OSConfigOSPolicyAssignment


Property Value
Google Cloud Service Name OS Config
Google Cloud Service Documentation /compute/docs/osconfig/rest/
Google Cloud REST Resource Name v1.projects.locations.osPolicyAssignments
Google Cloud REST Resource Documentation /compute/docs/osconfig/rest/v1/projects.locations.osPolicyAssignments
Config Connector Resource Short Names gcposconfigospolicyassignment
gcposconfigospolicyassignments
osconfigospolicyassignment
Config Connector Service Name osconfig.googleapis.com
Config Connector Resource Fully Qualified Name osconfigospolicyassignments.osconfig.cnrm.cloud.google.com
Can Be Referenced by IAMPolicy/IAMPolicyMember No
Config Connector Default Average Reconcile Interval In Seconds 600

Custom Resource Definition Properties

Spec

Schema

description: string
instanceFilter:
  all: boolean
  exclusionLabels:
  - labels:
      string: string
  inclusionLabels:
  - labels:
      string: string
  inventories:
  - osShortName: string
    osVersion: string
location: string
osPolicies:
- allowNoResourceGroupMatch: boolean
  description: string
  id: string
  mode: string
  resourceGroups:
  - inventoryFilters:
    - osShortName: string
      osVersion: string
    resources:
    - exec:
        enforce:
          args:
          - string
          file:
            allowInsecure: boolean
            gcs:
              bucket: string
              generation: integer
              object: string
            localPath: string
            remote:
              sha256Checksum: string
              uri: string
          interpreter: string
          outputFilePath: string
          script: string
        validate:
          args:
          - string
          file:
            allowInsecure: boolean
            gcs:
              bucket: string
              generation: integer
              object: string
            localPath: string
            remote:
              sha256Checksum: string
              uri: string
          interpreter: string
          outputFilePath: string
          script: string
      file:
        content: string
        file:
          allowInsecure: boolean
          gcs:
            bucket: string
            generation: integer
            object: string
          localPath: string
          remote:
            sha256Checksum: string
            uri: string
        path: string
        permissions: string
        state: string
      id: string
      pkg:
        apt:
          name: string
        deb:
          pullDeps: boolean
          source:
            allowInsecure: boolean
            gcs:
              bucket: string
              generation: integer
              object: string
            localPath: string
            remote:
              sha256Checksum: string
              uri: string
        desiredState: string
        googet:
          name: string
        msi:
          properties:
          - string
          source:
            allowInsecure: boolean
            gcs:
              bucket: string
              generation: integer
              object: string
            localPath: string
            remote:
              sha256Checksum: string
              uri: string
        rpm:
          pullDeps: boolean
          source:
            allowInsecure: boolean
            gcs:
              bucket: string
              generation: integer
              object: string
            localPath: string
            remote:
              sha256Checksum: string
              uri: string
        yum:
          name: string
        zypper:
          name: string
      repository:
        apt:
          archiveType: string
          components:
          - string
          distribution: string
          gpgKey: string
          uri: string
        goo:
          name: string
          url: string
        yum:
          baseUrl: string
          displayName: string
          gpgKeys:
          - string
          id: string
        zypper:
          baseUrl: string
          displayName: string
          gpgKeys:
          - string
          id: string
projectRef:
  external: string
  name: string
  namespace: string
resourceID: string
rollout:
  disruptionBudget:
    fixed: integer
    percent: integer
  minWaitDuration: string
skipAwaitRollout: boolean
Fields

description

Optional

string

OS policy assignment description. Length of the description is limited to 1024 characters.

instanceFilter

Required

object

Required. Filter to select VMs.

instanceFilter.all

Optional

boolean

Target all VMs in the project. If true, no other criteria is permitted.

instanceFilter.exclusionLabels

Optional

list (object)

List of label sets used for VM exclusion. If the list has more than one label set, the VM is excluded if any of the label sets are applicable for the VM.

instanceFilter.exclusionLabels[]

Optional

object

instanceFilter.exclusionLabels[].labels

Optional

map (key: string, value: string)

Labels are identified by key/value pairs in this map. A VM should contain all the key/value pairs specified in this map to be selected.

instanceFilter.inclusionLabels

Optional

list (object)

List of label sets used for VM inclusion. If the list has more than one `LabelSet`, the VM is included if any of the label sets are applicable for the VM.

instanceFilter.inclusionLabels[]

Optional

object

instanceFilter.inclusionLabels[].labels

Optional

map (key: string, value: string)

