Google Cloud | Compute | Circuit Chips

Compute Engine Explained: Scheduling The OS Patch Management Service

Last year, we introduced the OS patch management service to protect your running Compute Engine VMs against defects and vulnerabilities. The service makes patching Linux and Windows VMs with the latest OS upgrades simple, scalable and effective. In this blog, we share a step-by-step guide on how to set up a project with a schedule to automatically patch filtered VM instances, resolve issues if an agent is not detected, and view an overview of patch compliance across your VM fleet.

Getting started

Imagine an example project with several VM instances hosting a mythical web service. You want to automatically keep the instances updated with the latest critical fixes and security updates against malicious software. You have a production fleet and a development fleet of machines for which you want to apply updates using different schedules. 

First, enable the service by navigating to GCE > OS Patch Management in the Google Cloud Console. Alternatively, you can also enable Cloud OS Config API and Container Analysis API through the Google Cloud Marketplace, or gcloud:

gcloud services enable
gcloud services enable

Note that the OS Config agent is most likely already installed on the VM instances and just needs to be enabled via project metadata keys:

gcloud compute project-info add-metadata \
  --project PROJECT_ID \

After the agent collects data across the VM fleet, this data is then displayed on the patch compliance dashboard, which shows the state across all your VMs and operating systems, and displays a bird eye’s view of your patch compliance:

Google Cloud | Compute Engine | OS Patch Management

You can now see some VM instances that you might like to patch more frequently, for example the CentOS and Red Hat Enterprise Linux (RHEL) fleet. 

Creating a patch deployment

You can then click the New Patch Deployment at the top of the screen and walk through the steps to create a patch deployment for the target VMs, each with specific patch configurations and scheduling options.

In the Target VMs section, you can use VM Instance name prefixes and labels to target only the VM instances with labels that start with a certain prefix. More instance filtering options are available, including zonal and combinations of label groups.

Google Cloud | Compute Engine | Target VMs | Patch Deployment

In the Patch config option, you can select to patch RHEL, CentOS and Windows with critical and security patches, or specify exact Microsoft Knowledge Base (KB) numbers and packages to install. You can also exclude specific packages from being installed in the ‘Exclude’ fields.

Google Cloud | Package config

Finally, you can schedule the patch job. For example, here’s how to run the job every second Tuesday of the month for a maximum duration (three-hour maintenance window), from 11 AM to 2PM:

Google Cloud | New patch deployment scheduling

After the patch job runs, you can see the result of the installed patches. This information is reported on the compliance dashboard and the VM instances tab:

Google Cloud | OS Patch Managmenet Dashboard
Google Cloud | OS Patch Management | VM Instances

Patch your Compute Engine VMs today

To learn more about the OS patch management service on Compute Engine including automating patch deployment, visit our documentation page.

By Dmitry Sadakov. Source: Google Cloud Blog.

For enquiries, product placements, sponsorships, and collaborations, connect with us at We'd love to hear from you!

Our humans need coffee too! Your support is highly appreciated, thank you!

Previous Article
Google Cloud | Cloud App Development | Vials

Introducing Ruby On Google Cloud Functions

Next Article
Google Cloud | Cloud Storage

4 Best Practices For Ensuring Privacy And Security Of Your Data In Cloud Storage

Related Posts