#Provides automated patch management | |
class profile::patch_mgmt_win ( | |
Array $blacklist = [], | |
Array $whitelist = [], | |
Optional[Hash] $patch_window = { | |
range => '01:00 - 04:00', | |
weekday => 'Sunday', | |
repeat => 3 | |
} | |
) { | |
include os_patching | |
class { 'wsus_client': | |
server_url => 'http://wsus.example.com:8530', | |
target_group => 'AutoApproval', | |
enable_status_server => true, | |
auto_install_minor_updates => false, | |
auto_update_option => 'NotifyOnly', | |
detection_frequency_hours => 22 | |
} | |
if $facts['os_patching'] { | |
$updatescan = $facts['os_patching']['missing_update_kbs'] | |
} | |
else { | |
$updatescan = [] | |
} | |
if $whitelist.count > 0 { | |
$updates = $updatescan.filter |$item| { $item in $whitelist } | |
} elsif $blacklist.count > 0 { | |
$updates = $updatescan.filter |$item| { !($item in $blacklist) } | |
} else { | |
$updates = $updatescan | |
} | |
schedule { 'patch_window': | |
* => $patch_window | |
} | |
if $facts['os_patching']['reboots']['reboot_required'] == true { | |
Windows_updates::Kb { | |
require => Reboot['patch_window_reboot'] | |
} | |
notify { 'Reboot pending, rebooting node...': | |
schedule => 'patch_window', | |
notify => Reboot['patch_window_reboot'] | |
} | |
} | |
reboot { 'patch_window_reboot': | |
apply => 'finished', | |
schedule => 'patch_window' | |
} | |
$updates.each | $kb | { | |
windows_updates::kb { $kb: | |
ensure => 'present', | |
maintwindow => 'patch_window' | |
} | |
} | |
} |
This comment has been minimized.
This comment has been minimized.
Yes I think there's a problem in the logic as the |
This comment has been minimized.
This comment has been minimized.
It actually turns out the hanging is caused by a weird Powershell bug with the "Get-WUHistory" command that the windows_updates module relies on. Documented here: noma4i/puppet-windows_updates#12 Also thank you for linking the module. I still have a question with how the reboot functions though. I see that in patchday.pp you you have this code here:
However the reboot resource is set with apply => 'finished' so the pending reboot is not happening before updates try to install. I tested it out today and windows_updates::kb still attempts to install if reboot_required is true and if there are $updates in the array. Would you be able to test this? I am thinking the apply => 'finished' might need to be changed to 'immediately' so that the require in the Windows_updates::Kb block will fire off immediately if there is a pending reboot instead of waiting. Here is output I ran on a node, you'll see how it notifies the reboot, but it then also attempts to start installing updates. The reboot doesn't happen until after the updates are done.
|
This comment has been minimized.
This comment has been minimized.
Hmmm, interesting. I guess when the reboot resource has triggered, this satisfies the |
This comment has been minimized.
This comment has been minimized.
@mike406 can you try the updated 0.2.0 version of the module? This now correctly handles pending reboots, and provides additional capabilities around pre/post patching commands, and pre-reboot commands. |
This comment has been minimized.
This comment has been minimized.
This appears to be working! Edit - a follow up: So these two essentially fight each other for who finishes first. For computers that have slower link speeds or are at remote locations, there is a high chance the os_patching fact for the reboot_required will not update before the puppet agent run starts, causing multiple pending reboots to fire. A classic "stale data" problem...To get around this one could set the puppet service on Windows machines to be Automatic (Delayed) instead of Automatic, but there is still a chance it could still be stale data even then. https://forge.puppet.com/puppetlabs/reboot#complete-any-pending-reboots-before-installing-a-package This is how I have my reboots set up. I'm still new to Puppet so I hope I did it right. My goal is to check for pending reboots with the require, and then notify as well at the end of the patching run to reboot the computer:
|
This comment has been minimized.
Hello! I've been implementing my own patching routing based off of your code here, but I think I may have spotted an issue but I am not sure why it happens. When I run a puppet agent -t, the run hangs indefinitely with the below output
Basically it never finishes so the reboot never occurs. If I switch the reboot apply => 'finished' to apply => 'immediately' it will restart the computer but I cannot figure out where it is hanging when it is set to 'finished'. I am wondering if it is because of this:
My thoughts are that since this makes the windows_updates::kb wait for the reboot, the run essentially freezes because in my mind you can't wait for the reboot, while the reboot is also set to wait for the run to finish because that will make it wait forever. But I could be wrong.
Here is my full code for reference: