I believe the patch groups are configured via the pe_patch module. https://www.puppet.com/docs/pe/2021.1/patch_management_setup.html Per that documentation, you'll want to use apt-mark to flag the mysql packages so they aren't patched.