googleOsConfigPatchDeployment

Patch deployments are configurations that individual patch jobs use to complete a patch. These configurations include instance filter, package repository settings, and a schedule.

To get more information about PatchDeployment, see:

Example Usage - Os Config Patch Deployment Basic

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
new google.osConfigPatchDeployment.OsConfigPatchDeployment(this, "patch", {
  instance_filter: [
    {
      all: true,
    },
  ],
  one_time_schedule: [
    {
      execute_time: "2999-10-10T10:10:10.045123456Z",
    },
  ],
  patch_deployment_id: "patch-deploy",
});

Example Usage - Os Config Patch Deployment Daily

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
new google.osConfigPatchDeployment.OsConfigPatchDeployment(this, "patch", {
  instance_filter: [
    {
      all: true,
    },
  ],
  patch_deployment_id: "patch-deploy",
  recurring_schedule: [
    {
      time_of_day: [
        {
          hours: 0,
          minutes: 30,
          nanos: 20,
          seconds: 30,
        },
      ],
      time_zone: [
        {
          id: "America/New_York",
        },
      ],
    },
  ],
});

Example Usage - Os Config Patch Deployment Daily Midnight

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
new google.osConfigPatchDeployment.OsConfigPatchDeployment(this, "patch", {
  instance_filter: [
    {
      all: true,
    },
  ],
  patch_deployment_id: "patch-deploy",
  recurring_schedule: [
    {
      time_of_day: [
        {
          hours: 0,
          minutes: 0,
          nanos: 0,
          seconds: 0,
        },
      ],
      time_zone: [
        {
          id: "America/New_York",
        },
      ],
    },
  ],
});

Example Usage - Os Config Patch Deployment Instance

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const dataGoogleComputeImageMyImage =
  new google.dataGoogleComputeImage.DataGoogleComputeImage(this, "my_image", {
    family: "debian-11",
    project: "debian-cloud",
  });
const googleComputeInstanceFoobar = new google.computeInstance.ComputeInstance(
  this,
  "foobar",
  {
    boot_disk: [
      {
        initialize_params: [
          {
            image: dataGoogleComputeImageMyImage.selfLink,
          },
        ],
      },
    ],
    can_ip_forward: false,
    machine_type: "e2-medium",
    metadata: [
      {
        foo: "bar",
      },
    ],
    name: "patch-deploy-inst",
    network_interface: [
      {
        network: "default",
      },
    ],
    tags: ["foo", "bar"],
    zone: "us-central1-a",
  }
);
new google.osConfigPatchDeployment.OsConfigPatchDeployment(this, "patch", {
  instance_filter: [
    {
      instances: [googleComputeInstanceFoobar.id],
    },
  ],
  patch_config: [
    {
      yum: [
        {
          excludes: ["bash"],
          minimal: true,
          security: true,
        },
      ],
    },
  ],
  patch_deployment_id: "patch-deploy",
  recurring_schedule: [
    {
      monthly: [
        {
          month_day: 1,
        },
      ],
      time_of_day: [
        {
          hours: 0,
          minutes: 30,
          nanos: 20,
          seconds: 30,
        },
      ],
      time_zone: [
        {
          id: "America/New_York",
        },
      ],
    },
  ],
});

Example Usage - Os Config Patch Deployment Full

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
new google.osConfigPatchDeployment.OsConfigPatchDeployment(this, "patch", {
  duration: "10s",
  instance_filter: [
    {
      group_labels: [
        {
          labels: [
            {
              app: "web",
              env: "dev",
            },
          ],
        },
      ],
      instance_name_prefixes: ["test-"],
      zones: ["us-central1-a", "us-central-1c"],
    },
  ],
  patch_config: [
    {
      apt: [
        {
          excludes: ["python"],
          type: "DIST",
        },
      ],
      goo: [
        {
          enabled: true,
        },
      ],
      mig_instances_allowed: true,
      post_step: [
        {
          linux_exec_step_config: [
            {
              gcs_object: [
                {
                  bucket: "my-patch-scripts",
                  generation_number: "1523477886880",
                  object: "linux/post_patch_script",
                },
              ],
            },
          ],
          windows_exec_step_config: [
            {
              gcs_object: [
                {
                  bucket: "my-patch-scripts",
                  generation_number: "135920493447",
                  object: "windows/post_patch_script.ps1",
                },
              ],
              interpreter: "POWERSHELL",
            },
          ],
        },
      ],
      pre_step: [
        {
          linux_exec_step_config: [
            {
              allowed_success_codes: [0, 3],
              local_path: "/tmp/pre_patch_script.sh",
            },
          ],
          windows_exec_step_config: [
            {
              allowed_success_codes: [0, 2],
              interpreter: "SHELL",
              local_path: "C:\\Users\\user\\pre-patch-script.cmd",
            },
          ],
        },
      ],
      reboot_config: "ALWAYS",
      windows_update: [
        {
          classifications: ["CRITICAL", "SECURITY", "UPDATE"],
        },
      ],
      yum: [
        {
          excludes: ["bash"],
          minimal: true,
          security: true,
        },
      ],
      zypper: [
        {
          categories: ["security"],
        },
      ],
    },
  ],
  patch_deployment_id: "patch-deploy",
  recurring_schedule: [
    {
      monthly: [
        {
          week_day_of_month: [
            {
              day_of_week: "TUESDAY",
              week_ordinal: -1,
            },
          ],
        },
      ],
      time_of_day: [
        {
          hours: 0,
          minutes: 30,
          nanos: 20,
          seconds: 30,
        },
      ],
      time_zone: [
        {
          id: "America/New_York",
        },
      ],
    },
  ],
  rollout: [
    {
      disruption_budget: [
        {
          fixed: 1,
        },
      ],
      mode: "ZONE_BY_ZONE",
    },
  ],
});

