This document describes how Google Cloud supports bringing your own licenses(BYOL) that have dedicated hardware requirements to Compute Engine.Before attempting to bring images with existing licenses to Google Cloud,review your licensing terms and conditions.

Bringing your existing physical-core or physical-processor licenses that havededicated hardware requirements requires you to bring your own media and to runthat media on hardware configurations, such assole-tenantnodes, that are compliant with your licenses. You canbring images with existing licenses in anyregion that supports sole-tenantnodes, and although there is no additional chargefor bringing images with existing licenses, you must still pay for your licensesaccording to your agreements.

Licensing scenarios such as licenses related to Linux BYOS with RHEL orSLES, as well as Microsoft applications don't require sole-tenant nodes. If youare considering bringing licenses from Microsoft applications such as SharePointServer and SQL Server, useMicrosoft License Mobility.

Sole-tenant nodes are physical servers dedicated to hosting virtual machine(VM) instances for only your project. You can configure sole-tenant nodes tosupport various workload requirements, such as requirements for minimizing thenumber of physical servers and cores. Consult your licensing agreements todetermine which configuration options are most suitable for your workloads.

To support bringing your own licenses, and to help you manage compliancerequirements related to your licenses, Google Cloud provides tools forimporting images, managing VMs on dedicated hardware by using sole-tenant nodes,minimizing physical core usage, and tracking usage of physical cores forreporting purposes.

To bring images with existing licenses to Google Cloud, you must do thefollowing:

1. Prepare the images according to your license agreements.

2. Activate your licenses.

3. Import virtual disk files and create images from those disk files.

4. Create sole-tenant node templates.

5. Create sole-tenant node groups from the node templates.

6. Provision VMs on the node groups with the imported virtual disk files.

7. Track the license usage of your VMs. To help you with reporting yourlicense consumption, Google provides tools to help youtrack both license usageand physical core and processor usage.

8. Report license consumption to your vendor.

If you need support or have questions regarding licensing, contact yourlicensing reseller. If you need support or have questions about bringing imageswith existing licenses to Google Cloud,contact Google CloudSupport.

Before you begin

• Review the node group host maintenance policy:For BYOL there are two options for host maintenance policy that minimize thenumber of physical servers used for licensing purposes. These options arerestart-in-place andmigrate-within-node-group.
• Request additional CPU quota:New projects receive a CPU quota of 72. Make sure you haveenough CPU quota to support your node group. For example, then1-node-96-624 node type contains 96CPUs, and if your node group uses the minimum number of nodes(2), your CPU quota must be at least192.Depending on your setup and the needs of your workloads, you might alsoneed to request a quota adjustment for VMs or IP addresses.
• Enable the Cloud Build API:To import your OS image you must enable the Cloud Build API. When you enablethis API, Compute Engine grants your project the appropriateIAM roles so that you can importimages into your project. To list the roles granted to your project, use thegcloud projectsget-iam-policy command. For information about how to grant roles toyour project, seeManaging access toCompute Engine resources.
• Enable the Cloud Logging API:Enable this API if your licensing agreements require you to track physicalserver usage. With this API enabled, you can import and view server usageinformation, such as physical core count, by usingBigQuery, which Google stronglyrecommends. For information about how to determine the count of physical cores,seeAnalyzing sole-tenantnode usage.
• If you haven't already, set upauthentication. Authentication verifies your identity for access to Google Cloud services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:

  Select the tab for how you plan to use the samples on this page:

  Console

  When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.

  gcloud

  1. Install the Google Cloud CLI. After installation,initialize the Google Cloud CLI by running the following command:

     gcloudinit

     If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

     Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.
  2. Set a default region and zone.

  REST

  To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

  Install the Google Cloud CLI. After installation,initialize the Google Cloud CLI by running the following command:

  gcloudinit

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.

  For more information, seeAuthenticate for using REST in the Google Cloud authentication documentation.

Importing and creating an image from an offline virtual disk

To provision VMs with your existing licenses, you must bring your own media.Images based on a premium image are not eligible for BYOL because premium imagesrequire pay-as-you-go licenses from Google. For information about premiumimages, seeOperating system details.

If you have virtual disks (golden disks orgolden images) in youron-premises environment with software configurations or licenses that you need,theimport virtual disk tool canhelp you do the following:

1. Import your customized virtual disks with asupported operating systemand create images based on those disks.

   Note: If you are importing Windows Server 2008 R2 SP1 or Windows 7 SP1 x64,theimage must support SHA2 signing because Compute Engine drivers are signed with SHA2.

2. Set up the appropriate license configuration.

3. Install the packages and drivers necessary for compatibility withGoogle Cloud.

Before you import the virtual disk file for your VM, verify that there are noincompatibilitiesin the file bydownloading and running the precheck toolfrom inside your VM. Also, because software from third parties might interferewith the installation of Compute Engine drivers, Google recommends removingthird-party software before importing your image.

