[MUSIC PLAYING]
DAN SHEPPARD: Hi.
I'm Dan Shepherd, a product manager for Compute Engine.
Today, I'm here to talk with you about how
you can use VM manager's service in order
to maintain internal compliance for your VMs.
Google Cloud VM manager has been built
to help Cloud customers build and maintain compliance
for their VMs.
This includes compliance to operating system patch levels,
application, and package installations,
such as a package for Monitoring agent,
backup agents, or any other custom compliance requirement
that you may have for your VM.
To get started, I thought it would be best
to start with looking at the reports.
On the left, you have our patch management report.
This report is available on the dashboard for patch management
and shows you how many VMs are patched by OS
and, when present, how many VMs are not reporting,
as you can see in the gray report at the top.
To drill down into the details, you
can leverage the tabs at the top to show
you specifics for each VM, by each patch job, or even
schedule deployment.
These alternative views quickly allow
you to find and filter by what's most important at the time
and understand the health and patch level for each VM
inside your project on a single screen.
On the right, you'll see our OS configuration management
report.
This is available in the configuration management
dashboard.
This report provides you with a view of all the VMs inside
of your project.
As you can see in this report, we
have a variety of statuses available,
noting whether or not the VM has had policies applied as well
as whether or not the VM is in compliance.
Clicking on a VM here will show you
what policies are applicable to the VM, the state
of each policy, as well as the reason why
the VM is in that state.
This drill down gives you the overall compliance view
for your VMs and specifics allowing you
and your team to take action as soon as your VM falls out
of compliance.
And finally, both of these reports
are backed up with logs, allowing your team
to export logs and, as needed, provide proof to the auditors
that you've met compliance.
So let's take a look at what it looks like to actually go in
and get one of these set up.
Starting with OS patch management,
I'll walk you through the basics of getting a patch job setup.
First, we'll open up the OS patch management dashboard
from the Compute Engine menu on the left,
and then we will click New Patch Deployment
at the top of the window.
From here, you will select the zones
in which we wish to include in the patch deployment.
Note that the multizone selection is available here,
so feel free to select any zones that are
applicable for your project.
Also remember that the patch deployment is only
for this project, so you will need
to set this up for each project that you
wish to automate patching.
Next, you will see the options to filter VMs.
We offer the ability to filter each deployment
by a combination of VM instance names
and/or labels applied to an instance.
We recommend that you create separate deployments
for each environment type-- say, dev, test, and prod.
This is easy to do with naming conventions or a label scheme.
Finally, you can choose to apply the patch deployment
to your managed instance group, but this is something
that you should consider carefully
as it can be disruptive to your workloads and the instance
group.
Instead, we would recommend that you consider features built
into managed instance groups that
would allow you to apply blue/green style
deployments with new images.
Now, back to our patch deployment.
After you click Next, you will see that the deployment
provides a description.
This is your opportunity to provide clarity
such as what patches or what labels
this patch deployment covers.
Then, you can select the patch parameters for each OS type.
These parameters allow you to either opt
in with a broad item such as apply all, critical OS
patches, or specific patches that you wish to include.
Which one is right for you really
depends on what your compliance standard is in your company.
If each patch needs to be certified before you apply it,
perhaps you use specific patches,
or if you are required to deploy critical patches ASAP,
you can specify that parameter here.
On the next screen, you will select the schedule.
This can be done now, later, or recurring.
And then click on the Next and specify your rollout options.
This gives you the option to select a single zone at a time,
as well as what number or percentage of VMs
can be patched at a single time, preserving your performance
and uptime requirements.
Then, you can click Next and move on
to the advanced options, which gives you the flexibility
to select Reboot as well as any pre
and post scripts that are required for your VM.
If you have any of these, you can apply them and then
wrap it all up with the Deploy button,
and your patch deployment is ready and executing
per your schedule.
So let's talk about OS policies now.
OS policies are YAML files that you
use to create for each policy or set of policies
that you wish to apply to an operating system.
Given this, you should spend time
to write and test your YAML files ahead
of building any OS policy.
Once you have your YAML files--
or file ready for deployment, you
can browse the OS configuration management
and then click Create OS Policy Assignment
at the top of the screen.
This will open the form, starting
with giving this policy an assignment ID and then
a description.
Be sure to be as descriptive as possible in this section
as it helps you manage multiple OS policy assignments
for your specific project.
Once you have an assigned ID, you
can then click Add OS Policy and browse to the YAML file
that you created earlier.
Note that you can select as many policies as you want here,
and I recommend that you generate a separate YAML file
for each policy as this will provide maximum flexibility
as things change over time.
And you want to avoid some risk of rework.
Having added all the policies you want,
you can now specify your targets.
Remember, this is a project level,
so you want to work out what VMs in that project
should be included in this policy.
You can target those VMs through the use of availability zones,
OS filtering, or labels.
With OS policies, you can select labels to include
as well as labels that you wish to exclude.
The rollout rate allows you to control
how fast your policy will deploy across your project, so keep
this in mind to avoid any potential disruptions
to running applications or services.
After that is set, click Start Rollout,
and you will be able to see your policy listed
and watch its status.
So that takes us through how to configure OS policies as well
as patch management to help your organization meet
its compliance requirements.
If you want to learn more about VM Manager
or start setting it up today, I encourage you all
to take a look at setting up VM Manager documentation
at the link below.
Thanks.
[MUSIC PLAYING]