[MUSIC PLAYING]
ROGER MARTINEZ: Do you have a large fleet
of staple virtual machines?
How many of each operating system are there?
Which ones are fully patched and up-to-date with the latest
security patches?
And can you be sure that all of them
have the right software installed and running?
For a lot of teams, it's critical
that they're able to answer all of these questions.
But that's not always easy, especially
if your infrastructure includes hundreds
of virtual machines running various operating systems.
Today, I'm going to show you how VM Manager can add clarity
to those questions and lift some of those operational burdens
that come with managing a large number of virtual machines
in the cloud.
VM Manager is a suite of tools that
help you manage the operating systems of your fleet
of virtual machines.
These capabilities are nothing new.
There are plenty of third-party tools and services out there
that help you do some of these things across your fleet.
The advantage of VM Manager is that it's cloud-native
and works out-of-the-box with the latest Google Cloud images
across Windows and Linux operating systems.
Its functionality is accessible via the Google Cloud Console
that you're already familiar with,
or via the gcloud command-line interface and API.
VM Manager works by periodically communicating
with the google-osconfig agent that runs on each
of your virtual machines.
The data it receives helps it serve three core
functionalities--
durability with OS inventory management,
security with OS patch management, and compliance
with OS configuration management.
So let's talk about the first VM Manager feature, OS inventory
management.
OS inventory management lets you collect and review
operating system information from your fleet of VMs.
This information includes operating system version,
packages installed on each VM, package updates available,
and vulnerability reports.
The osconfig agent that periodically
reports in with the latest data interfaces
with standard package managers, like apt,
yum, and googet to collect info on packages and updates.
So with OS inventory management, I
can list all of the VMs in my project.
And if I want, I can filter that list by operating system,
by operating system version, by installed packages,
by missing packages, or even by pending updates.
Next, we have OS patch management.
While OS inventory management will tell you
what's installed where and which updates are pending,
OS patch management is going to let
you install packages and updates through patch deployment jobs.
The OS Patch Management Dashboard
will help you visualize your fleet
and identify how many are ready for updates, broken down
nicely by operating system.
The dashboard helps you clearly identify
the machines in your fleet that have important security
updates, so you'll never miss a beat when
keeping the machines secure.
When you're ready to deploy a patch,
you can create a patch deployment job
to run immediately or in the future, once
or on a recurring basis.
If a patch deployment fails for whatever reason,
since VM Manager is cloud-native,
you'll be able to troubleshoot it right from the Cloud Console
through Cloud Logging.
The third big piece of VM Manager
is OS configuration management.
With OS configuration management,
you can automate the deployment, configuration, and maintenance
of your virtual machines from a centralized place.
You do this by creating OS policies that
contain declarative configuration for each VM,
like packages that should be present,
package repositories that should be added,
files that should exist, and scripts that you'd like to run.
A single OS policy can be written
to write a multi-step workflow.
For example, setting up a repository,
installing a package, and then changing config files.
You can specify how to apply these policies
across your fleet by using filters
based on labels, OS families, or even regions and zones.
Once policies are written and applied,
VM Manager will constantly check to make
sure the policy is enforced.
It can also generate a compliance report
that will tell you if any machines have fallen out
of compliance with the requirements
that you specified.
If you want to use VM Manager with your fleet, here's how.
First, there are two APIs that you'll want to enable
or your project, OS Config and Container Analysis.
Then you need to enable OS Config on each VM in your fleet
by setting the metadata tag enable-osconfig to TRUE.
This will make the osconfig agent
active on the corresponding instances.
You also have the option of adding this metadata
tag to your project so that all VMs are included.
Each VM will also have to have an attached service account.
It'll be used to sign requests to the OS Config API.
And finally, each VM in your fleet
is going to have to have the osconfig agent installed.
The good news is that this is already
included on the latest OS images available.
If it isn't installed on your machines,
check out the documentation in the description
below for steps on how to get it installed on each operating
system.
Let's check out VM Manager with a quick walkthrough of OS patch
management.
What I have is a Google Cloud project
with 17 virtual machines running various operating systems.
For this demonstration, I have the patch job executor IAM
role assigned.
That will give me permission to create and execute
patch jobs in the project.
First, let's take a look at the OS Patch Dashboard.
From here, we can see our VMs broken down
by operating system.
We also see a chart for each operating system,
showing us the virtual machines by available updates.
If we click View Details on any of those charts,
we'll get a list view of our virtual machines.
Up here, we'll be able to filter the list
by a few different fields.
For example, by adding a Filter on OS Distribution,
we can view all CentOS and Red Hat machines
in a single list with their Zone, OS info, and Status.
If we want to get more information
about a single machine's available updates,
we can simply click the name and get some more details.
Under Basic info, we once again see the OS information
and a summary of its available updates.
As you can see down here, there are quite a few updates
with different Classifications.
Let's add a filter to see only updates classified as Critical.
That narrows things down to three critical updates.
If you want more information about an individual update,
check out the CVE column.
You'll be able to go straight to the CVE website
to learn more about the vulnerability each update will
resolve.
Since these are critical updates,
let's install these updates by creating a patch job.
We can do that right here by selecting the updates
and clicking Apply Update.
Creating a new patch deployment happens with five steps.
First, let's select our VMs.
Our one CentOS machine is automatically selected,
but we can add more by adjusting the filter
and selecting all CentOS machines.
Next is the Patch configuration.
First, we'll give it a name.
Since we initiated this straight from the VM Details panel,
the packages we want to update are already here
under Include packages.
We can move on to step three, scheduling.
Here, we simply indicate whether we
want to roll this deployment out now or sometime in the future.
We also can create this rollout on a recurring schedule
for packages that we know we want to update regularly.
And the Duration field will let us
specify how long before the deployment
is considered a failure.
Step four brings us a few more rollout options
that let us control how quickly you want to roll it out.
The Threshold and the Percentage will
help to slow down the rollout so that we don't have
to patch all machines at once.
And finally, step five is Advanced options,
where we can provide VM Manager with any pre
or post-patch scripts that we'd like to execute before
or after the patch completes.
Additionally, here, there are some Post-patch reboot options.
Once we finish the configuration,
we can click Deploy to kick off this patch deployment job.
Once it starts, you can click the job name on the Patch Jobs
page to get details about its execution.
The Update info page will recap what this job will be doing.
And on the bottom, we can see the status of each VM included
in this patch deployment.
Once finished, each VM will have the status
of Success or Failure, along with a link
to view logs associated with that patch job.
That was just a simple example of OS patch management
in action and only a small peek at what VM Manager as a whole
can do.
OS inventory management is going to give you insight
into the operating systems running
on your virtual machines in your Google Cloud projects.
OS patch management will make sure the right packages are
kept up-to-date and free of vulnerabilities.
And OS configuration management will
automate the deployment, configuration, and maintenance
of your virtual machines--
all of this straight from the Cloud Console.
For more information on VM Manager,
check out the link to the documentation
in the description below.
Thanks for watching.
[MUSIC PLAYING]