To start a VM with your own license, import a virtual disk with the OS you wantto use. You can import virtual disks fromCloud Storagebuckets and local workstations. When importing a virtual disk file from a localworkstation, the image import tool uploads your image file to Cloud Storage,and, if necessary, creates a new Cloud Storage bucket. Then, the importtool copies the file to Compute Engine and creates a bootable image fromthe virtual disk file.

Files stored on Cloud Storage and images in Compute Engineincur charges. After verifying that the image imports and boots correctly as aVM, you can delete the virtual disk file from Cloud Storage.

gcloud compute images importIMAGE_NAME \    --source-fileVMDK_NAME \    --byol

Activating licenses

After verifying that you are importing acompatible OS,you are responsible for checking that your licensing agreements permit you tobring your own licenses and that you are permitted to use the guest OS image andlicense import environment provided by Google. You are also responsible forpreparing your guest OS image for import according to your licensing agreements.

To activate a license, usestartup scripts withyour Multiple Activation Key (MAK), or configure access to your organization'sMicrosoft Key Management Service. You can't activate images with existinglicenses against the Compute Engine license server.

After importing your image and activating the license, provision a VM based onthe imported image onto a sole-tenant node.

Creating a sole-tenant node template

After importing the image, create a sole-tenant node template. You will usethis node template to create a sole-tenant node group to run your image on.

The node templates page doesn't list the region and zone of the template, butnode groups must be created in a zone within the region where you created thenode template. To create a template, you must first create a node group, butyou only need to complete the steps as far as choosing the region and zone.After that, you can create the template and not continue on to create the nodegroup if you want to.

You set node affinity labels in the sole-tenant node template when you createthe template.

gcloud compute sole-tenancy node-templates createTEMPLATE_NAME \    --node-typeNODE_TYPE \    --regionREGION

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/nodeTemplates{   "name": "TEMPLATE_NAME",   "nodeType": "NODE_TYPE"   "nodeAffinityLabels": {      "KEY": "VALUE"   }}

Creating a sole-tenant node group

To create a node group that is based on a node template, the node group must bein a zone within the region where you created the node template. A sole-tenantnode group inherits properties specified by the sole-tenant node template.The sole-tenant node group has additional values that you must specify. ForBYOL, depending on the license requirements consider the different options forhost maintenance policy:

• If the licenses are assigned per physical cores, then use therestart-in-place ormigrate-within-node-group host maintenance policy tominimize the number of physical servers used.
• If the licenses are assigned based on user/device, a model typically used forVirtual Desktop licenses, then use thedefault host maintenance policy. Theselicenses are not assigned per physical cores, and therefore do not need aspecial host maintenance policy to limit physical server usage.

gcloud compute sole-tenancy node-groups createGROUP_NAME \    --node-templateTEMPLATE_NAME \    --target-sizeGROUP_SIZE \    --zoneZONE \    --maintenance-policyMAINTENANCE_POLICY

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/nodeGroups?initialNodeCount=GROUP_SIZE{  "nodeTemplate": "/regions/REGION/nodeTemplates/TEMPLATE_NAME",  "name": "GROUP_NAME",  "maintenancePolicy": "MAINTENANCE_POLICY"}

Provisioning a sole-tenant VM

Provision a VM on the node group and specify its host maintenance policy. Beaware of the following requirements:

• To provision in node groups withrestart-in-place host maintenance policy, makesure that the VM has the valueTERMINATE for theon host maintenance option.
• To provision in node groups withmigrate-within-node-group maintenancepolicy, make sure that the VM targets a single node group with thenode-group-name affinity label, and that it does not target single nodeswith thenode-name affinity label. Any type of host maintenance option isvalid, but the recommendation is to useMIGRATE.

gcloud compute instances createVM_NAME \    --machine-typeMACHINE_TYPE    --imageIMAGE_NAME \    --zoneZONE \    --node-groupGROUP_NAME \RESTART_BEHAVIOR \    --maintenance-policyMAINTENANCE_POLICY

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/VM_ZONE/instances{  "name": "VM_NAME",  "machineType": "/zones/MACHINE_TYPE_ZONE/machineTypes/MACHINE_TYPE",  "scheduling": {    "nodeAffinities": [      {        "key": "node-group",        "operator": "IN",        "values": [        "GROUP_NAME"        ]      }    ],    "onHostMaintenance": "MAINTENANCE_POLICY",    "automaticRestart": "AUTOMATIC_RESTART"  },  "networkInterfaces": [    {     "network": "/global/networks/NETWORK",     "subnetwork": "/regions/region/subnetworks/SUBNETWORK"    }  ],  "disks": [    {      "boot": true,      "initializeParams": {        "sourceImage": "/projects/IMAGE_PROJECT/global/images/family/IMAGE_FAMILY"       }    }  ]}

What's next

• Consult theFAQfor bringing your own licenses to Google Cloud.

• Learn aboutWindows on Compute Engine.