Create patch jobs

You can use Patch to apply operating system patches across a group of virtual machine (VM) instances.

To apply patches to your VMs, complete the following steps:

  1. Set up your VM.
  2. Run a patch job.

Before you begin

  • Review OS Config quotas.
  • To generate audit logs for VM Manager events, enable data access audit logs.
  • Review limitations for Patch.
  • If you haven't already, set up authentication. Authentication verifies your identity for access to Google Cloud services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:

    Select the tab for how you plan to use the samples on this page:

    Console

    When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.

    gcloud

    1. Install the Google Cloud CLI. After installation, initialize the Google Cloud CLI by running the following command: 

      gcloud init

      If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

    2. Set a default region and zone.

    REST

    To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

      Install the Google Cloud CLI.

      If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

    For more information, see Authenticate for using REST in the Google Cloud authentication documentation.

Set up your VM

To use the Patch feature, complete the following steps:

  1. For all VMs, set up VM Manager.
  2. For Windows VMs, Google recommends disabling automatic updates on the VMs. This reduces conflicts between the Windows automatic updates and the Patch service.

Permissions

Owners of a Google Cloud project have full access to run and manage patch jobs. For all other users, you need to grant permissions. You can grant one of the following granular roles:

  • roles/osconfig.patchJobExecutor: Contains permissions to run, cancel, get, and list patch jobs. It also contains permissions to view instance details for a patch job.
  • roles/osconfig.patchJobViewer: Contains permissions for read-only access to get and list patch jobs. It also contains permissions to view instance details for a patch job.

For example, to grant a user access to run patch jobs, use the following command:

gcloud projects add-iam-policy-binding project-id \
    --member user:user-id@gmail.com \
    --role roles/osconfig.patchJobExecutor

Replace the following:

  • project-id: The project ID.
  • user-id: The user's Google Workspace username.

Run patch jobs

You can run a patch job by using either the Google Cloud console, Google Cloud CLI, or REST.

When you run a patch job, the patching of the VMs starts simultaneously on all instances specified by the instance filter.

After you have started a patch job, you can monitor your patches using the Patch dashboard. It takes approximately 30 minutes after a patch job starts before the data is populated on the dashboard.

Console

  1. In the Google Cloud console, go to the Compute Engine > VM Manager > Patch page.

    Go to the Patch page

  2. Click Create patch job.

  3. In the Target VMs section, specify the criteria for selecting VMs for patching.

    1. Select the zone that contains the VMs that you want to patch. You can also choose to select all zones.

      After you select the zones, you can then further filter the VMs within that zone.

      For example, to patch specific VMs in the zones you selected, enter the name and label filters similar to the following:

      • Name prefix: test-
      • Labels: env=dev and app=web

    2. In the Other options section, specify the following:

      • Allow patching MIG instances: If you select this option, the patch job runs on VMs that are part of a managed instance group (MIG).
      • Skip unpatchable VMs: If you select this option, the patch job skips any VM that cannot be patched (for example, VMs running Container-Optimized OS). For more information, see Settings for VMs in MIGs and unpatchable VMs.

  4. In the Patch configuration section, configure the patch.

    1. Specify a Name for your patch.
    2. Select the required updates for your operating system. For more information, see patch configuration.

  5. In the Scheduling section, complete the following:

  6. In the