yum-update

gistfile1.txt

# for updating all packages (not tested, just an idea, or use some bash script instead of puppet for invoking the command)
+  ControllerUpdateConfig:
+    type: OS::Heat::SoftwareConfig
+    properties:
+      group: puppet
+      options:
+        enable_hiera: True
+        enable_facter: False
+      inputs:
+      outputs:
+      - name: result
+      config: 'exec { "update": command => "yum -y update"}'
+
+  ControllerUpdateDeployment:
+    type: OS::Heat::StructuredDeployment
+    properties:
+      name: puppet_update
+      server: {get_resource: Controller}
+      config: {get_resource: ControllerUpdateConfig}