Proxmox VE: Are we getting too many kernel updates for an enterprise virtualization platform?

[Penobscot]

Back when we were on VxRails, the patches, which took 1-4 hours to apply for our cluster, would straggle in sometime after VMware released them. Having been burned once by Dell pulling a patch after I'd installed it, I learned to wait at least two weeks after it had been released before applying. Further, they encourage running an elaborate pre-flight check called VxVerify on all the nodes. Its findings occasionally required opening an SR, fixing the issue, and then patching.

So, no, I don't rush to apply patches, though the thought of guests breaking confinement is unsettling.

My Ubuntu servers all run a daily unattended update, but aren't necessarily in sync due to phasing and different OS versions.

My Windows servers get patched within a few days after the patch is available, though I stagger the DCs by days or weeks due to another learning experience.

 

[Johannes S]

Back when we were on VxRails, the patches, which took 1-4 hours to apply for our cluster, would straggle in sometime after VMware released them. Having been burned once by Dell pulling a patch after I'd installed it, I learned to wait at least two weeks after it had been released before applying. Further, they encourage running an elaborate pre-flight check called VxVerify on all the nodes. Its findings occasionally required opening an SR, fixing the issue, and then patching.

So, no, I don't rush to apply patches, though the thought of guests breaking confinement is unsettling.

Welcome to the new normal. In this age waiting multiple weeks just isn't feasible anymore. And even the idea of "first testing updates in a test environment" (e.g. a virtual PVE cluster inside your production cluster) doesn't really work since your test environment won't have the same production workloads which might get hurt by the patch. Imho you can't really do much than using clustering and then first patch one node, wait for any problems, then the next.
If something breaks, wipe the node and reinstall (cattle, not pets).
But not after multiple weeks, but more days if not hours since most known vulnerabilties get used by bad actors less than 24 hours after they are discovered:
https://zerodayclock.com/ They also have a timeline: https://zerodayclock.com/collapse

Even worse due to the amount of fixed CVEs etc in each kernel most admins don't have the time to triage whether they are actually vulnerable to a specific bug or not. It's way less work to assume that one of the multitude of issues fixed in the latest patch IS an issue on your system and just apply the patch instead of wasting time with triage.

My Windows servers get patched within a few days after the patch is available, though I stagger the DCs by days or weeks due to another learning experience.

Microsoft failing quality assurance is not a reason not to patch systems by other vendors.

 

[Etienne Charlier]

"I would love to see Proxmox adopt a more conservative kernel release strategy for production environments, while continuing to deliver critical security fixes promptly."

None forces you to apply each and every updates, but if you are too lazy to do it, please at least don't bring others with you !

 

[deebsr]

I'm hoping that Proxmox is looking at the updating issue and perhaps will be releasing some updates to PDM and POM to help address managing updates in large PVE environments. This is one area where proxmox has just not caught up to the competition yet.