Argument Reference

The following arguments are supported:

instanceFilter - (Required) VM instances to patch. Structure is documented below.
patchDeploymentId - (Required) A name for the patch deployment in the project. When creating a name the following rules apply:
- Must contain only lowercase letters, numbers, and hyphens.
- Must start with a letter.
- Must be between 1-63 characters.
- Must end with a number or a letter.
- Must be unique within the project.

The instanceFilter block supports:

all - (Optional) Target all VM instances in the project. If true, no other criteria is permitted.
groupLabels - (Optional) Targets VM instances matching ANY of these GroupLabels. This allows targeting of disparate groups of VM instances. Structure is documented below.
zones - (Optional) Targets VM instances in ANY of these zones. Leave empty to target VM instances in any zone.
instances - (Optional) Targets any of the VM instances specified. Instances are specified by their URI in the formZones/{{zone}}/instances/{{instanceName}}, projects/{{projectId}}/zones/{{zone}}/instances/{{instanceName}}, or https://wwwGoogleapisCom/compute/v1/projects/{{projectId}}/zones/{{zone}}/instances/{{instanceName}}
instanceNamePrefixes - (Optional) Targets VMs whose name starts with one of these prefixes. Similar to labels, this is another way to group VMs when targeting configs, for example prefix="prod-".

The groupLabels block supports:

labels - (Required) Compute Engine instance labels that must be present for a VM instance to be targeted by this filter

description - (Optional) Description of the patch deployment. Length of the description is limited to 1024 characters.
patchConfig - (Optional) Patch configuration that is applied. Structure is documented below.
duration - (Optional) Duration of the patch. After the duration ends, the patch times out. A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s"
oneTimeSchedule - (Optional) Schedule a one-time execution. Structure is documented below.
recurringSchedule - (Optional) Schedule recurring executions. Structure is documented below.
rollout - (Optional) Rollout strategy of the patch job. Structure is documented below.
project - (Optional) The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

The patchConfig block supports:

migInstancesAllowed - (Optional) Allows the patch job to run on Managed instance groups (MIGs).
rebootConfig - (Optional) Post-patch reboot settings. Possible values are default, always, and never.
apt - (Optional) Apt update settings. Use this setting to override the default apt patch rules. Structure is documented below.
yum - (Optional) Yum update settings. Use this setting to override the default yum patch rules. Structure is documented below.
goo - (Optional) goo update settings. Use this setting to override the default goo patch rules. Structure is documented below.
zypper - (Optional) zypper update settings. Use this setting to override the default zypper patch rules. Structure is documented below.
windowsUpdate - (Optional) Windows update settings. Use this setting to override the default Windows patch rules. Structure is documented below.
preStep - (Optional) The ExecStep to run before the patch update. Structure is documented below.
postStep - (Optional) The ExecStep to run after the patch update. Structure is documented below.

The apt block supports:

type - (Optional) By changing the type to DIST, the patching is performed using apt-get dist-upgrade instead. Possible values are dist and upgrade.
excludes - (Optional) List of packages to exclude from update. These packages will be excluded.
exclusivePackages - (Optional) An exclusive list of packages to be updated. These are the only packages that will be updated. If these packages are not installed, they will be ignored. This field cannot be specified with any other patch configuration fields.

The yum block supports:

security - (Optional) Adds the --security flag to yum update. Not supported on all platforms.
minimal - (Optional) Will cause patch to run yum update-minimal instead.
excludes - (Optional) List of packages to exclude from update. These packages will be excluded.
exclusivePackages - (Optional) An exclusive list of packages to be updated. These are the only packages that will be updated. If these packages are not installed, they will be ignored. This field cannot be specified with any other patch configuration fields.

