VM template life cycle

This section explains how to update and maintain your VM templates while maintaining the connection between the VM template and the VMs deployed from them. It is important to update them methodically to keep your VMs in compliance efficiently.

The three ways to keep templates up to date are as follows:

Update your VM templates at regular intervals. For example, you might modify the attached policies weekly and create new VM templates monthly.

Modifying attached policies

You can update your VM templates by modifying the contents of the policies attached to the VM template. This is the simplest method of updating VM templates.

  1. Modify the policies attached to your VMs and the VM template from which they were created.
  2. Remediate the existing VMs previously created from the VM template. This brings them into compliance with the updated policies.

    All VMs previously deployed from the VM template immediately become noncompliant and require remediation to be brought back into compliance.

    For details about performing actions on a group of related VMs and VM templates, see Genealogy of virtualization.

  3. Deploy new VMs from the updated VM template.
  4. Scan and remediate the new VMs to bring them into compliance with the updated policies.

    All new VMs deployed from the updated VM template immediately require a compliance scan and remediation, because the baseline VM template does not contain the new additions to the policies.

    For details about performing actions on a group of related VMs and VM templates, see Genealogy of virtualization.

The following figure shows the VM template, the VMs created from it, and the attached policies.

Modifying attached policies and creating a new VM template

The following figure shows the old VM template (VM Template A), the new VM template (VM Template B), and the policies attached to both VM templates and to all the VMs deployed from them.

After updating the policies attached to your VM templates, you can create a new VM template from the old VM template with the same set of policies:

  1. Deploy a VM from the VM template (VM Template A in the previous figure).
  2. Remediate the VM.
  3. Convert the VM to a new VM template (VM Template B in the previous figure). This incorporates the contents of all the policies into the baseline VM template (B).
  4. Remediate all VMs previously deployed from the original VM template (A) to ensure they are in compliance.

    After creating the new VM template (B), all VMs previously deployed from the VM template (A) immediately become noncompliant and require remediation to be brought into compliance.

  5. Deploy new VMs from the new VM template (B).

    All new VMs deployed from the new VM template (B) are compliant and do not need remediation. However, they do require a compliance scan.

    For details about performing actions on a group of related VMs and VM templates, see Genealogy of virtualization.

Attaching new policies and creating a new VM template

This section describes how you can add new policies and create a new VM template, and maintain compliance of all VMs previously created from the original VM template. The following figure shows this scenario before adding new policies.

VM template C before adding new policies

  1. Deploy a VM from the VM template (VM Template C in the previous figure).
  2. Attach new policies to the VM.
  3. Remediate the VM to incorporate the new policies into the baseline VM.
  4. Convert the VM to a new VM template (VM Template D in the previous figure).
  5. Search for all VMs created from the original VM template (C).

    All VMs previously deployed from the original VM template (C) will not have the new policies attached. You can search for all those VMs that were deployed from the original VM template (C), attach the new policies to those VMs, then remediate them to bring them into compliance with the new set of policies and the new VM template (D).

  6. Attach the new policies to all the VMs deployed from VM templates (C).
  7. Remediate all those VMs to bring them into compliance.
  8. Instruct your users to use the new VM template (D) to create VMs. All VMs deployed from the new VM template are compliant and do not need remediation. However, they do require a compliance scan. This process is made easier by performing the Genealogy action for the original VM template, because all VMs previously deployed from the template are grouped together. For details about performing actions on a group of related VMs and VM templates, see Genealogy of virtualization.

The following figure shows this scenario after all steps have been completed.

VM Template D after attaching two new policies