google_os_config_patch_deployment

Patch deployments are configurations that individual patch jobs use to complete a patch. These configurations include instance filter, package repository settings, and a schedule.

To get more information about PatchDeployment, see:

Open in Cloud Shell

Example Usage - Os Config Patch Deployment Basic

resource "google_os_config_patch_deployment" "patch" {
  patch_deployment_id = "patch-deploy"

  instance_filter {
    all = true
  }

  one_time_schedule {
    execute_time = "2999-10-10T10:10:10.045123456Z"
  }
}
Open in Cloud Shell

Example Usage - Os Config Patch Deployment Daily

resource "google_os_config_patch_deployment" "patch" {
  patch_deployment_id = "patch-deploy"

  instance_filter {
    all = true
  }

  recurring_schedule {
    time_zone {
      id = "America/New_York"
    }

    time_of_day {
      hours = 0
      minutes = 30
      seconds = 30
      nanos = 20
    }
  }
}
Open in Cloud Shell

Example Usage - Os Config Patch Deployment Daily Midnight

resource "google_os_config_patch_deployment" "patch" {
  patch_deployment_id = "patch-deploy"

  instance_filter {
    all = true
  }

  recurring_schedule {
    time_zone {
      id = "America/New_York"
    }

    time_of_day {
      hours = 0
      minutes = 0
      seconds = 0
      nanos = 0
    }
  }
}
Open in Cloud Shell

Example Usage - Os Config Patch Deployment Instance

data "google_compute_image" "my_image" {
  family  = "debian-11"
  project = "debian-cloud"
}

resource "google_compute_instance" "foobar" {
  name           = "patch-deploy-inst"
  machine_type   = "e2-medium"
  zone           = "us-central1-a"
  can_ip_forward = false
  tags           = ["foo", "bar"]

  boot_disk {
    initialize_params {
      image = data.google_compute_image.my_image.self_link
    }
  }

  network_interface {
    network = "default"
  }

  metadata = {
    foo = "bar"
  }
}

resource "google_os_config_patch_deployment" "patch" {
  patch_deployment_id = "patch-deploy"

  instance_filter {
    instances = [google_compute_instance.foobar.id]
  }

  patch_config {
    yum {
      security = true
      minimal = true
      excludes = ["bash"]
    }
  }

  recurring_schedule {
    time_zone {
      id = "America/New_York"
    }

    time_of_day {
      hours = 0
      minutes = 30
      seconds = 30
      nanos = 20
    }

    monthly {
      month_day = 1
    }
  }
}
Open in Cloud Shell

Example Usage - Os Config Patch Deployment Full

resource "google_os_config_patch_deployment" "patch" {
  patch_deployment_id = "patch-deploy"

  instance_filter {
    group_labels {
      labels = {
        env = "dev",
        app = "web"
      }
    }

    instance_name_prefixes = ["test-"]

    zones = ["us-central1-a", "us-central-1c"]
  }

  patch_config {
    mig_instances_allowed = true

    reboot_config = "ALWAYS"

    apt {
      type = "DIST"
      excludes = ["python"]
    }

    yum {
      security = true
      minimal = true
      excludes = ["bash"]
    }

    goo {
      enabled = true
    }

    zypper {
      categories = ["security"]
    }

    windows_update {
      classifications = ["CRITICAL", "SECURITY", "UPDATE"]
      excludes = ["5012170"]
    }

    pre_step {
      linux_exec_step_config {
        allowed_success_codes = [0,3]
        local_path = "/tmp/pre_patch_script.sh"
      }

      windows_exec_step_config {
        interpreter = "SHELL"
        allowed_success_codes = [0,2]
        local_path  = "C:\\Users\\user\\pre-patch-script.cmd"
      }
    }

    post_step {
      linux_exec_step_config {
        gcs_object {
          bucket = "my-patch-scripts"
          generation_number = "1523477886880" 
          object = "linux/post_patch_script"
        }
      }

      windows_exec_step_config {
        interpreter = "POWERSHELL"
        gcs_object {
          bucket = "my-patch-scripts"
          generation_number = "135920493447"
          object = "windows/post_patch_script.ps1"
        }
      }
    }
  }

  duration = "10s"

  recurring_schedule {
    time_zone {
      id = "America/New_York"
    }

    time_of_day {
      hours = 0
      minutes = 30
      seconds = 30
      nanos = 20
    }

    monthly {
      week_day_of_month {
        week_ordinal = -1
        day_of_week  = "TUESDAY"
        day_offset   = 3
      }
    }
  }

  rollout {
    mode = "ZONE_BY_ZONE"
    disruption_budget {
      fixed = 1
    }
  }
}

Argument Reference

The following arguments are supported:

The instance_filter block supports:

The group_labels block supports:


The patch_config block supports:

The apt block supports:

The yum block supports:

The goo block supports:

The zypper block supports:

The windows_update block supports:

The pre_step block supports:

The linux_exec_step_config block supports:

The gcs_object block supports:

The windows_exec_step_config block supports:

The gcs_object block supports:

The post_step block supports:

The linux_exec_step_config block supports:

The gcs_object block supports:

The windows_exec_step_config block supports:

The gcs_object block supports:

The one_time_schedule block supports:

The recurring_schedule block supports:

The time_zone block supports:

The time_of_day block supports:

The weekly block supports:

The monthly block supports:

The week_day_of_month block supports:

The rollout block supports:

The disruption_budget block supports:

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

Timeouts

This resource provides the following Timeouts configuration options:

Import

PatchDeployment can be imported using any of these accepted formats:

In Terraform v1.5.0 and later, use an import block to import PatchDeployment using one of the formats above. For example:

import {
  id = "projects/{{project}}/patchDeployments/{{name}}"
  to = google_os_config_patch_deployment.default
}

When using the terraform import command, PatchDeployment can be imported using one of the formats above. For example:

$ terraform import google_os_config_patch_deployment.default projects/{{project}}/patchDeployments/{{name}}
$ terraform import google_os_config_patch_deployment.default {{project}}/{{name}}
$ terraform import google_os_config_patch_deployment.default {{name}}

User Project Overrides

This resource supports User Project Overrides.