The goo block supports:

enabled - (Required) goo update settings. Use this setting to override the default goo patch rules.

The zypper block supports:

withOptional - (Optional) Adds the --with-optional flag to zypper patch.
withUpdate - (Optional) Adds the --with-update flag, to zypper patch.
categories - (Optional) Install only patches with these categories. Common categories include security, recommended, and feature.
severities - (Optional) Install only patches with these severities. Common severities include critical, important, moderate, and low.
excludes - (Optional) List of packages to exclude from update.
exclusivePatches - (Optional) An exclusive list of patches to be updated. These are the only patches that will be installed using 'zypper patch patch:' command. This field must not be used with any other patch configuration fields.

The windowsUpdate block supports:

classifications - (Optional) Only apply updates of these windows update classifications. If empty, all updates are applied. Each value may be one of critical, security, definition, driver, featurePack, servicePack, tool, updateRollup, and update.
excludes - (Optional) List of KBs to exclude from update.
exclusivePatches - (Optional) An exclusive list of kbs to be updated. These are the only patches that will be updated. This field must not be used with other patch configurations.

The preStep block supports:

linuxExecStepConfig - (Optional) The ExecStepConfig for all Linux VMs targeted by the PatchJob. Structure is documented below.
windowsExecStepConfig - (Optional) The ExecStepConfig for all Windows VMs targeted by the PatchJob. Structure is documented below.

The linuxExecStepConfig block supports:

allowedSuccessCodes - (Optional) Defaults to [0]. A list of possible return values that the execution can return to indicate a success.
interpreter - (Optional) The script interpreter to use to run the script. If no interpreter is specified the script will be executed directly, which will likely only succeed for scripts with shebang lines. Possible values are shell and powershell.
localPath - (Optional) An absolute path to the executable on the VM.
gcsObject - (Optional) A Cloud Storage object containing the executable. Structure is documented below.

The gcsObject block supports:

bucket - (Required) Bucket of the Cloud Storage object.
object - (Required) Name of the Cloud Storage object.
generationNumber - (Required) Generation number of the Cloud Storage object. This is used to ensure that the ExecStep specified by this PatchJob does not change.

The windowsExecStepConfig block supports:

allowedSuccessCodes - (Optional) Defaults to [0]. A list of possible return values that the execution can return to indicate a success.
interpreter - (Optional) The script interpreter to use to run the script. If no interpreter is specified the script will be executed directly, which will likely only succeed for scripts with shebang lines. Possible values are shell and powershell.
localPath - (Optional) An absolute path to the executable on the VM.
gcsObject - (Optional) A Cloud Storage object containing the executable. Structure is documented below.

The gcsObject block supports:

bucket - (Required) Bucket of the Cloud Storage object.
object - (Required) Name of the Cloud Storage object.
generationNumber - (Required) Generation number of the Cloud Storage object. This is used to ensure that the ExecStep specified by this PatchJob does not change.

The postStep block supports:

linuxExecStepConfig - (Optional) The ExecStepConfig for all Linux VMs targeted by the PatchJob. Structure is documented below.
windowsExecStepConfig - (Optional) The ExecStepConfig for all Windows VMs targeted by the PatchJob. Structure is documented below.

The linuxExecStepConfig block supports:

allowedSuccessCodes - (Optional) Defaults to [0]. A list of possible return values that the execution can return to indicate a success.
interpreter - (Optional) The script interpreter to use to run the script. If no interpreter is specified the script will be executed directly, which will likely only succeed for scripts with shebang lines. Possible values are shell and powershell.
localPath - (Optional) An absolute path to the executable on the VM.
gcsObject - (Optional) A Cloud Storage object containing the executable. Structure is documented below.

The gcsObject block supports:

bucket - (Required) Bucket of the Cloud Storage object.
object - (Required) Name of the Cloud Storage object.
generationNumber - (Required) Generation number of the Cloud Storage object. This is used to ensure that the ExecStep specified by this PatchJob does not change.

The windowsExecStepConfig block supports:

allowedSuccessCodes - (Optional) Defaults to [0]. A list of possible return values that the execution can return to indicate a success.
interpreter - (Optional) The script interpreter to use to run the script. If no interpreter is specified the script will be executed directly, which will likely only succeed for scripts with shebang lines. Possible values are shell and powershell.
localPath - (Optional) An absolute path to the executable on the VM.
gcsObject - (Optional) A Cloud Storage object containing the executable. Structure is documented below.

