GCP for DevOps — OS Config

OS Config

OS Config is a service for managing operating system configuration on VM fleets. It provides automated patch management, OS policy enforcement, and software inventory tracking for Compute Engine instances.

OS Config Architecture

OS Config:
┌──────────────────┐    ┌──────────────────┐
│  OS Config Agent   │    │  OS Config        │
│  (on each VM)      │◀──▶│  Service          │
│                    │    │                    │
│  • Report inventory│    │  • Patch jobs      │
│  • Apply patches   │    │  • OS policies     │
│  • Run policies    │    │  • Inventory       │
│  • Install software│    │  • Compliance      │
└──────────────────┘    └──────────────────┘
       ▲                         │
       │    ┌──────────────┐    │
       └────│  VM Fleet     │◀───┘
            │  (managed)    │
            └──────────────┘

Enable OS Config

# Enable the OS Config API
$ gcloud services enable osconfig.googleapis.com

# Enable OS Config agent on project metadata
$ gcloud compute project-info add-metadata \
    --metadata=enable-osconfig=TRUE

# Verify agent on a VM
$ gcloud compute ssh my-vm --command="systemctl status google-osconfig-agent"

Patch Management

# Create a one-time patch job
$ gcloud compute os-config patch-jobs execute \
    --instance-filter-names="zones/us-central1-a/instances/my-vm-1,zones/us-central1-a/instances/my-vm-2" \
    --apt-type=upgrade \
    --reboot-config=DEFAULT

# Patch all VMs with a specific label
$ gcloud compute os-config patch-jobs execute \
    --instance-filter-group-labels="env=production" \
    --yum-security \
    --reboot-config=ALWAYS

# Patch all VMs in a zone
$ gcloud compute os-config patch-jobs execute \
    --instance-filter-zones="us-central1-a" \
    --apt-type=upgrade

# List patch jobs
$ gcloud compute os-config patch-jobs list

# Describe a patch job
$ gcloud compute os-config patch-jobs describe JOB_ID

Patch Deployments (Scheduled)

# Create a recurring patch deployment (every Sunday at 2 AM)
$ gcloud compute os-config patch-deployments create weekly-patch \
    --instance-filter-group-labels="env=production" \
    --apt-type=upgrade \
    --reboot-config=DEFAULT \
    --recurring-schedule-frequency=WEEKLY \
    --recurring-schedule-weekly-day-of-week=SUNDAY \
    --recurring-schedule-time-of-day="02:00" \
    --recurring-schedule-time-zone="America/New_York"

# List patch deployments
$ gcloud compute os-config patch-deployments list

# Pause a deployment
$ gcloud compute os-config patch-deployments pause weekly-patch

# Resume a deployment
$ gcloud compute os-config patch-deployments resume weekly-patch

OS Policies

OS Policies define desired state for software, files, and scripts:

# os-policy-assignment.yaml
osPolicies:
  - id: ensure-nginx
    mode: ENFORCEMENT
    resourceGroups:
      - resources:
          - id: install-nginx
            pkg:
              desiredState: INSTALLED
              apt:
                name: nginx
          - id: nginx-config
            file:
              path: /etc/nginx/conf.d/default.conf
              state: PRESENT
              content:
                inline: |
                  server {
                      listen 80;
                      location /health {
                          return 200 "OK";
                      }
                  }
          - id: start-nginx
            exec:
              validate:
                interpreter: SHELL
                script: systemctl is-active nginx
              enforce:
                interpreter: SHELL
                script: systemctl start nginx && systemctl enable nginx

# Create OS policy assignment
$ gcloud compute os-config os-policy-assignments create nginx-policy \
    --location=us-central1-a \
    --file=os-policy-assignment.yaml \
    --instance-filter-group-labels="role=web"

# List assignments
$ gcloud compute os-config os-policy-assignments list \
    --location=us-central1-a

# Check compliance
$ gcloud compute os-config os-policy-assignment-reports list \
    --location=us-central1-a

Software Inventory

# List installed packages on a VM
$ gcloud compute os-config inventories describe my-vm \
    --location=us-central1-a

# List all VMs with a specific package
$ gcloud asset search-all-resources \
    --asset-types=osconfig.googleapis.com/Inventory \
    --query="installedPackage:nginx"

Common Mistakes

Mistake	Why It’s Wrong	Fix
OS Config agent not enabled	No management possible	Enable via project metadata
No scheduled patching	VMs drift behind on patches	Create patch deployments
Patching all VMs at once	Service disruption	Use rolling patches with labels
No reboot policy	Patches don’t take effect	Set reboot-config appropriately
No compliance monitoring	Unknown VM state	Use OS policy assignments

Quick Reference

Command	Description
gcloud compute os-config patch-jobs execute	Run patch job
gcloud compute os-config patch-jobs list	List patch jobs
gcloud compute os-config patch-deployments create	Schedule patches
gcloud compute os-config os-policy-assignments create	Create OS policy
gcloud compute os-config inventories describe	View inventory

Next → Practice Exercises