How to use Livepatch client with an on-prem server

Network access

Machines running livepatch-client will need network access to the on-prem server. HTTPS (:443) or HTTP (:80) is used, depending on how the livepatch on-prem haproxy and the livepatch application’s url_template setting are configured.

In addition to that, machines will require access to the Canonical snap store to install the livepatch client snap:

Generating the authorization token

To configure this livepatch client to start pulling patches from the on-prem livepatch server, an authorization token is necessary. To issue it, run:

$ livepatch-admin auth-token <id> <tier>

The tier parameter is one of the tiers available on the server. The client will download patches as they become available in that tier. See this page on how to manage tiers and patches in your on-prem server.

The id parameter bears no significance in an on-prem deployment. It can be set to a value identifying the group of livepatch clients that will be enabled using the same token (a single authorization token can be used to enable multiple client instances).

Configuring livepatch client

To start applying livepatches to a machine, it is necessary to install the livepatch client on it. Livepatch client is currently distributed as a snap. On the machine run:

$ sudo snap install canonical-livepatch

Once the client is installed, it needs to be configured to pull patches from the on-prem server:

$ canonical-livepatch config remote-server="http(s)://<hostname>"

The authorization token returned can be then used to attach any number of machines to the on-prem livepatch server:

$ canonical-livepatch enable <token>

I struggle with the The tier parameter is one of the tiers available on the server. The client will download patches as they become available in that tier. part.

According to What are Livepatch tiers?, the tier options should be Internal, Updates, Stable - but when I try to use updates with my on-prem server, it returns an error. Stable works, but I am not able to figure out how these tiers are defined in my server, or how I can check which are available.

The document could be improved in this area by providing the reader with a hint on how to find out what tiers are available on their server.

Hi @maarten256, that’s a great point. We have a page here on patch management that shows some commands you can use with the Livepatch Admin tool to view what tiers are available, add tiers, promote patches into tiers, etc.

I will link that page in this doc to aid future readers.

2 Likes