Bringing your own licenses

This document describes how Google Cloud supports bringing your own licenses (BYOL) that have dedicated hardware requirements to Compute Engine. Before attempting to bring images with existing licenses to Google Cloud, review your licensing terms and conditions.

Bringing your existing physical-core or physical-processor licenses that have dedicated hardware requirements requires you to bring your own media and to run that media on hardware configurations, such as sole-tenant nodes, that are compliant with your licenses. You can bring images with existing licenses in any region that supports sole-tenant nodes, and although there is no additional charge for bringing images with existing licenses, you must still pay for your licenses according to your agreements.

Licensing scenarios such as licenses related to Linux BYOS with RHEL or SLES, as well as Microsoft applications don't require sole-tenant nodes. If you are considering bringing licenses from Microsoft applications such as SharePoint Server and SQL Server, use Microsoft License Mobility.

Sole-tenant nodes are physical servers dedicated to hosting virtual machine (VM) instances for only your project. You can configure sole-tenant nodes to support various workload requirements, such as requirements for minimizing the number of physical servers and cores. Consult your licensing agreements to determine which configuration options are most suitable for your workloads.

To support bringing your own licenses, and to help you manage compliance requirements related to your licenses, Google Cloud provides tools for importing images, managing VMs on dedicated hardware by using sole-tenant nodes, minimizing physical core usage, and tracking usage of physical cores for reporting purposes.

To bring images with existing licenses to Google Cloud, you must do the following:

1. Prepare the images according to your license agreements.

2. Activate your licenses.

3. Import virtual disk files and create images from those disk files.

4. Create sole-tenant node templates.

5. Create sole-tenant node groups from the node templates.

6. Provision VMs on the node groups with the imported virtual disk files.

7. Track the license usage of your VMs. To help you with reporting your license consumption, Google provides tools to help you track both license usage and physical core and processor usage.

8. Report license consumption to your vendor.

If you need support or have questions regarding licensing, contact your licensing reseller. If you need support or have questions about bringing images with existing licenses to Google Cloud, contact Google Cloud Support.

Before you begin

• Review the node group host maintenance policy: For BYOL there are two options for host maintenance policy that minimize the number of physical servers used for licensing purposes. These options are restart-in-place and migrate-within-node-group.
• Request additional CPU quota: New projects receive a CPU quota of 72. Make sure you have enough CPU quota to support your node group. For example, the n1-node-96-624 node type contains 96 CPUs, and if your node group uses the minimum number of nodes (2), your CPU quota must be at least 192. Depending on your setup and the needs of your workloads, you might also need to request a quota adjustment for VMs or IP addresses.
• Enable the Cloud Build API: To import your OS image you must enable the Cloud Build API. When you enable this API, Compute Engine grants your project the appropriate IAM roles so that you can import images into your project. To list the roles granted to your project, use the gcloud projects get-iam-policy command. For information about how to grant roles to your project, see Managing access to Compute Engine resources.
• Enable the Cloud Logging API: Enable this API if your licensing agreements require you to track physical server usage. With this API enabled, you can import and view server usage information, such as physical core count, by using BigQuery, which Google strongly recommends. For information about how to determine the count of physical cores, see Analyzing sole-tenant node usage.
• If you haven't already, then set up authentication. Authentication is the process by which your identity is verified for access to Google Cloud services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:
  

  Select the tab for how you plan to use the samples on this page:

  Console

  When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.

  gcloud

  1. Install the Google Cloud CLI, then initialize it by running the following command:

     gcloud init

  2. Set a default region and zone.

  REST

  To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

  Install the Google Cloud CLI, then initialize it by running the following command:

  gcloud init

  For more information, see Authenticate for using REST in the Google Cloud authentication documentation.

Importing and creating an image from an offline virtual disk

To provision VMs with your existing licenses, you must bring your own media. Images based on a premium image are not eligible for BYOL because premium images require pay-as-you-go licenses from Google. For information about premium images, see Operating system details.

If you have virtual disks (golden disks or golden images) in your on-premises environment with software configurations or licenses that you need, the import virtual disk tool can help you do the following:

1. Import your customized virtual disks with a supported operating system and create images based on those disks.

2. Set up the appropriate license configuration.

3. Install the packages and drivers necessary for compatibility with Google Cloud.

Before you import the virtual disk file for your VM, verify that there are no incompatibilities in the file by downloading and running the precheck tool from inside your VM. Also, because software from third parties might interfere with the installation of Compute Engine drivers, Google recommends removing third-party software before importing your image.

To start a VM with your own license, import a virtual disk with the OS you want to use. You can import virtual disks from Cloud Storage buckets and local workstations. When importing a virtual disk file from a local workstation, the image import tool uploads your image file to Cloud Storage, and, if necessary, creates a new Cloud Storage bucket. Then, the import tool copies the file to Compute Engine and creates a bootable image from the virtual disk file.