Labels are identified by key/value pairs in this map. A VM should contain all the key/value pairs specified in this map to be selected.

instanceFilter.inventories

Optional

list (object)

List of inventories to select VMs. A VM is selected if its inventory data matches at least one of the following inventories.

instanceFilter.inventories[]

Optional

object

instanceFilter.inventories[].osShortName

Required*

string

Required. The OS short name

instanceFilter.inventories[].osVersion

Optional

string

The OS version Prefix matches are supported if asterisk(*) is provided as the last character. For example, to match all versions with a major version of `7`, specify the following value for this field `7.*` An empty string matches all OS versions.

location

Required

string

Immutable. The location for the resource

osPolicies

Required

list (object)

Required. List of OS policies to be applied to the VMs.

osPolicies[]

Required

object

osPolicies[].allowNoResourceGroupMatch

Optional

boolean

This flag determines the OS policy compliance status when none of the resource groups within the policy are applicable for a VM. Set this value to `true` if the policy needs to be reported as compliant even if the policy has nothing to validate or enforce.

osPolicies[].description

Optional

string

Policy description. Length of the description is limited to 1024 characters.

osPolicies[].id

Required

string

Required. The id of the OS policy with the following restrictions: * Must contain only lowercase letters, numbers, and hyphens. * Must start with a letter. * Must be between 1-63 characters. * Must end with a number or a letter. * Must be unique within the assignment.

osPolicies[].mode

Required

string

Required. Policy mode Possible values: MODE_UNSPECIFIED, VALIDATION, ENFORCEMENT

osPolicies[].resourceGroups

Required

list (object)

Required. List of resource groups for the policy. For a particular VM, resource groups are evaluated in the order specified and the first resource group that is applicable is selected and the rest are ignored. If none of the resource groups are applicable for a VM, the VM is considered to be non-compliant w.r.t this policy. This behavior can be toggled by the flag `allow_no_resource_group_match`

osPolicies[].resourceGroups[]

Required

object

osPolicies[].resourceGroups[].inventoryFilters

Optional

list (object)

List of inventory filters for the resource group. The resources in this resource group are applied to the target VM if it satisfies at least one of the following inventory filters. For example, to apply this resource group to VMs running either `RHEL` or `CentOS` operating systems, specify 2 items for the list with following values: inventory_filters[0].os_short_name='rhel' and inventory_filters[1].os_short_name='centos' If the list is empty, this resource group will be applied to the target VM unconditionally.

osPolicies[].resourceGroups[].inventoryFilters[]

Optional

object

osPolicies[].resourceGroups[].inventoryFilters[].osShortName

Required*

string

Required. The OS short name

osPolicies[].resourceGroups[].inventoryFilters[].osVersion

Optional

string

The OS version Prefix matches are supported if asterisk(*) is provided as the last character. For example, to match all versions with a major version of `7`, specify the following value for this field `7.*` An empty string matches all OS versions.

osPolicies[].resourceGroups[].resources

Required

list (object)

Required. List of resources configured for this resource group. The resources are executed in the exact order specified here.

osPolicies[].resourceGroups[].resources[]

Required

object

osPolicies[].resourceGroups[].resources[].exec

Optional

object

Exec resource

osPolicies[].resourceGroups[].resources[].exec.enforce

Optional

object

What to run to bring this resource into the desired state. An exit code of 100 indicates "success", any other exit code indicates a failure running enforce.

osPolicies[].resourceGroups[].resources[].exec.enforce.args

Optional

list (string)

Optional arguments to pass to the source during execution.

osPolicies[].resourceGroups[].resources[].exec.enforce.args[]

Optional

string

osPolicies[].resourceGroups[].resources[].exec.enforce.file

Optional

object

A remote or local file.

osPolicies[].resourceGroups[].resources[].exec.enforce.file.allowInsecure

Optional

boolean

Defaults to false. When false, files are subject to validations based on the file type: Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.

osPolicies[].resourceGroups[].resources[].exec.enforce.file.gcs

Optional

object

A Cloud Storage object.

osPolicies[].resourceGroups[].resources[].exec.enforce.file.gcs.bucket

Required*

string

Required. Bucket of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].exec.enforce.file.gcs.generation

Optional

integer

Generation number of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].exec.enforce.file.gcs.object

Required*

string

Required. Name of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].exec.enforce.file.localPath

Optional

string

A local path within the VM to use.

