VMware safe patching with snapshot rollback

Patch VMware vCenter virtual machines safely with an automated snapshot, OS upgrade, health probe, and rollback workflow. This Kestra blueprint captures a pre-patch VM snapshot in vCenter, runs apt-get upgrade over SSH, reboots the guest, verifies a /health endpoint, and automatically restores the snapshot if anything goes wrong. It closes the gap between vCenter snapshot management, Linux package updates, and incident response on Slack, all in one declarative YAML flow.

How it works

1. pre_patch_snapshot calls io.kestra.plugin.ee.vmware.vcenter.CreateVmSnapshot to take a named snapshot (pre-patch-{{ execution.startDate }}) tagged with the Kestra execution id.
2. apply_patches runs io.kestra.plugin.scripts.shell.Commands to SSH into the VM as ops@{{ inputs.vm_address }}, executes sudo apt-get update && sudo apt-get -y upgrade && sudo reboot, with allowFailure: true so the post-checks still run.
3. wait_for_boot uses io.kestra.plugin.core.flow.Pause for PT1M to let the guest come back online.
4. health_check calls io.kestra.plugin.core.http.Request against http://{{ inputs.vm_address }}/health with a constant retry policy (10 attempts, 30 seconds apart).
5. notify_success posts a green Slack message via io.kestra.plugin.slack.notifications.SlackIncomingWebhook.
6. The errors branch fires RestoreVmFromSnapshot to roll back, then sends an :alert: Slack message linking back to the failing execution.

What you get

• Deterministic snapshot naming tied to each execution, so rollback always targets the right restore point.
• Automatic rollback to a known-good VM state when patching or health checks fail.
• Built-in HTTP health probe with retries, no extra scripting required.
• Slack notifications for both success and failure paths.
• End-to-end execution lineage in Kestra: inputs, task outputs, logs, and snapshot ids.

Who it's for

• Platform and infrastructure engineers running vSphere or vCenter fleets.
• SREs who want patching windows to be auditable and reversible.
• Ops teams replacing manual change-window runbooks with declarative workflows.

Why orchestrate this with Kestra

vCenter scheduled tasks can snapshot a VM, but they cannot chain that snapshot to an SSH-driven OS upgrade, an HTTP readiness probe, a conditional rollback, and a Slack alert in one auditable run. Kestra wires those steps together with declarative YAML, retries on the health check, an errors branch for automatic recovery, and full execution lineage. You can trigger the flow from a cron schedule, a webhook from your patch-management system, or an upstream CVE event, then inspect every step from one UI.

Prerequisites

• A reachable vCenter server (set in pluginDefaults.server) and a VM in inventory.
• SSH access from Kestra workers to the target VM as user ops with passwordless sudo.
• An HTTP /health endpoint on the VM that returns 2xx when the workload is ready.
• Kestra Enterprise Edition (the io.kestra.plugin.ee.vmware plugin requires EE).

Secrets

• VMWARE_VCENTER_USERNAME: vCenter user with snapshot and restore permission.
• VMWARE_VCENTER_PASSWORD: password for that vCenter user.
• SLACK_WEBHOOK: Slack Incoming Webhook URL for success and failure notifications.

Quick start

1. Set the three secrets above in your Kestra tenant.
2. Update pluginDefaults.server to your vCenter FQDN.
3. Adjust the SSH command in apply_patches to match your guest OS (apt-get for Debian/Ubuntu, dnf or yum for RHEL/CentOS/Rocky).
4. Run the flow with vm_name and vm_address for a non-production VM first to validate the snapshot, reboot, and rollback paths.
5. Wire it to a schedule, webhook, or upstream patch-detection flow.

How to extend

• Add a Schedule trigger to run during your maintenance window.
• Replace the shell SSH step with io.kestra.plugin.ansible.cli.AnsibleCLI to apply a hardened playbook.
• Loop over a list of VMs using ForEach to patch a fleet sequentially or in parallel batches.
• Replace the simple /health probe with multiple checks (TCP, application-level, database connectivity).
• Open a ServiceNow or Jira change ticket before patching and close it after success.
• Promote the snapshot to a vCenter template after a successful patch as your new gold image.

Links

• Plugin docs: https://kestra.io/plugins/plugin-ee-vmware
• Orchestrate VMware with Kestra: https://kestra.io/orchestration/vmware