Google OS Config Patch Deployment

google_os_config_patch_deployment (Terraform)

The Patch Deployment in OS Config can be configured in Terraform with the resource name google_os_config_patch_deployment. The following sections describe 2 examples of how to use the resource and its parameters.

Example Usage from GitHub

rackspace-infrastructure-automation/mgcp-terraform-modules

resource "google_os_config_patch_deployment" "blue-windows" {
  patch_deployment_id = var.deployment_id_1


  instance_filter {
    group_labels {

jeremychauvet/gcp-terramearth-showroom

resource "google_os_config_patch_deployment" "patch" {
  patch_deployment_id = "patch-deploy-apt"

  instance_filter {
    group_labels {
      labels = {

Parameters

• create_time optional computed - string

Time the patch deployment was created. Timestamp is in RFC3339 text format. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

• description optional - string

Description of the patch deployment. Length of the description is limited to 1024 characters.

• duration optional - string

Duration of the patch. After the duration ends, the patch times out. A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s"

• id optional computed - string
• last_execute_time optional computed - string

The last time a patch job was started by this deployment. Timestamp is in RFC3339 text format. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

• name optional computed - string

Unique name for the patch deployment resource in a project. The patch deployment name is in the form: projects/[project_id]/patchDeployments/[patchDeploymentId].

• patch_deployment_id required - string

A name for the patch deployment in the project. When creating a name the following rules apply: Must contain only lowercase letters, numbers, and hyphens. Must start with a letter. Must be between 1-63 characters. Must end with a number or a letter. * Must be unique within the project.

• project optional computed - string
• update_time optional computed - string

Time the patch deployment was last updated. Timestamp is in RFC3339 text format. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

• instance_filter list block
  • all optional - bool

  Target all VM instances in the project. If true, no other criteria is permitted.

  • instance_name_prefixes optional - list of string

  Targets VMs whose name starts with one of these prefixes. Similar to labels, this is another way to group VMs when targeting configs, for example prefix="prod-".

  • instances optional - list of string

  Targets any of the VM instances specified. Instances are specified by their URI in the 'form zones/[[zone]]/instances/[[instance_name]]', 'projects/[[project_id]]/zones/[[zone]]/instances/[[instance_name]]', or 'https://www.googleapis.com/compute/v1/projects/[[project_id]]/zones/[[zone]]/instances/[[instance_name]]'

  • zones optional - list of string

  Targets VM instances in ANY of these zones. Leave empty to target VM instances in any zone.

  • group_labels list block
    • labels required - map from string to string

    Compute Engine instance labels that must be present for a VM instance to be targeted by this filter

• one_time_schedule list block
  • execute_time required - string

  The desired patch job execution time. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

• patch_config list block
  • reboot_config optional - string

  Post-patch reboot settings. Possible values: ["DEFAULT", "ALWAYS", "NEVER"]

  • apt list block
    • excludes optional - list of string

    List of packages to exclude from update. These packages will be excluded.

    • exclusive_packages optional - list of string

    An exclusive list of packages to be updated. These are the only packages that will be updated. If these packages are not installed, they will be ignored. This field cannot be specified with any other patch configuration fields.

    • type optional - string

    By changing the type to DIST, the patching is performed using apt-get dist-upgrade instead. Possible values: ["DIST", "UPGRADE"]

  • goo list block
    • enabled required - bool

    goo update settings. Use this setting to override the default goo patch rules.

  • post_step list block
    • linux_exec_step_config list block
      • allowed_success_codes optional - list of number

      Defaults to [0]. A list of possible return values that the execution can return to indicate a success.

      • interpreter optional - string

      The script interpreter to use to run the script. If no interpreter is specified the script will be executed directly, which will likely only succeed for scripts with shebang lines. Possible values: ["SHELL", "POWERSHELL"]

      • local_path optional - string

      An absolute path to the executable on the VM.

      • gcs_object list block
        • bucket required - string

        Bucket of the Cloud Storage object.

        • generation_number required - string

        Generation number of the Cloud Storage object. This is used to ensure that the ExecStep specified by this PatchJob does not change.

        • object required - string

        Name of the Cloud Storage object.

    • windows_exec_step_config list block
      • allowed_success_codes optional - list of number

      Defaults to [0]. A list of possible return values that the execution can return to indicate a success.

      • interpreter optional - string

      The script interpreter to use to run the script. If no interpreter is specified the script will be executed directly, which will likely only succeed for scripts with shebang lines. Possible values: ["SHELL", "POWERSHELL"]

      • local_path optional - string

      An absolute path to the executable on the VM.

      • gcs_object list block
        • bucket required - string

        Bucket of the Cloud Storage object.

        • generation_number required - string

        Generation number of the Cloud Storage object. This is used to ensure that the ExecStep specified by this PatchJob does not change.

        • object required - string

        Name of the Cloud Storage object.

  • pre_step list block
    • linux_exec_step_config list block
      • allowed_success_codes optional - list of number

      Defaults to [0]. A list of possible return values that the execution can return to indicate a success.

