Design goals
- Production gets exactly the packages that were tested in dev/test, not whatever was published upstream last night.
- HA pairs and clusters are never patched at the same time.
- Compliance is visible per owner, without spreadsheets.
1. Lifecycle environments
Vendor repos ─► custom software source snapshot (e.g. 2026-11 patch set)
└─► Dev stage ──(test, approve)──► Test stage ──(approve)──► Prod stage
A lifecycle environment has stages (dev, test, prod). You promote a versioned custom software source from stage to stage. Each instance is attached to a stage, so it only sees the package set promoted to that stage.
2. Group instances
| Group | Members |
|---|---|
prod-web-a | First half of web tier (fault domain 1) |
prod-web-b | Second half (fault domain 2/3) |
prod-db-standby | Data Guard standbys (patch first) |
prod-db-primary | Primaries (after switchover or in window) |
exception | Vendor-restricted systems |
Managed instance groups make scheduling and reporting per group easy. Split by fault domain so a group never contains every node of a service.
3. Schedule
| Week (after patch set creation) | Action |
|---|---|
| 1 | Promote to Dev; patch dev groups |
| 2 | Promote to Test; patch test groups; run app tests |
| 3 | Promote to Prod; patch prod-*-a / standbys |
| 3–4 | Patch prod-*-b / primaries after checking group A |
Scheduled jobs in OS Management Hub install updates (all, security only, or specific advisories) and can reboot. For Windows, define update classifications per group.
4. Pre and post steps
- Drain instances from load balancer backend sets before patching (script or automation), re-add after health checks pass.
- Database tiers: switch over Data Guard before patching the primary host.
- Post-reboot checks: services running, application health endpoint OK. Alert on failure.
These steps sit in your automation (Functions, Ansible, Resource Manager jobs) triggered around the scheduled job.
5. Ksplice for less rebooting
On Oracle Linux, Ksplice can apply kernel and selected user-space security updates without reboot. Use it to close critical vulnerabilities quickly between maintenance windows, and still reboot periodically for full updates.
6. Reporting
- Instances by stage and patch set; instances missing security advisories; instances not reporting (agent issues).
- Per-owner reports using defined tags.
- Evidence for audits: job history with success/failure per instance.
7. Exceptions and emergencies
- Exception group: documented reason, owner, compensating controls, expiry date.
- Emergency (critical CVE): create a patch set with the specific advisory, promote quickly with approval, patch prod in an ad-hoc window, report until closed.
Warning
Attaching production instances directly to vendor repositories skips your testing. Package versions can differ between test and prod by the time prod patches. Use versioned software source snapshots.
Checklist
- Lifecycle environment with dev/test/prod stages
- Versioned software sources promoted stage by stage
- Instance groups split by fault domain/HA role
- Schedules with pre/post steps and health checks
- Ksplice for urgent fixes on Oracle Linux
- Compliance reports and exception process