Files stored on Cloud Storage and images in Compute Engine incur charges. After verifying that the image imports and boots correctly as a VM, you can delete the virtual disk file from Cloud Storage.

gcloud compute images import IMAGE_NAME \
    --source-file VMDK_NAME \
    --byol

Activating licenses

After verifying that you are importing a compatible OS, you are responsible for checking that your licensing agreements permit you to bring your own licenses and that you are permitted to use the guest OS image and license import environment provided by Google. You are also responsible for preparing your guest OS image for import according to your licensing agreements.

To activate a license, use startup scripts with your Multiple Activation Key (MAK), or configure access to your organization's Microsoft Key Management Service. You can't activate images with existing licenses against the Compute Engine license server.

After importing your image and activating the license, provision a VM based on the imported image onto a sole-tenant node.

Creating a sole-tenant node template

After importing the image, create a sole-tenant node template. You will use this node template to create a sole-tenant node group to run your image on.

The node templates page doesn't list the region and zone of the template, but node groups must be created in a zone within the region where you created the node template. To create a template, you must first create a node group, but you only need to complete the steps as far as choosing the region and zone. After that, you can create the template and not continue on to create the node group if you want to.

You set node affinity labels in the sole-tenant node template when you create the template.

gcloud compute sole-tenancy node-templates create TEMPLATE_NAME \
    --node-type NODE_TYPE \
    --region REGION

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/nodeTemplates

{
   "name": "TEMPLATE_NAME",
   "nodeType": "NODE_TYPE"
   "nodeAffinityLabels": {
      "KEY": "VALUE"
   }
}

Creating a sole-tenant node group

To create a node group that is based on a node template, the node group must be in a zone within the region where you created the node template. A sole-tenant node group inherits properties specified by the sole-tenant node template. The sole-tenant node group has additional values that you must specify. For BYOL, depending on the license requirements consider the different options for host maintenance policy:

• If the licenses are assigned per physical cores, then use the restart-in-place or migrate-within-node-group host maintenance policy to minimize the number of physical servers used.
• If the licenses are assigned based on user/device, a model typically used for Virtual Desktop licenses, then use the default host maintenance policy. These licenses are not assigned per physical cores, and therefore do not need a special host maintenance policy to limit physical server usage.

gcloud compute sole-tenancy node-groups create GROUP_NAME \
    --node-template TEMPLATE_NAME \
    --target-size GROUP_SIZE \
    --zone ZONE \
    --maintenance-policy MAINTENANCE_POLICY

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/nodeGroups?initialNodeCount=GROUP_SIZE

{
  "nodeTemplate": "/regions/REGION/nodeTemplates/TEMPLATE_NAME",
  "name": "GROUP_NAME",
  "maintenancePolicy": "MAINTENANCE_POLICY"
}

Provisioning a sole-tenant VM

Provision a VM on the node group and specify its host maintenance policy. Be aware of the following requirements:

• To provision in node groups with restart-in-place host maintenance policy, make sure that the VM has the value TERMINATE for the on host maintenance option.
• To provision in node groups with migrate-within-node-group maintenance policy, make sure that the VM targets a single node group with the node-group-name affinity label, and that it does not target single nodes with the node-name affinity label. Any type of host maintenance option is valid, but the recommendation is to use MIGRATE.

gcloud compute instances create VM_NAME \
    --machine-type MACHINE_TYPE
    --image IMAGE_NAME \
    --zone ZONE \
    --node-group GROUP_NAME \
    RESTART_BEHAVIOR \
    --maintenance-policy MAINTENANCE_POLICY

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/VM_ZONE/instances

{
  "name": "VM_NAME",
  "machineType": "/zones/MACHINE_TYPE_ZONE/machineTypes/MACHINE_TYPE",
  "scheduling": {
    "nodeAffinities": [
      {
        "key": "node-group",
        "operator": "IN",
        "values": [
        "GROUP_NAME"
        ]
      }
    ],
    "onHostMaintenance": "MAINTENANCE_POLICY",
    "automaticRestart": "AUTOMATIC_RESTART"
  },
  "networkInterfaces": [
    {
     "network": "/global/networks/NETWORK",
     "subnetwork": "/regions/region/subnetworks/SUBNETWORK"
    }
  ],
  "disks": [
    {
      "boot": true,
      "initializeParams": {
        "sourceImage": "/projects/IMAGE_PROJECT/global/images/family/IMAGE_FAMILY"
       }
    }
  ]
}

What's next

• Consult the FAQ for bringing your own licenses to Google Cloud.

• Learn about Windows on Compute Engine.