      • interpreter optional - string

      The script interpreter to use to run the script. If no interpreter is specified the script will be executed directly, which will likely only succeed for scripts with shebang lines. Possible values: ["SHELL", "POWERSHELL"]

      • local_path optional - string

      An absolute path to the executable on the VM.

      • gcs_object list block
        • bucket required - string

        Bucket of the Cloud Storage object.

        • generation_number required - string

        Generation number of the Cloud Storage object. This is used to ensure that the ExecStep specified by this PatchJob does not change.

        • object required - string

        Name of the Cloud Storage object.

    • windows_exec_step_config list block
      • allowed_success_codes optional - list of number

      Defaults to [0]. A list of possible return values that the execution can return to indicate a success.

      • interpreter optional - string

      The script interpreter to use to run the script. If no interpreter is specified the script will be executed directly, which will likely only succeed for scripts with shebang lines. Possible values: ["SHELL", "POWERSHELL"]

      • local_path optional - string

      An absolute path to the executable on the VM.

      • gcs_object list block
        • bucket required - string

        Bucket of the Cloud Storage object.

        • generation_number required - string

        Generation number of the Cloud Storage object. This is used to ensure that the ExecStep specified by this PatchJob does not change.

        • object required - string

        Name of the Cloud Storage object.

  • windows_update list block
    • classifications optional - list of string

    Only apply updates of these windows update classifications. If empty, all updates are applied. Possible values: ["CRITICAL", "SECURITY", "DEFINITION", "DRIVER", "FEATURE_PACK", "SERVICE_PACK", "TOOL", "UPDATE_ROLLUP", "UPDATE"]

    • excludes optional - list of string

    List of KBs to exclude from update.

    • exclusive_patches optional - list of string

    An exclusive list of kbs to be updated. These are the only patches that will be updated. This field must not be used with other patch configurations.

  • yum list block
    • excludes optional - list of string

    List of packages to exclude from update. These packages will be excluded.

    • exclusive_packages optional - list of string

    An exclusive list of packages to be updated. These are the only packages that will be updated. If these packages are not installed, they will be ignored. This field cannot be specified with any other patch configuration fields.

    • minimal optional - bool

    Will cause patch to run yum update-minimal instead.

    • security optional - bool

    Adds the --security flag to yum update. Not supported on all platforms.

  • zypper list block
    • categories optional - list of string

    Install only patches with these categories. Common categories include security, recommended, and feature.

    • excludes optional - list of string

    List of packages to exclude from update.

    • exclusive_patches optional - list of string

    An exclusive list of patches to be updated. These are the only patches that will be installed using 'zypper patch patch:' command. This field must not be used with any other patch configuration fields.

    • severities optional - list of string

    Install only patches with these severities. Common severities include critical, important, moderate, and low.

    • with_optional optional - bool

    Adds the --with-optional flag to zypper patch.

    • with_update optional - bool

    Adds the --with-update flag, to zypper patch.

• recurring_schedule list block
  • end_time optional - string

  The end time at which a recurring patch deployment schedule is no longer active. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

  • last_execute_time optional computed - string

  The time the last patch job ran successfully. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

  • next_execute_time optional computed - string

  The time the next patch job is scheduled to run. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

  • start_time optional - string

  The time that the recurring schedule becomes effective. Defaults to createTime of the patch deployment. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

  • monthly list block
    • month_day optional - number

    One day of the month. 1-31 indicates the 1st to the 31st day. -1 indicates the last day of the month. Months without the target day will be skipped. For example, a schedule to run "every month on the 31st" will not run in February, April, June, etc.

    • week_day_of_month list block
      • day_of_week required - string

      A day of the week. Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"]

      • week_ordinal required - number

      Week number in a month. 1-4 indicates the 1st to 4th week of the month. -1 indicates the last week of the month.

  • time_of_day list block
    • hours optional - number

    Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

    • minutes optional - number

    Minutes of hour of day. Must be from 0 to 59.

    • nanos optional - number

    Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

    • seconds optional - number

    Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

  • time_zone list block
    • id required - string

    IANA Time Zone Database time zone, e.g. "America/New_York".

    • version optional - string

    IANA Time Zone Database version number, e.g. "2019a".

  • weekly list block
    • day_of_week required - string

    IANA Time Zone Database time zone, e.g. "America/New_York". Possible values: ["MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY", "SUNDAY"]

• rollout list block
  • mode required - string

  Mode of the patch rollout. Possible values: ["ZONE_BY_ZONE", "CONCURRENT_ZONES"]

  • disruption_budget list block
    • fixed optional - number

    Specifies a fixed value.

    • percentage optional - number

    Specifies the relative value defined as a percentage, which will be multiplied by a reference value.

• timeouts single block
  • create optional - string
  • delete optional - string

Explanation in Terraform Registry

Patch deployments are configurations that individual patch jobs use to complete a patch. These configurations include instance filter, package repository settings, and a schedule. To get more information about PatchDeployment, see:

• API documentation
• How-to Guides
  • Official Documentation