This document shows you how to append the ELS Add-On to RHEL compute instancesthat have on-demand licenses for their images and have reached end ofmaintenance.

When a Red Hat Enterprise Linux (RHEL) versionreaches end of maintenance and your OS image usesan on-demand license, support and access to these Compute Engine instancesare limited according to theMaintenance policy for lifecycle stage.

For extended support, which provides critical impact security fixes and selectedurgent priority bug fixes, you can append the RHEL Extended Life Cycle Support(ELS) Add-On. The ELS Add-On applies to the last minor release of a majorrelease as follows:

• For RHEL 7, the ELS Add-On applies to the latest minor release which is RHEL7.9 or RHEL 7.9 for SAP. The ELS Add-On for RHEL 7 is available until June 30, 2028.
• For RHEL 6, the ELS Add-On applies to the latest minor release which is RHEL6.10. The ELS Add-On for RHEL 6 is available until June 30, 2024. The ELSAdd-On is appended automatically to the RHEL 6.10 instanceswhen you migrate them to Google Cloud.

For more information, see theRHEL Life Cycle and theFAQ.

Overview

You append the ELS license by doing the following for each compute instance:

1. Stop the instance and append the license to the boot disk.

   Caution: Google recommends usingreservations to ensuremachine availability while the compute instance is shut down.

2. Validate the license and start the instance.

3. Install the Red Hat Update Infrastructure (RHUI) ELS client package on theinstance.

Before you begin

• The ELS Add-On only applies to the latest minor release. For each RHEL instance, update to the latest minor release byconnecting to the VM and running the following command:

  sudo yum -y update

• If you haven't already, set upauthentication. Authentication verifies your identity for access to Google Cloud services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:

  Select the tab for how you plan to use the samples on this page:

  Console

  When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.

  gcloud

  1. Install the Google Cloud CLI. After installation,initialize the Google Cloud CLI by running the following command:

     gcloudinit

     If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

     Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.
  2. Set a default region and zone.

Required roles

To get the permissions that you need to append the ELS license to your instance, ask your administrator to grant you the following IAM roles on the project:

• Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1)
• To connect to an instance that can run as a service account:Service Account User (v1) (roles/iam.serviceAccountUser)

For more information about granting roles, seeManage access to projects, folders, and organizations.

These predefined roles contain the permissions required to append the ELS license to your instance. To see the exact permissions that are required, expand theRequired permissions section:

Required permissions

The following permissions are required to append the ELS license to your instance:

• To start and stop the instance:
  • compute.instances.stop on the project
  • compute.instances.start on the project
• To view the disks attached to the instance:
  • compute.instances.get on the instance
  • compute.disks.get on the instance
  • compute.disks.list on the instance
• To update the boot disk of the instance:
  • compute.disks.get on the boot disk
  • compute.disks.update on the boot disk

You might also be able to get these permissions withcustom roles or otherpredefined roles.

Billing

After you attach RHEL ELS to a disk, Compute Engine adds anadditional SKU to your bill.

For example if you are using RHEL 7,your billincludes one line item for RHEL 7 and another for RHEL 7 ELS.

You are billed for RHEL instances according to thepricing for premium images.

Limitations

You must stop the instance before appending a license.

Append the RHEL ELS license

Append the RHEL ELS license to the Linux VM's boot disk by using the followingprocedure:

Caution: Google recommends usingreservations to ensuremachine availability while the VM is shut down.

1. Stop the VM by using thegcloud compute instances stop command:

   gcloud compute instances stopVM_NAME

   ReplaceVM_NAME with the name of the VM to stop.

2. List the disks associated with the VM by using thegcloudcompute instances describecommand:

   gcloud compute instances describeVM_NAME --format="yaml(disks)"

   ReplaceVM_NAME with the name of the VM.

3. Verify that the output is similar to the following:

   disks:- autoDelete: true  boot: true  deviceName: persistent-disk-0  diskSizeGb: '20'  index: 0  interface: SCSI  kind: compute#attachedDisk  licenses:  - https://www.googleapis.com/compute/v1/projects/rhel-cloud/global/licenses/RHEL_VERSION  - https://www.googleapis.com/compute/v1/projects/rhel-cloud/global/licenses/RHEL_ELS_VERSION  mode: READ_WRITE  source: https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/zones/ZONE/disks/VM_NAME  type: PERSISTENT

   Note that noLicenses have been appended yet.