osPolicies[].resourceGroups[].resources[].exec.enforce.file.remote

Optional

object

A generic remote file.

osPolicies[].resourceGroups[].resources[].exec.enforce.file.remote.sha256Checksum

Optional

string

SHA256 checksum of the remote file.

osPolicies[].resourceGroups[].resources[].exec.enforce.file.remote.uri

Required*

string

Required. URI from which to fetch the object. It should contain both the protocol and path following the format `{protocol}://{location}`.

osPolicies[].resourceGroups[].resources[].exec.enforce.interpreter

Required*

string

Required. The script interpreter to use. Possible values: INTERPRETER_UNSPECIFIED, NONE, SHELL, POWERSHELL

osPolicies[].resourceGroups[].resources[].exec.enforce.outputFilePath

Optional

string

Only recorded for enforce Exec. Path to an output file (that is created by this Exec) whose content will be recorded in OSPolicyResourceCompliance after a successful run. Absence or failure to read this file will result in this ExecResource being non-compliant. Output file size is limited to 100K bytes.

osPolicies[].resourceGroups[].resources[].exec.enforce.script

Optional

string

An inline script. The size of the script is limited to 1024 characters.

osPolicies[].resourceGroups[].resources[].exec.validate

Required*

object

Required. What to run to validate this resource is in the desired state. An exit code of 100 indicates "in desired state", and exit code of 101 indicates "not in desired state". Any other exit code indicates a failure running validate.

osPolicies[].resourceGroups[].resources[].exec.validate.args

Optional

list (string)

Optional arguments to pass to the source during execution.

osPolicies[].resourceGroups[].resources[].exec.validate.args[]

Optional

string

osPolicies[].resourceGroups[].resources[].exec.validate.file

Optional

object

A remote or local file.

osPolicies[].resourceGroups[].resources[].exec.validate.file.allowInsecure

Optional

boolean

Defaults to false. When false, files are subject to validations based on the file type: Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.

osPolicies[].resourceGroups[].resources[].exec.validate.file.gcs

Optional

object

A Cloud Storage object.

osPolicies[].resourceGroups[].resources[].exec.validate.file.gcs.bucket

Required*

string

Required. Bucket of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].exec.validate.file.gcs.generation

Optional

integer

Generation number of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].exec.validate.file.gcs.object

Required*

string

Required. Name of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].exec.validate.file.localPath

Optional

string

A local path within the VM to use.

osPolicies[].resourceGroups[].resources[].exec.validate.file.remote

Optional

object

A generic remote file.

osPolicies[].resourceGroups[].resources[].exec.validate.file.remote.sha256Checksum

Optional

string

SHA256 checksum of the remote file.

osPolicies[].resourceGroups[].resources[].exec.validate.file.remote.uri

Required*

string

Required. URI from which to fetch the object. It should contain both the protocol and path following the format `{protocol}://{location}`.

osPolicies[].resourceGroups[].resources[].exec.validate.interpreter

Required*

string

Required. The script interpreter to use. Possible values: INTERPRETER_UNSPECIFIED, NONE, SHELL, POWERSHELL

osPolicies[].resourceGroups[].resources[].exec.validate.outputFilePath

Optional

string

Only recorded for enforce Exec. Path to an output file (that is created by this Exec) whose content will be recorded in OSPolicyResourceCompliance after a successful run. Absence or failure to read this file will result in this ExecResource being non-compliant. Output file size is limited to 100K bytes.

osPolicies[].resourceGroups[].resources[].exec.validate.script

Optional

string

An inline script. The size of the script is limited to 1024 characters.

osPolicies[].resourceGroups[].resources[].file

Optional

object

File resource

osPolicies[].resourceGroups[].resources[].file.content

Optional

string

A a file with this content. The size of the content is limited to 1024 characters.

osPolicies[].resourceGroups[].resources[].file.file

Optional

object

A remote or local source.

osPolicies[].resourceGroups[].resources[].file.file.allowInsecure

Optional

boolean

Defaults to false. When false, files are subject to validations based on the file type: Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.

osPolicies[].resourceGroups[].resources[].file.file.gcs

Optional

object

A Cloud Storage object.

osPolicies[].resourceGroups[].resources[].file.file.gcs.bucket

Required*

string

Required. Bucket of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].file.file.gcs.generation

Optional

integer

Generation number of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].file.file.gcs.object

Required*

string

Required. Name of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].file.file.localPath

Optional

string

A local path within the VM to use.

