Add hotpatching feature

README.md

@@ -457,6 +457,16 @@ Default:
 ]
 ```
 
+### <a name="input_hotpatching_enabled"></a> [hotpatching\_enabled](#input\_hotpatching\_enabled)
+
+Description: Should the Windows VM be patched without requiring a reboot? [more infos](https://learn.microsoft.com/windows-server/get-started/hotpatch)
+
+**NOTE**: Hotpatching can only be enabled if the `patch_mode` is set to `AutomaticByPlatform`, the `provision_vm_agent` is set to `true`, your `source_image_reference` references a hotpatching enabled image, and the VM's `size` is set to a [Azure generation 2 VM](https://learn.microsoft.com/en-gb/azure/virtual-machines/generation-2#generation-2-vm-sizes).
+
+Type: `bool`
+
+Default: `false`
+
 ### <a name="input_identity"></a> [identity](#input\_identity)
 
 Description: The Azure managed identity to assign to the virtual machine.

r-vm.tf

@@ -123,6 +123,7 @@ resource "azurerm_windows_virtual_machine" "this" {
   custom_data                                            = var.custom_data
   enable_automatic_updates                               = var.enable_automatic_updates
   encryption_at_host_enabled                             = var.encryption_at_host_enabled
+  hotpatching_enabled                                    = var.hotpatching_enabled
   license_type                                           = var.license_type
   network_interface_ids                                  = local.network_interface_ids
   patch_assessment_mode                                  = var.patch_assessment_mode

tests/local/input_enable_hotpatching.tftest.hcl

@@ -0,0 +1,30 @@
+mock_provider "azapi" { source = "tests/local/mocks" }
+mock_provider "azurerm" { source = "tests/local/mocks" }
+mock_provider "random" { source = "tests/local/mocks" }
+mock_provider "tls" { source = "tests/local/mocks" }
+
+variables {
+  # Unset default, set in variables.auto.tfvars
+  image = true
+
+  # Set default for this test file
+  hotpatching_enabled = true
+}
+
+run "should_use_hotpatching_enabled_on_windows" {
+  command = plan
+
+  variables {
+    image = "MicrosoftWindowsServer:WindowsServer:2022-datacenter-azure-edition-hotpatch:latest"
+  }
+}
+
+run "hotpatching_enabled_should_fail_on_linux" {
+  command = plan
+
+  variables {
+    image = "Ubuntu2204"
+  }
+
+  expect_failures = [var.hotpatching_enabled]
+}

variables.tf

@@ -269,6 +269,24 @@ variable "extensions" {
   ]
 }
 
+variable "hotpatching_enabled" {
+
+  description = <<-EOT
+    Should the Windows VM be patched without requiring a reboot? [more infos](https://learn.microsoft.com/windows-server/get-started/hotpatch)
+
+    **NOTE**: Hotpatching can only be enabled if the `patch_mode` is set to `AutomaticByPlatform`, the `provision_vm_agent` is set to `true`, your `source_image_reference` references a hotpatching enabled image, and the VM's `size` is set to a [Azure generation 2 VM](https://learn.microsoft.com/en-gb/azure/virtual-machines/generation-2#generation-2-vm-sizes).
+  EOT
+
+  type = bool
+
+  default = false
+
+  validation {
+    condition     = var.hotpatching_enabled == false ? true : local.is_windows
+    error_message = "Hotpatching can only be set for Windows virtual machines."
+  }
+}
+
 variable "identity" {
   description = <<-EOT
     The Azure managed identity to assign to the virtual machine.