4. Get the name of the boot disk by running thegcloud compute disks list command:

   gcloud compute disks list

5. Update the boot disk with the RHEL ELS license URI by using thegcloud compute disks update command:

   gcloud compute disks updateBOOT_DISK_NAME \   --zoneZONE \   --append-licenses="https://www.googleapis.com/compute/v1/projects/rhel-cloud/global/licenses/RHEL_ELS_VERSION"

   Replace the following:

   • RHEL_VERSION: the RHEL version. For example,rhel-7-server.

   • BOOT_DISK_NAME: the name of the boot disk obtainedin the previous step

   • ZONE: the zone containing the boot disk

   • RHEL_ELS_VERSION: the RHEL ELS version. For example,rhel-7-els.

Validate the RHEL ELS license

Check that the RHEL ELS license is appended to the Linux VM boot disk byusing the following procedure:

1. Get information about the boot disk by using thegcloud compute disks describe command:

   gcloud compute disks describeBOOT_DISK_NAME \   --zoneZONE

   Replace the following:

   • BOOT_DISK_NAME: the name of the boot disk to checkfor the appended license

   • ZONE: the zone containing the boot disk

2. Verify that the output is similar to the following:

   creationTimestamp: '2021-05-05T15:26:27.835-07:00'id: '727854272460268924'interface: SCSIkind: compute#disklabelFingerprint: 42WmSpB8rSM=lastAttachTimestamp: '2021-05-05T15:26:27.836-07:00'licenseCodes:- '1000006'- '6213885950785916969'licenses:- https://www.googleapis.com/compute/v1/projects/rhel-cloud/global/licenses/RHEL_VERSION- https://www.googleapis.com/compute/v1/projects/rhel-cloud/global/licenses/RHEL_ELS_VERSIONmultiWriter: falsename:VM_NAMEphysicalBlockSizeBytes: '4096'selfLink: https://www.googleapis.com/compute/projects/PROJECT_NAME/zones/ZONE/disks/DISK_NAMEselfLinkWithId: https://www.googleapis.com/compute/projects/PROJECT_NAME/zones/ZONE/disks/DISK_IDsizeGb: '20'sourceImage: https://www.googleapis.com/compute/projects/IMAGE_PROJECT/global/images/IMAGEsourceImageId: '7397991294075835597'status: READYtype: https://www.googleapis.com/compute/projects/PROJECT_NAME/zones/ZONE/diskTypes/DISK_TYPEusers:- https://www.googleapis.com/compute/projects/PROJECT_NAME/zones/ZONE/instances/VM_NAMEzone: https://www.googleapis.com/compute/projects/PROJECT_NAME/zones/ZONE

3. Validate that the RHEL ELS license is appended to the Linux VM boot disk bychecking the output of the previous step for theLicenses field for theappropriate license string.

   If theLicenses field doesn't contain the intended licensing string,you might need to clear and then update the user licenses.For more information, see thegcloud compute disks update command.

4. Start the VM by using thegcloud compute instances start command:

   gcloud compute instances startVM_NAME \   [--csek-key-fileENCRYPTION_KEY]

   Replace the following:

   • VM_NAME: the name of the VM to start

   • ENCRYPTION_KEY: an optional flag that specifies thepath to the Customer-Supplied Encryption Key (CSEK) file if the boot diskis encrypted

Install the RHUI ELS client package

After appending the license string to the RHEL disk, install the RHUI ELSclient package on the VM byconnecting to the VM and running the following commands:

View audit logs

View the history of license updates for compute instances by using thefollowing procedure:

1. In the Google Cloud console, go to theLogs Explorer page.

   Go to Logs Explorer

2. In the toolbar, ensure thatShow query is enabled.

3. Copy the following expression into the query editor:

    resource.type="gce_disk" logName="projects/PROJECT_NAME/logs/cloudaudit.googleapis.com%2Factivity" severity>=NOTICE protoPayload.request.@type="type.googleapis.com/compute.disks.update" protoPayload.request.licenses:*

4. ReplacePROJECT_NAME with the name of your project.

5. ClickRun query.