osPolicies[].resourceGroups[].resources[].file.file.remote

Optional

object

A generic remote file.

osPolicies[].resourceGroups[].resources[].file.file.remote.sha256Checksum

Optional

string

SHA256 checksum of the remote file.

osPolicies[].resourceGroups[].resources[].file.file.remote.uri

Required*

string

Required. URI from which to fetch the object. It should contain both the protocol and path following the format `{protocol}://{location}`.

osPolicies[].resourceGroups[].resources[].file.path

Required*

string

Required. The absolute path of the file within the VM.

osPolicies[].resourceGroups[].resources[].file.permissions

Optional

string

Consists of three octal digits which represent, in order, the permissions of the owner, group, and other users for the file (similarly to the numeric mode used in the linux chmod utility). Each digit represents a three bit number with the 4 bit corresponding to the read permissions, the 2 bit corresponds to the write bit, and the one bit corresponds to the execute permission. Default behavior is 755. Below are some examples of permissions and their associated values: read, write, and execute: 7 read and execute: 5 read and write: 6 read only: 4

osPolicies[].resourceGroups[].resources[].file.state

Required*

string

Required. Desired state of the file. Possible values: OS_POLICY_COMPLIANCE_STATE_UNSPECIFIED, COMPLIANT, NON_COMPLIANT, UNKNOWN, NO_OS_POLICIES_APPLICABLE

osPolicies[].resourceGroups[].resources[].id

Required

string

Required. The id of the resource with the following restrictions: * Must contain only lowercase letters, numbers, and hyphens. * Must start with a letter. * Must be between 1-63 characters. * Must end with a number or a letter. * Must be unique within the OS policy.

osPolicies[].resourceGroups[].resources[].pkg

Optional

object

Package resource

osPolicies[].resourceGroups[].resources[].pkg.apt

Optional

object

A package managed by Apt.

osPolicies[].resourceGroups[].resources[].pkg.apt.name

Required*

string

Required. Package name.

osPolicies[].resourceGroups[].resources[].pkg.deb

Optional

object

A deb package file.

osPolicies[].resourceGroups[].resources[].pkg.deb.pullDeps

Optional

boolean

Whether dependencies should also be installed. - install when false: `dpkg -i package` - install when true: `apt-get update && apt-get -y install package.deb`

osPolicies[].resourceGroups[].resources[].pkg.deb.source

Required*

object

Required. A deb package.

osPolicies[].resourceGroups[].resources[].pkg.deb.source.allowInsecure

Optional

boolean

Defaults to false. When false, files are subject to validations based on the file type: Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.

osPolicies[].resourceGroups[].resources[].pkg.deb.source.gcs

Optional

object

A Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.deb.source.gcs.bucket

Required*

string

Required. Bucket of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.deb.source.gcs.generation

Optional

integer

Generation number of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.deb.source.gcs.object

Required*

string

Required. Name of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.deb.source.localPath

Optional

string

A local path within the VM to use.

osPolicies[].resourceGroups[].resources[].pkg.deb.source.remote

Optional

object

A generic remote file.

osPolicies[].resourceGroups[].resources[].pkg.deb.source.remote.sha256Checksum

Optional

string

SHA256 checksum of the remote file.

osPolicies[].resourceGroups[].resources[].pkg.deb.source.remote.uri

Required*

string

Required. URI from which to fetch the object. It should contain both the protocol and path following the format `{protocol}://{location}`.

osPolicies[].resourceGroups[].resources[].pkg.desiredState

Required*

string

Required. The desired state the agent should maintain for this package. Possible values: DESIRED_STATE_UNSPECIFIED, INSTALLED, REMOVED

osPolicies[].resourceGroups[].resources[].pkg.googet

Optional

object

A package managed by GooGet.

osPolicies[].resourceGroups[].resources[].pkg.googet.name

Required*

string

Required. Package name.

osPolicies[].resourceGroups[].resources[].pkg.msi

Optional

object

An MSI package.

osPolicies[].resourceGroups[].resources[].pkg.msi.properties

Optional

list (string)

Additional properties to use during installation. This should be in the format of Property=Setting. Appended to the defaults of `ACTION=INSTALL REBOOT=ReallySuppress`.

osPolicies[].resourceGroups[].resources[].pkg.msi.properties[]

Optional

string

osPolicies[].resourceGroups[].resources[].pkg.msi.source

Required*

object

Required. The MSI package.

