Updating Systems with Rolling Updates and Stateful MIGs
Patch management is simplified using Rolling Updates. This method deploys new software versions across a MIG without service interruption by updating VMs in small batches. For applications like databases that need to preserve unique data, you use Stateful MIGs. These groups preserve each VM's persistent disks during updates or recreations, protecting important data while maintaining a secure and updated environment.
Infrastructure as Code (IaC) and Orchestration
Defining Infrastructure with Code
Infrastructure as Code (IaC) means you manage cloud resources using configuration files instead of manual clicks in a console. Tools like Terraform and Google Cloud Deployment Manager use these files to automate the provisioning of resources. This approach ensures your environments are consistent, repeatable, and less prone to human error.
Terraform uses a declarative syntax where you describe your desired infrastructure state. It relies on a state file to track which real-world resources correspond to your code. To maintain consistency, teams use modular templates for reusable components, version control to track changes and enable rollbacks, and careful state management to ensure the cloud environment always matches the configuration file.
Orchestrating Deployments with Pipelines
Infrastructure orchestration coordinates multiple automated tasks. Google Cloud recommends using deployment pipelines, often automated with services like Cloud Build, to manage changes. These pipelines separate duties between teams (like foundation, infrastructure, and application layers), making every change auditable, traceable, and repeatable.
Preparing VM Images with Packer
For compute resource configuration, image baking creates a pre-configured VM image. Using a tool like Packer to bake images is preferred over running scripts at VM startup because it makes deployment faster and more reliable. When a Managed Instance Group scales up, every new VM starts from this identical image and is ready to work immediately.
Automating Patch Management
Automating patch management is critical for security. Key practices include using automated rollouts to apply updates gradually and minimize disruption, employing health checks to monitor systems during updates, and leveraging managed services where Google Cloud handles underlying maintenance automatically.
OS Patching, Compliance, and Inventory Management
Centralized Management with VM Manager
VM Manager is a suite of tools for managing operating systems on large fleets of Google Cloud VMs. It automates tasks like infrastructure orchestration and resource configuration, specifically for OS updates, which reduces the manual work needed to keep an environment secure.
Tracking Software with OS Inventory Management
The OS inventory management service collects detailed software information from your VMs and stores it in instance metadata. You can query this data to check if your systems meet compliance standards. A Patch dashboard uses this inventory to show VM status, categorizing them as Critical (needing urgent updates), Security (needing security fixes), or Up-to-date.
Scheduling and Applying OS Updates
The Patch service lets you schedule operating system updates or apply them on-demand. An OS Config agent runs on each VM and uses the system's standard tools (like apt or yum) to install these updates. Scheduling patches ensures regular application of critical security fixes without constant manual effort.
Enforcing Desired States with OS Policies
OS policies are declarative files that define the exact state a VM should be in, including specific software packages. When set to enforcement mode, the system automatically corrects any VM that does not match the policy. This automation ensures even large-scale fleets remain consistent and secure over time.
Controlling Update Rollouts
When deploying updates, you can control the speed and impact using rollout options. A disruption budget defines the maximum number of VMs that can be updating or offline at the same time. These settings help maintain high availability by preventing updates from taking down too many resources at once.
StudyCerts
StudyCerts