1. Overview
    1. When a VM instance is started using Google-provided public images, a guest environment is automatically installed on the VM instance
    2. The guest environment is a set of scripts, daemons, and binaries that read the content of the metadata server to make a virtual machine (VM) run properly on Compute Engine
    3. A metadata server is a communication channel for transferring information from a client to the guest operating system
    4. VM instances created using Google-provided public images include a guest environment that is installed by default
    5. In some cases the installed guest environment might become outdated
    6. If the guest environment on the instance is outdated, update the guest environment
    7. A custom image or a virtual disk can be imported to the Compute Engine platform when automatic installation of the guest environment option is not selected
    8. A guest environment is not used when migrating VMs to Compute Engine using Migrate for Compute Engine
    9. A guest environment is not used with images that do not have the guest environment optimizations for local SSD
  2. OS Configuration
    1. OS configuration
      1. Use the OS configuration management service to deploy, query, and maintain consistent configurations (desired state and software) for VM instance
      2. On Compute Engine, use guest policies to maintain consistent software configurations on a VM
    2. Guest policies
      1. A guest policy is a resource that contains settings such as the desired package, package repository, and software configurations
      2. The guest policy specifies VMs settings should apply to
      3. Use guest policies to install, remove, and auto-update software packages
      4. Use guest policies to configure software package repositories
      5. Use guest policies to install software using software recipes
    3. Key terms
      1. Package: Software packages such as dpkg or rpm
      2. Package repository: A repository where software packages can be installed from
      3. Software recipe: A set of instructions for installing unpackaged software for a guest operating system
      4. Software recipes specify instructions for installing software on the VMs
      5. Software recipes are ideal to install software that is not delivered as a conventional software package, or for packages that require additional installation arguments or instructions
    4. How guest policies work
      1. Set up guest policies for project or specific VM instances and install the OS Config agent
      2. OS Config agent runs on VM and uses the specifications in the guest policy to maintain the desired state for the VM
      3. The OS Config agent applies the configurations during the agent's first run and then corrects any drift every 10–15 minutes
      4. The OS Config agent uses the standard system package manager to apply the changes where applicable
      5. On Linux, this means running a system package manager such as apt-get install or yum install for package installation
      6. Set a policy that ensures that the Cloud Monitoring agent is installed on all instances in project that have the prefix test
  3. OS inventory
    1. Use OS inventory management to collect operating system and package information that is stored as guest attributes on the Compute Engine metadata server
    2. Query guest attributes to retrieve information about the operating system that is running on a VM instance
    3. OS inventory management can be used to identifying virtual machines that are running a specific version of an operating system
    4. OS inventory management can be used to view packages that are installed on a VM instance
    5. OS inventory management can be used to generate a list of package updates that are available for each VM instance
    6. OS inventory management can be used to identify missing packages, updates, or patches for a VM instance
    7. When OS inventory management is enabled, the OS Config agent runs an inventory scan to collect data, and then sends this information to the metadata server and various log streams
    8. This scan runs every 10 minutes on the VM instance
  4. Os login
    1. Use OS Login to manage SSH access to instances using IAM without having to create and manage individual SSH keys
    2. OS Login maintains a consistent Linux user identity across VM instances and is the recommended way to manage many users across multiple instances or projects
    3. OS Login simplifies SSH access management by linking Linux user account to Google identity
    4. Administrators can easily manage access to instances at either an instance or project level by setting IAM permissions
    5. OS Login provides automatic Linux account lifecycle management.
    6. It directly ties a Linux user account to a user's Google identity so that the same Linux account information is used across all instances in the same project or organization
    7. It provides fine grained authorization using Google Cloud IAM
    8. Project and instance-level administrators can use IAM to grant SSH access to a user's Google identity without granting a broader set of privileges
    9. OS login grants a user permissions to log into the system, but not the ability to run commands such as sudo
    10. OS login enables automatic permission updates
    11. With OS Login, permissions are updated automatically when an administrator changes Cloud IAM permissions
    12. If IAM permissions are removed from a Google identity, access to VM instances is revoked
    13. Google checks permissions for every login attempt to prevent unwanted access
    14. Users can import existing Linux accounts Administrators or optionally synchronize Linux account information from Active Directory (AD) and Lightweight Directory Access Protocol (LDAP) that are set up on-premises
    15. Can ensure that users have the same user ID (UID) in both Cloud and on-premises environments.
  5. Os Patch
    1. Use OS patch management to apply operating system patches across a set of Compute Engine VM instances (VMs)
    2. Long running VMs require periodic system updates to protect against defects and vulnerabilities
    3. With the OS patch management service, create patch jobs and patch deployments
    4. A patch job runs across VM instances and applies patches
    5. A patch deployment schedules patch jobs and automates the operating system and software patch update process