osPolicies[].resourceGroups[].resources[].pkg.msi.source.allowInsecure

Optional

boolean

Defaults to false. When false, files are subject to validations based on the file type: Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.

osPolicies[].resourceGroups[].resources[].pkg.msi.source.gcs

Optional

object

A Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.msi.source.gcs.bucket

Required*

string

Required. Bucket of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.msi.source.gcs.generation

Optional

integer

Generation number of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.msi.source.gcs.object

Required*

string

Required. Name of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.msi.source.localPath

Optional

string

A local path within the VM to use.

osPolicies[].resourceGroups[].resources[].pkg.msi.source.remote

Optional

object

A generic remote file.

osPolicies[].resourceGroups[].resources[].pkg.msi.source.remote.sha256Checksum

Optional

string

SHA256 checksum of the remote file.

osPolicies[].resourceGroups[].resources[].pkg.msi.source.remote.uri

Required*

string

Required. URI from which to fetch the object. It should contain both the protocol and path following the format `{protocol}://{location}`.

osPolicies[].resourceGroups[].resources[].pkg.rpm

Optional

object

An rpm package file.

osPolicies[].resourceGroups[].resources[].pkg.rpm.pullDeps

Optional

boolean

Whether dependencies should also be installed. - install when false: `rpm --upgrade --replacepkgs package.rpm` - install when true: `yum -y install package.rpm` or `zypper -y install package.rpm`

osPolicies[].resourceGroups[].resources[].pkg.rpm.source

Required*

object

Required. An rpm package.

osPolicies[].resourceGroups[].resources[].pkg.rpm.source.allowInsecure

Optional

boolean

Defaults to false. When false, files are subject to validations based on the file type: Remote: A checksum must be specified. Cloud Storage: An object generation number must be specified.

osPolicies[].resourceGroups[].resources[].pkg.rpm.source.gcs

Optional

object

A Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.rpm.source.gcs.bucket

Required*

string

Required. Bucket of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.rpm.source.gcs.generation

Optional

integer

Generation number of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.rpm.source.gcs.object

Required*

string

Required. Name of the Cloud Storage object.

osPolicies[].resourceGroups[].resources[].pkg.rpm.source.localPath

Optional

string

A local path within the VM to use.

osPolicies[].resourceGroups[].resources[].pkg.rpm.source.remote

Optional

object

A generic remote file.

osPolicies[].resourceGroups[].resources[].pkg.rpm.source.remote.sha256Checksum

Optional

string

SHA256 checksum of the remote file.

osPolicies[].resourceGroups[].resources[].pkg.rpm.source.remote.uri

Required*

string

Required. URI from which to fetch the object. It should contain both the protocol and path following the format `{protocol}://{location}`.

osPolicies[].resourceGroups[].resources[].pkg.yum

Optional

object

A package managed by YUM.

osPolicies[].resourceGroups[].resources[].pkg.yum.name

Required*

string

Required. Package name.

osPolicies[].resourceGroups[].resources[].pkg.zypper

Optional

object

A package managed by Zypper.

osPolicies[].resourceGroups[].resources[].pkg.zypper.name

Required*

string

Required. Package name.

osPolicies[].resourceGroups[].resources[].repository

Optional

object

Package repository resource

osPolicies[].resourceGroups[].resources[].repository.apt

Optional

object

An Apt Repository.

osPolicies[].resourceGroups[].resources[].repository.apt.archiveType

Required*

string

Required. Type of archive files in this repository. Possible values: ARCHIVE_TYPE_UNSPECIFIED, DEB, DEB_SRC

osPolicies[].resourceGroups[].resources[].repository.apt.components

Required*

list (string)

Required. List of components for this repository. Must contain at least one item.

osPolicies[].resourceGroups[].resources[].repository.apt.components[]

Required*

string

osPolicies[].resourceGroups[].resources[].repository.apt.distribution

Required*

string

Required. Distribution of this repository.

osPolicies[].resourceGroups[].resources[].repository.apt.gpgKey

Optional

string

URI of the key file for this repository. The agent maintains a keyring at `/etc/apt/trusted.gpg.d/osconfig_agent_managed.gpg`.

osPolicies[].resourceGroups[].resources[].repository.apt.uri

Required*

string

Required. URI for this repository.

osPolicies[].resourceGroups[].resources[].repository.goo

Optional

object

A Goo Repository.

osPolicies[].resourceGroups[].resources[].repository.goo.name

Required*

string

Required. The name of the repository.

