Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Patch the operating system of a cluster

This tutorial shows how to apply operating system updates to the nodes of a running Amazon ParallelCluster cluster by building a patched AMI and updating the cluster to use it, without recreating the cluster from scratch.

The procedure has three steps:

Steps 1 and 3 both apply OS updates to a node with the same commands, defined in Patch a node.

Step 1: Build a patched AMI

Build a custom AMI that includes the OS updates:

Note the ID of the resulting patched AMI, for example ami-123456789, as you will use it in the next step.

Step 2: Update the compute and login nodes to the patched AMI

Step 3: Patch the head node

The head node is a static instance, so you patch it in place and then reboot it.

Patch a node

Apply all available OS updates with the node's package manager, using the commands for the node's operating system. These commands are used both when building a patched AMI (Step 1: Build a patched AMI) and when patching the head node (Step 3: Patch the head node).

Amazon Linux 2023

# Refresh the package manager cache.
sudo dnf clean all
sudo dnf makecache --refresh -y

# No kernel cap needed: the Lustre module ships in-tree with the kernel.

# Apply all available updates.
sudo dnf upgrade -y

RHEL 8, RHEL 9, Rocky Linux 8, and Rocky Linux 9

# Refresh the package manager cache.
sudo dnf clean all
sudo dnf makecache --refresh -y

# Determine the kernel cap: the newest kernel version supported by the FSx for Lustre client.
# We assume 5.14.0-503.11.1.el9_5.x86_64; set kernel_cap to the newest kernel your Lustre client supports.
kernel_cap=5.14.0-503.11.1.el9_5.x86_64

# Cap the kernel at that version and version-lock it.
sudo dnf install -y python3-dnf-plugin-versionlock
sudo dnf versionlock add "kernel-${kernel_cap}" "kernel-core-${kernel_cap}" "kernel-modules-${kernel_cap}" "kernel-modules-core-${kernel_cap}" "kernel-tools-${kernel_cap}"

# Apply all available updates.
sudo dnf upgrade -y

# Refresh the Lustre client for the kernel about to boot.
new_kernel=$(rpm -q kernel --qf '%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort -V | tail -n1)
if ! modinfo -k "$new_kernel" lustre >/dev/null 2>&1; then
  sudo sed -i -E "s#(/el/)[0-9]+(\.[0-9]+)?#\1$(. /etc/os-release && echo "$VERSION_ID")#" /etc/yum.repos.d/aws-fsx.repo
  sudo dnf clean metadata
  sudo dnf upgrade -y kmod-lustre-client lustre-client
fi

Ubuntu 22.04 and 24.04

# Refresh the package manager cache.
sudo DEBIAN_FRONTEND=noninteractive apt-get update -y

# Determine the kernel cap: the newest kernel version supported by the FSx for Lustre client.
# We assume 6.8.0-1021-aws; set kernel_cap to the newest kernel your Lustre client supports.
kernel_cap=6.8.0-1021-aws

# Cap the kernel at that version and version-lock it.
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y "linux-image-${kernel_cap}" "linux-headers-${kernel_cap}" "linux-modules-${kernel_cap}"
# linux-modules-extra carries the InfiniBand/RDMA modules and ships separately only up to
# the 6.17 series; from the 7.0.0 series those modules are folded into linux-modules (installed above)
# and linux-modules-extra is no longer published.
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y "linux-modules-extra-${kernel_cap}" \
    || echo "WARNING: linux-modules-extra-${kernel_cap} is not available; continuing without it"
sudo apt-mark hold linux-aws linux-image-aws linux-headers-aws

# Apply all available updates. The dpkg options keep locally-modified config files
# (e.g. efs-utils.conf); without them dpkg prompts and aborts on EOF, and
# DEBIAN_FRONTEND=noninteractive does not cover this.
sudo DEBIAN_FRONTEND=noninteractive apt-get upgrade -y -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-confdef"

# Refresh the Lustre client for the kernel about to boot.
new_kernel=$(dpkg-query -W -f='${Package}\n' 'linux-image-*-aws' | sed 's/^linux-image-//' | grep -E '^[0-9]' | sort -V | tail -n1)
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y "lustre-client-modules-${new_kernel}" lustre-client-modules-aws

After applying the updates, on any operating system, reboot the node to activate them. A reboot is required when the update installs a new kernel:

$ sudo reboot