Zonal VM extension policies

This document provides an overview of zonal VM extension policies in VM Extension Manager. Zonal extension policies let you deploy and manage extensions within a single zone in a project, or across descendant projects in a folder or organization, to isolate changes to a specific zone before rolling them out more broadly. Each policy specifies the extensions to install and targets VMs in a specific zone based on optional label selectors.

For more information about hierarchy levels for extension policies, see Resource hierarchy scopes.

How zonal policies work

Zonal extension policies apply extension configurations to matching VMs within a single zone across your resource hierarchy.

The following diagram illustrates how zonal extension policies apply to VMs across organization, folder, and project scopes based on zones and labels:

Zonal extension policies at the organization, folder, and project levels applying extensions to VMs based on zones and VM labels.

As shown in the preceding diagram, you can define zonal extension policies at the organization, folder, or project level. VM Extension Manager applies each policy to matching VMs in the specified zone within that hierarchy scope.

The guest agent on each VM periodically checks Google Cloud for applicable policies. If a policy targets a VM, VM Extension Manager installs the specified extensions and keeps them up to date according to the policy. The guest agent checks for policy updates at the following intervals:

  • No extensions installed on the VM. The guest agent checks for policy updates every eight minutes.
  • One or more extensions installed on the VM. The guest agent checks for policy updates every minute.

What's next