osPolicies[].resourceGroups[].resources[].repository.goo.url

Required*

string

Required. The url of the repository.

osPolicies[].resourceGroups[].resources[].repository.yum

Optional

object

A Yum Repository.

osPolicies[].resourceGroups[].resources[].repository.yum.baseUrl

Required*

string

Required. The location of the repository directory.

osPolicies[].resourceGroups[].resources[].repository.yum.displayName

Optional

string

The display name of the repository.

osPolicies[].resourceGroups[].resources[].repository.yum.gpgKeys

Optional

list (string)

URIs of GPG keys.

osPolicies[].resourceGroups[].resources[].repository.yum.gpgKeys[]

Optional

string

osPolicies[].resourceGroups[].resources[].repository.yum.id

Required*

string

Required. A one word, unique name for this repository. This is the `repo id` in the yum config file and also the `display_name` if `display_name` is omitted. This id is also used as the unique identifier when checking for resource conflicts.

osPolicies[].resourceGroups[].resources[].repository.zypper

Optional

object

A Zypper Repository.

osPolicies[].resourceGroups[].resources[].repository.zypper.baseUrl

Required*

string

Required. The location of the repository directory.

osPolicies[].resourceGroups[].resources[].repository.zypper.displayName

Optional

string

The display name of the repository.

osPolicies[].resourceGroups[].resources[].repository.zypper.gpgKeys

Optional

list (string)

URIs of GPG keys.

osPolicies[].resourceGroups[].resources[].repository.zypper.gpgKeys[]

Optional

string

osPolicies[].resourceGroups[].resources[].repository.zypper.id

Required*

string

Required. A one word, unique name for this repository. This is the `repo id` in the zypper config file and also the `display_name` if `display_name` is omitted. This id is also used as the unique identifier when checking for GuestPolicy conflicts.

projectRef

Required

object

Immutable. The Project that this resource belongs to.

projectRef.external

Optional

string

The project for the resource Allowed value: The Google Cloud resource name of a `Project` resource (format: `projects/{{name}}`).

projectRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

projectRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

resourceID

Optional

string

Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default.

rollout

Required

object

Required. Rollout to deploy the OS policy assignment. A rollout is triggered in the following situations: 1) OSPolicyAssignment is created. 2) OSPolicyAssignment is updated and the update contains changes to one of the following fields: - instance_filter - os_policies 3) OSPolicyAssignment is deleted.

rollout.disruptionBudget

Required

object

Required. The maximum number (or percentage) of VMs per zone to disrupt at any given moment.

rollout.disruptionBudget.fixed

Optional

integer

Specifies a fixed value.

rollout.disruptionBudget.percent

Optional

integer

Specifies the relative value defined as a percentage, which will be multiplied by a reference value.

rollout.minWaitDuration

Required

string

Required. This determines the minimum duration of time to wait after the configuration changes are applied through the current rollout. A VM continues to count towards the `disruption_budget` at least until this duration of time has passed after configuration changes are applied.

skipAwaitRollout

Optional

boolean

Set to true to skip awaiting rollout during resource creation and update.

* Field is required when parent field is specified

Status

Schema

baseline: boolean
conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
deleted: boolean
etag: string
observedGeneration: integer
reconciling: boolean
revisionCreateTime: string
revisionId: string
rolloutState: string
uid: string
Fields
baseline

boolean

Output only. Indicates that this revision has been successfully rolled out in this zone and new VMs will be assigned OS policies from this revision. For a given OS policy assignment, there is only one revision with a value of `true` for this field.

conditions

list (object)

Conditions represent the latest available observation of the resource's current state.

conditions[]

object

conditions[].lastTransitionTime

string

Last time the condition transitioned from one status to another.

conditions[].message

string

Human-readable message indicating details about last transition.

conditions[].reason

string

Unique, one-word, CamelCase reason for the condition's last transition.

conditions[].status

string

Status is the status of the condition. Can be True, False, Unknown.

conditions[].type

string

Type is the type of the condition.

deleted

boolean

Output only. Indicates that this revision deletes the OS policy assignment.

etag

string

The etag for this OS policy assignment. If this is provided on update, it must match the server's etag.

observedGeneration

integer

ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.

reconciling

boolean

Output only. Indicates that reconciliation is in progress for the revision. This value is `true` when the `rollout_state` is one of: * IN_PROGRESS * CANCELLING

revisionCreateTime

string

Output only. The timestamp that the revision was created.

revisionId

string

Output only. The assignment revision ID A new revision is committed whenever a rollout is triggered for a OS policy assignment

rolloutState

string

Output only. OS policy assignment rollout state Possible values: ROLLOUT_STATE_UNSPECIFIED, IN_PROGRESS, CANCELLING, CANCELLED, SUCCEEDED

uid

string

Output only. Server generated unique id for the OS policy assignment resource.

