanged.
For example, a URL in this form:
```
https://yum.oracle.com/repo/OracleLinux/OL8/<repository>/x86_64/index.html
```
becomes:
```
https://${oci_osmh_yum}/repo/OracleLinux/OL8/<repository>/x86_64/
```

Create or edit a separate repository file, such as /etc/yum.repos.d/additional.repo, and add a uniquely named repository entry. For example:

[additional_repo]
name=<repository_name>
baseurl=https://${oci_osmh_yum}/repo/OracleLinux/OL8/<repository>/x86_64/
sslverify=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
gpgcheck=1
enabled=1

Refresh the repository metadata and verify the repository:
```
sudo dnf --refresh repoinfo additional_repo
```

Configure a third-party repository

Use the repository URL and GPG key provided by the third-party software vendor. Some vendors provide an RPM that configures the repository file and installs or configures the GPG key. If the vendor provides one, follow the vendor’s documentation to install and configure it. Otherwise, add the repository in a separate .repo file; do not add it to /etc/yum.repos.d/osmh.repo. Replace the following example URLs with the vendor’s actual repository and key URLs.

Network access: Third-party repositories must be accessed through the VM’s client network. Ensure that third-party repository hosts are reachable through that network and that the required routes, DNS, and firewall access are configured. If the client network requires a proxy, set the repository’s proxy option to the approved client-network proxy. For direct access, set proxy= in the repository entry to disable a proxy inherited from /etc/dnf/dnf.conf for Oracle OS Management Hub integration. For more information, see the DNF Configuration Reference.

Create a repository file, such as /etc/yum.repos.d/third-party.repo, and add a uniquely named repository entry:

[third_party_example]
name=Example third-party repository
baseurl=https://repo.example.com/oraclelinux/8/$basearch/
proxy=
enabled=1
gpgcheck=1
gpgkey=https://repo.example.com/keys/RPM-GPG-KEY-example
sslverify=1

Keep package signature checking enabled and use the GPG key published by the vendor.

Refresh the repository metadata and verify the repository:
```
sudo dnf --refresh repoinfo third_party_example
```

For more information, see Managing custom software repositories.

Configure automatic Ksplice updates

Ksplice can apply supported kernel and user-space security updates without restarting. The following scripts enable or disable automatic Ksplice updates on VMs. Run the appropriate script, then enter kernel, userspace, or all when prompted. The default selection is kernel.

When enabled, automatic Ksplice updates check for and apply available updates for the selected component when the VM starts and once each day thereafter. This keeps supported kernel and user-space packages current without requiring a restart.

Note: For Ksplice user-space updates to apply successfully, first install the Ksplice-aware glibc and openssl packages. Run the following command to update the system packages from the enabled repositories:

sudo dnf update glibc openssl

Enable automatic updates:

sudo /opt/oracle/datainfracc/utils/enable_automatic_ksplice_updates.sh

Disable automatic updates:

sudo /opt/oracle/datainfracc/utils/disable_automatic_ksplice_updates.sh

For more information, see Configuring Ksplice Enhanced Client for Offline Mode and Configuring Ksplice Uptrack Clients for Offline Mode.