The gcsObject block supports:

bucket - (Required) Bucket of the Cloud Storage object.
object - (Required) Name of the Cloud Storage object.
generationNumber - (Required) Generation number of the Cloud Storage object. This is used to ensure that the ExecStep specified by this PatchJob does not change.

The oneTimeSchedule block supports:

executeTime - (Required) The desired patch job execution time. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

The recurringSchedule block supports:

timeZone - (Required) Defines the time zone that timeOfDay is relative to. The rules for daylight saving time are determined by the chosen time zone. Structure is documented below.
startTime - (Optional) The time that the recurring schedule becomes effective. Defaults to createTime of the patch deployment. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
endTime - (Optional) The end time at which a recurring patch deployment schedule is no longer active. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
timeOfDay - (Required) Time of the day to run a recurring deployment. Structure is documented below.
lastExecuteTime - (Output) The time the last patch job ran successfully. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
nextExecuteTime - (Output) The time the next patch job is scheduled to run. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
weekly - (Optional) Schedule with weekly executions. Structure is documented below.
monthly - (Optional) Schedule with monthly executions. Structure is documented below.

The timeZone block supports:

id - (Required) IANA Time Zone Database time zone, e.g. "America/New_York".
version - (Optional) IANA Time Zone Database version number, e.g. "2019a".

The timeOfDay block supports:

hours - (Optional) Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.
minutes - (Optional) Minutes of hour of day. Must be from 0 to 59.
seconds - (Optional) Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.
nanos - (Optional) Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

The weekly block supports:

dayOfWeek - (Required) IANA Time Zone Database time zone, e.g. "America/New_York". Possible values are monday, tuesday, wednesday, thursday, friday, saturday, and sunday.

The monthly block supports:

weekDayOfMonth - (Optional) Week day in a month. Structure is documented below.
monthDay - (Optional) One day of the month. 1-31 indicates the 1st to the 31st day. -1 indicates the last day of the month. Months without the target day will be skipped. For example, a schedule to run "every month on the 31st" will not run in February, April, June, etc.

The weekDayOfMonth block supports:

weekOrdinal - (Required) Week number in a month. 1-4 indicates the 1st to 4th week of the month. -1 indicates the last week of the month.
dayOfWeek - (Required) A day of the week. Possible values are monday, tuesday, wednesday, thursday, friday, saturday, and sunday.

The rollout block supports:

mode - (Required) Mode of the patch rollout. Possible values are zoneByZone and concurrentZones.
disruptionBudget - (Required) The maximum number (or percentage) of VMs per zone to disrupt at any given moment. The number of VMs calculated from multiplying the percentage by the total number of VMs in a zone is rounded up. During patching, a VM is considered disrupted from the time the agent is notified to begin until patching has completed. This disruption time includes the time to complete reboot and any post-patch steps. A VM contributes to the disruption budget if its patching operation fails either when applying the patches, running pre or post patch steps, or if it fails to respond with a success notification before timing out. VMs that are not running or do not have an active agent do not count toward this disruption budget. For zone-by-zone rollouts, if the disruption budget in a zone is exceeded, the patch job stops, because continuing to the next zone requires completion of the patch process in the previous zone. For example, if the disruption budget has a fixed value of 10, and 8 VMs fail to patch in the current zone, the patch job continues to patch 2 VMs at a time until the zone is completed. When that zone is completed successfully, patching begins with 10 VMs at a time in the next zone. If 10 VMs in the next zone fail to patch, the patch job stops. Structure is documented below.

The disruptionBudget block supports:

fixed - (Optional) Specifies a fixed value.
percentage - (Optional) Specifies the relative value defined as a percentage, which will be multiplied by a reference value.

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

id - an identifier for the resource with format {{name}}
name - Unique name for the patch deployment resource in a project. The patch deployment name is in the form: projects/{project_id}/patchDeployments/{patchDeploymentId}.
createTime - Time the patch deployment was created. Timestamp is in RFC3339 text format. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
updateTime - Time the patch deployment was last updated. Timestamp is in RFC3339 text format. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".
lastExecuteTime - The last time a patch job was started by this deployment. Timestamp is in RFC3339 text format. A timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds. Example: "2014-10-02T15:01:23.045123456Z".

Timeouts

This resource provides the following Timeouts configuration options:

create - Default is 20 minutes.
delete - Default is 20 minutes.

Import

PatchDeployment can be imported using any of these accepted formats:

$ terraform import google_os_config_patch_deployment.default projects/{{project}}/patchDeployments/{{name}}
$ terraform import google_os_config_patch_deployment.default {{project}}/{{name}}
$ terraform import google_os_config_patch_deployment.default {{name}}

User Project Overrides

This resource supports User Project Overrides.