Linux Servers Patching - GCP

Question

I wanted patch my Linux instances, hosted on Google Cloud Platform.

Is there any native tool available on Google Cloud Platform, like Azure Update Manager, or do we have to use a 3rd party tool?

Answer 1

Yes, At this moment GCP doesn't have a product that fulfills patch management like Azure update management. However, there are some other workarounds, on how to manage the patch updates of a large number of VMs.

a). Set up a startup script in order to execute certain maintenance routines. However, restarting the VM is necessary. Startup scripts can perform many actions, such as installing software, performing updates, turning on services, and any other tasks defined in the script [1] .

b). If we want to patch large number of instances, a Managed Instance Group [2] could also be an alternative, as the managed instance group automatic updater safely deploy new versions of software to instances in MIG and supports a flexible range of rollout scenarios. Also, we can control the speed and scope of deployment as well as the level of disruption to service. [3]

c). We could use OS Inventory Management [4] to collect and view operating system details for VM instances. These details include operating system information such as hostname, operating system, and kernel version as well as installed packages, and available package updates for the operating system. The process is described here [5].

d). Finally, there's also the possibility of setting up automatic security updates directly in CentOS or Redhat 7.

I hope the above information is useful.

RESOURCES:

[1] https://cloud.google.com/compute/docs/startupscript [2] https://cloud.google.com/compute/docs/instance-groups/#managed_instance_groups [3] https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups [4] https://cloud.google.com/compute/docs/instances/os-inventory-management [5] https://cloud.google.com/compute/docs/instances/view-os-details#query-inventory-data

Thank you all, who shared your knowledge!!!

Answer 2

GCP does not have any such package manager currently. If you would like to patch your servers you would have to setup a cronjob (either with crontab or another cron service like a GKE cronjob) to run the appropriate update command.

Answer 3

I think it was released after this question was asked (April 2020ish), but GCP now offers a native VM patch service called OS Patch Management for their VMs. You can learn more about it here: https://cloud.google.com/compute/docs/os-patch-management