Hi everyone,
Historically we have always installed servers using the latest available packages at the time of provisioning, without a consistent policy for freezing versions afterwards. This approach has caused us issues during patching — most notably we have run into problems when the latest UEK (Unbreakable Enterprise Kernel) was not enabled or was inconsistent across servers, leading to unexpected behaviour when applying patches. This has contributed to the version drift we now have across the environment.
We need to guarantee that the OS patch state applied in our test environment can be exactly replicated in production, even if several months pass between both patching windows. This delay is unavoidable as we depend on other teams to validate that a given patch combination is stable before we can proceed with production.
- We have around 250 servers running a mix of Oracle Linux 8 and Oracle Linux 9, each potentially on a different minor release due to historical provisioning without a consistent patching policy
- Servers are organized in prod/test pairs, but version drift exists both between pairs and within pairs
Is freezing the exact package list from test (e.g. via rpm -qa output) and using it as a baseline for production a valid and common approach? Or is a local frozen repo snapshot the only reliable way to guarantee this in the long term?