Sample YAML(s)

Fixed Os Policy Assignment

# Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: osconfig.cnrm.cloud.google.com/v1beta1
kind: OSConfigOSPolicyAssignment
metadata:
  name: osconfigospolicyassignment-sample-fixedospolicyassignment
spec:
  projectRef:
     # Replace ${PROJECT_ID?} with your project ID
     external: "projects/${PROJECT_ID?}"
  location: "us-west2-a"
  description: "A test os policy assignment"
  osPolicies:
  - id: "policy"
    description: "A test os policy"
    mode: "VALIDATION"
    resourceGroups:
    - inventoryFilters:
      - osShortName: "centos"
        osVersion: "8.*"
      resources:
      - id: "apt"
        pkg:
          desiredState: "INSTALLED"
          apt:
            name: "bazel"
      - id: "deb1"
        pkg:
          desiredState: "INSTALLED"
          deb:
            source:
              localPath: "$HOME/package.deb"
      - id: "deb2"
        pkg:
          desiredState: "INSTALLED"
          deb:
            pullDeps: true
            source:
              allowInsecure: true
              remote:
                uri: "ftp.us.debian.org/debian/package.deb"
                sha256Checksum: "3bbfd1043cd7afdb78cf9afec36c0c5370d2fea98166537b4e67f3816f256025"
      - id: "deb3"
        pkg:
          desiredState: "INSTALLED"
          deb:
            pullDeps: true
            source:
              gcs:
                bucket: "test-bucket"
                object: "test-object"
                generation: 1
      - id: "yum"
        pkg:
          desiredState: "INSTALLED"
          yum:
            name: "gstreamer-plugins-base-devel.x86_64"
      - id: "zypper"
        pkg:
          desiredState: "INSTALLED"
          zypper:
            name: "gcc"
      - id: "rpm1"
        pkg:
          desiredState: "INSTALLED"
          rpm:
            pullDeps: true
            source:
              localPath: "$HOME/package.rpm"
      - id: "rpm2"
        pkg:
          desiredState: "INSTALLED"
          rpm:
            source:
              allowInsecure: true
              remote:
                uri: "https://mirror.jaleco.com/centos/8.3.2011/BaseOS/x86_64/os/Packages/efi-filesystem-3-2.el8.noarch.rpm"
                sha256Checksum: "3bbfd1043cd7afdb78cf9afec36c0c5370d2fea98166537b4e67f3816f256025"
      - id: "rpm3"
        pkg:
          desiredState: "INSTALLED"
          rpm:
            source:
              gcs:
                bucket: "test-bucket"
                object: "test-object"
                generation: 1
    - resources:
      - id: "apt-to-deb"
        pkg:
          desiredState: "INSTALLED"
          apt:
            name: "bazel"
      - id: "deb-local-path-to-gcs"
        pkg:
          desiredState: "INSTALLED"
          deb:
            source:
              localPath: "$HOME/package.deb"
      - id: "googet"
        pkg:
          desiredState: "INSTALLED"
          googet:
            name: "gcc"
      - id: "msi1"
        pkg:
          desiredState: "INSTALLED"
          msi:
            source:
              localPath: "$HOME/package.msi"
            properties:
            - "REBOOT=ReallySuppress"
      - id: "msi2"
        pkg:
          desiredState: "INSTALLED"
          msi:
            source:
              allowInsecure: true
              remote:
                uri: "https://remote.uri.com/package.msi"
                sha256Checksum: "3bbfd1043cd7afdb78cf9afec36c0c5370d2fea98166537b4e67f3816f256025"
              sha256Checksum: "3bbfd1043cd7afdb78cf9afec36c0c5370d2fea98166537b4e67f3816f256025"
      - id: "msi3"
        pkg:
          desiredState: "INSTALLED"
          msi:
            source:
              gcs:
                bucket: "test-bucket"
                object: "test-object"
                generation: 1
    allowNoResourceGroupMatch: false
  instanceFilter:
    all: false
    inclusionLabels:
    - labels:
        label-one: "value-one"
    exclusionLabels:
    - labels:
        label-two: "value-two"
    inventories:
    - osShortName: "centos"
      osVersion: "8.*"
  rollout:
    disruptionBudget:
      fixed: 1
    minWaitDuration: "3.5s"

