Repair a VM in an alternate zone

This document describes how to allow a regional managed instance group (MIG) to repair a virtual machine (VM) instance in an alternate zone when the MIG cannot repair the VM in its original zone. To learn more about repairs in a MIG, see About repairing VMs for high availability.

When you create a regional MIG, you select one or more zones where the MIG distributes its VMs. By default, if a VM in the MIG fails, the MIG tries to repair that VM in its original zone. You can optionally allow the MIG to repair that VM in one of the other selected zones, which is useful in cases where the MIG cannot repair the VM in its original zone. The MIG picks the alternate zone based on available capacity and quota.

Limitations

When you configure a regional MIG to repair a VM in alternate zone, the following limitations apply:

• You must enable update on repair.

• Regional MIGs with the following configuration aren't supported:

  • MIGs with EVEN or ANY_SINGLE_ZONE target distribution shapes.

  • MIGs with stateful configuration.

Before you begin

• If you haven't already, set up authentication. Authentication verifies your identity for access to Cloud de Confiance by S3NS services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:

  Select the tab for how you plan to use the samples on this page:

  Console

  When you use the Cloud de Confiance console to access Cloud de Confiance by S3NS services and APIs, you don't need to set up authentication.

  gcloud

  1. Install the Google Cloud CLI, and then sign in to the gcloud CLI with your federated identity. After signing in, initialize the Google Cloud CLI by running the following command:

     gcloud init

  2. Set a default region and zone.

  Terraform

  To use the Terraform samples on this page in a local development environment, install and initialize the gcloud CLI, and then set up Application Default Credentials with your user credentials.

  1. Install the Google Cloud CLI.

  2. Configure the gcloud CLI to use your federated identity.

     For more information, see Sign in to the gcloud CLI with your federated identity.

  3. Create local authentication credentials for your user account:

     gcloud auth application-default login

     If an authentication error is returned, confirm that you have signed in to the gcloud CLI with your federated identity.

  For more information, see Set up authentication for a local development environment.

  REST

  To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

  Install the Google Cloud CLI, and then sign in to the gcloud CLI with your federated identity.

  For more information, see Authenticate for using REST in the Cloud de Confiance authentication documentation.

Allow repairs in an alternate zone

To allow a MIG to repair a VM in an alternate zone, select one of the following options:

gcloud compute instance-groups managed update MIG_NAME \
    --on-repair-allow-changing-zone=YES \
    --force-update-on-repair \
    --region=REGION

gcloud compute instance-groups managed create MIG_NAME \
    --template=INSTANCE_TEMPLATE_URL \
    --size=SIZE \
    --zones=ZONES \
    --target-distribution-shape=SHAPE \
    --instance-redistribution-type=none \
    --on-repair-allow-changing-zone=YES \
    --force-update-on-repair

resource "google_compute_region_instance_group_manager" "default" {
  provider           = google-beta
  name               = "example-rmig"
  base_instance_name = "example-rmig-instance"
  region             = "us-central1"

  target_size                      = 3
  distribution_policy_target_shape = "BALANCED"

  version {
    instance_template = google_compute_instance_template.default.id
  }

  instance_lifecycle_policy {
    default_action_on_failure = "REPAIR"
    force_update_on_repair    = "YES"
    on_repair {
      allow_changing_zone = "YES"
    }
  }

  update_policy {
    instance_redistribution_type = "NONE"
    type                         = "OPPORTUNISTIC"
    minimal_action               = "REPLACE"
    max_surge_fixed              = 0
    max_unavailable_fixed        = 6
  }
}

PATCH https://compute.s3nsapis.fr/compute/v1/projects/PROJECT_ID/regions/REGION/instanceGroupManagers/MIG_NAME
{
    "instanceLifecyclePolicy": {
      "onRepair": {
        "allowChangingZone": "YES"
      },
      "forceUpdateOnRepair": "YES"
    }
}

POST https://compute.s3nsapis.fr/compute/v1/projects/PROJECT_ID/regions/REGION/instanceGroupManagers

{
  "name": "MIG_NAME",
  "instanceTemplate": "INSTANCE_TEMPLATE_URL",
  "targetSize": SIZE,
  "distributionPolicy": {
    "targetShape": "SHAPE"
  }
  "updatePolicy": {
    "instanceRedistributionType": none
  }
  "instanceLifecyclePolicy": {
    "forceUpdateOnRepair": "YES",
    "onRepair": {
      "allowChangingZone": "YES"
    }
  }
}

Disallow repairs in an alternate zone

If you configured a MIG to repair VM in an alternate zone, then you can restore the default setting in which the MIG repairs the VM in the original zone.

To disallow repairs in an alternate zone, select one of the following options:

gcloud compute instance-groups managed update MIG_NAME \
    --on-repair-allow-changing-zone=NO \
    --region=REGION

PATCH https://compute.s3nsapis.fr/compute/v1/projects/PROJECT_ID/regions/REGION/instanceGroupManagers/MIG_NAME
{
    "instanceLifecyclePolicy": {
      "onRepair": {
        "allowChangingZone": "NO"
      }
    }
}

What's next

• Check the repair configuration in a MIG
• Check the zone of a VM by listing the managed instances