linux_patching

Description

A Chef cookbook to patch Linux nodes, based on Brian Fald's (@bflad) chef-auto-patch cookbook. Provides the ability to configure three patching windows/stages: pre-configuration, patching, and post-configuration. Also updated to support the latest version of chef-client, additional OSes, and newer versions of existing OS varieties.

Requirements

Platforms

• amazon
• arch
• centos
• debian
• redhat
• ubuntu

Cookbooks

• cron

Stages

• pre_config - disabled by default. Allows preparation scripts to be run, such as preparing/cleaning the system, pre-downloading patches, or notifying external systems. Can help speed up patching process and meet patching timeframes.
• patch - the primary patching stage. This stage is enabled by default and will run the node platform's patch script in the templates directory.
• post_config - disabled by default. Allows for checkout scripts to be run, such as verifying system state, rebooting at a later date, or notifying external systems. Use this to run tasks at a set scheduled time after the completion of the patching stage.

Attributes

The following is a hash of options that can be set for a stage, where stage is one of patch, pre_config, or post_config. See the Examples section for more details.

Recipes

• recipe['linux_patching'] - configures automatic patching.

Usage

• Update attributes as desired
• Update script templates
• Add recipe to node run list

Examples

Enable weekly patching with reboots

node['linux_patching']['patch'] = {
  'enable' => true,
  'hour' => 3,
  'minute' => 0,
  'monthly' => nil,
  'platforms' => 'all',
  'reboot' => true,
  'splay' => 0,
  'weekly' => 'sunday',
}

Enable monthly patching with no reboot

node['linux_patching']['patch'] = {
  'enable' => true,
  'hour' => 2,
  'minute' => 30,
  'monthly' => 'second tuesday',
  'platforms' => 'all',
  'reboot' => false,
  'splay' => 300,
  'weekly' => nil,
}

Disable patching entirely on a node

node['linux_patching']['patch']['enable'] = false
node['linux_patching']['pre_config']['enable'] = false
node['linux_patching']['post_config']['enable'] = false

TODO

The following is a list of things I would like to eventually add to this cookbook. Feel free to contribute by raising an issue or pull request to this project in GitLab.

• Improve InSpec tests
• Provide example pre_config and post_config scripts
• Add ability to "run now". Thought is to have an attribute that when set to true, will run the patch process/scripts at the next chef-client run.
• Add support for the 'platforms' attribute within a stage.