Percent Os Policy Assignment

# Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: osconfig.cnrm.cloud.google.com/v1beta1
kind: OSConfigOSPolicyAssignment
metadata:
  name: osconfigospolicyassignment-sample-percentospolicyassignment
spec:
  projectRef:
     # Replace ${PROJECT_ID?} with your project ID
     external: "projects/${PROJECT_ID?}"
  location: "us-west2-a"
  description: "A test os policy assignment"
  osPolicies:
  - id: "policy"
    mode: "VALIDATION"
    resourceGroups:
    - resources:
      - id: "apt-to-yum"
        repository:
          apt:
            archiveType: "DEB"
            uri: "https://atl.mirrors.clouvider.net/debian"
            distribution: "debian"
            components:
            - "doc"
            gpgKey: ".gnupg/pubring.kbx"
      - id: "yum"
        repository:
          yum:
            id: "yum"
            displayName: "yum"
            baseUrl: "http://centos.s.uw.edu/centos/"
            gpgKeys:
            - "RPM-GPG-KEY-CentOS-7"
      - id: "zypper"
        repository:
          zypper:
            id: "zypper"
            displayName: "zypper"
            baseUrl: "http://mirror.dal10.us.leaseweb.net/opensuse"
            gpgKeys:
            - "sample-key-uri"
      - id: "goo"
        repository:
          goo:
            name: "goo"
            url: "https://foo.com/googet/bar"
      - id: "exec1"
        exec:
          validate:
            args:
            - "arg1"
            interpreter: "SHELL"
            outputFilePath: "$HOME/out"
            file:
              localPath: "$HOME/script.sh"
          enforce:
            args:
            - "arg1"
            interpreter: "SHELL"
            outputFilePath: "$HOME/out"
            file:
              allowInsecure: true
              remote:
                uri: "https://www.example.com/script.sh"
                sha256Checksum: "c7938fed83afdccbb0e86a2a2e4cad7d5035012ca3214b4a61268393635c3063"
      - id: "exec2"
        exec:
          validate:
            args:
            - "arg1"
            interpreter: "SHELL"
            outputFilePath: "$HOME/out"
            file:
              allowInsecure: true
              remote:
                uri: "https://www.example.com/script.sh"
                sha256Checksum: "c7938fed83afdccbb0e86a2a2e4cad7d5035012ca3214b4a61268393635c3063"
          enforce:
            args:
            - "arg1"
            interpreter: "SHELL"
            outputFilePath: "$HOME/out"
            file:
              localPath: "$HOME/script.sh"
      - id: "exec3"
        exec:
          validate:
            interpreter: "SHELL"
            outputFilePath: "$HOME/out"
            file:
              allowInsecure: true
              gcs:
                bucket: "test-bucket"
                object: "test-object"
                generation: 1
          enforce:
            interpreter: "SHELL"
            outputFilePath: "$HOME/out"
            script: "pwd"
      - id: "exec4"
        exec:
          validate:
            interpreter: "SHELL"
            outputFilePath: "$HOME/out"
            script: "pwd"
          enforce:
            interpreter: "SHELL"
            outputFilePath: "$HOME/out"
            file:
              allowInsecure: true
              gcs:
                bucket: "test-bucket"
                object: "test-object"
                generation: 1
      - id: "file1"
        file:
          path: "$HOME/file"
          state: "PRESENT"
          file:
            localPath: "$HOME/file"
    - resources:
      - id: "file2"
        file:
          path: "$HOME/file"
          state: "PRESENT"
          permissions: "755"
          file:
            allowInsecure: true
            remote:
              uri: "https://www.example.com/file"
              sha256Checksum: "c7938fed83afdccbb0e86a2a2e4cad7d5035012ca3214b4a61268393635c3063"
      - id: "file3"
        file:
          path: "$HOME/file"
          state: "PRESENT"
          file:
            gcs:
              bucket: "test-bucket"
              object: "test-object"
              generation: 1
      - id: "file4"
        file:
          path: "$HOME/file"
          state: "PRESENT"
          content: "sample-content"
  instanceFilter:
    all: true
  rollout:
    disruptionBudget:
      percent: 1
    minWaitDuration: "3.5s"