Upgrade from Ubuntu to Ubuntu Pro

Linux

---

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

When an Ubuntu LTS image reaches its end of life, it is no longer supported and won't receive security updates. If you upgrade to Ubuntu Pro, you continue to receive security updates during Extended Security Maintenance (ESM).

This document shows you how to upgrade from Ubuntu to Ubuntu Pro by doing the following for each VM:

1. Installing updates and dependencies
2. Appending the Ubuntu Pro license
3. Validating the license

Supported upgrade paths

The following table shows the supported upgrade paths:

Initial version	Final version
Ubuntu 16.04 LTS	Ubuntu Pro 16.04 LTS
Ubuntu 18.04 LTS	Ubuntu Pro 18.04 LTS
Ubuntu 20.04 LTS	Ubuntu Pro 20.04 LTS

Limitations

• You must stop a VM before appending a license.

• You can only upgrade from Ubuntu LTS to Ubuntu Pro LTS if they are the same version. For example, you can upgrade from Ubuntu 16.04 LTS to Ubuntu Pro 16.04 LTS, but cannot upgrade from Ubuntu 16.04 LTS to Ubuntu Pro 20.04 LTS.

Billing

You are billed for Ubuntu Pro LTS according to the pricing for premium images.

For more information about billing, see Cloud Billing.

Before you begin

• Run the following commands on each VM, replacing VM_NAME with the name of the VM to upgrade:

  1. Update the package index by using the following command:

     gcloud compute ssh VM_NAME --command "sudo apt update"

  2. Install the newest version of the packages by using the following command:

     gcloud compute ssh VM_NAME --command "sudo apt -f upgrade"

  3. Install Ubuntu Pro by using the following command:

     gcloud compute ssh VM_NAME --command "sudo apt -f install ubuntu-advantage-pro"

• If you haven't already, then set up authentication. Authentication is the process by which your identity is verified for access to Google Cloud services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:
  

  Select the tab for how you plan to use the samples on this page:

  Console

  When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.

  gcloud

  1. Install the Google Cloud CLI, then initialize it by running the following command:

     gcloud init

     Note: If you installed the gcloud CLI previously, make sure you have the latest version by running gcloud components update.
  2. Set a default region and zone.

Append the license

Permissions required for this task

To perform this task, you must have the following permissions:

• compute.disks.update on the boot disk

Append the Ubuntu Pro license by using the following procedure:

1. Stop the VM by using the gcloud compute instances stop command:

   gcloud compute instances stop VM_NAME \
      --zone=ZONE
   

   Replace the following:

   • VM_NAME: the name of the VM to stop
   • ZONE: the zone containing the VM to stop

2. Get the list of disks associated with the VM by using the gcloud compute instances describe command:

   gcloud compute instances describe VM_NAME \
      --zone=ZONE \
      --format="yaml(disks)"
   

   Replace the following:

   • VM_NAME: the name of the VM to get the list of associated disks from

   • ZONE: the zone containing the VM to get the list of associated disks from

3. Verify that the output is similar to:

   disks:
   - autoDelete: true
     boot: true
     deviceName: ubuntu
     diskSizeGb: '10'
     guestOsFeatures:
     - type: VIRTIO_SCSI_MULTIQUEUE
     - type: SEV_CAPABLE
     - type: UEFI_COMPATIBLE
     - type: GVNIC
     index: 0
     interface: SCSI
     kind: compute#attachedDisk
     licenses:
     - https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/licenses/ubuntu-1604-xenial
     mode: READ_WRITE
     shieldedInstanceInitialState:
       dbxs:
       - content: ...
         fileType: BIN
     source: https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/zones/ZONE/disks/VM_NAME
     type: PERSISTENT
   

   Note that no userLicenses have been appended.

4. Get the name of the boot disk by running the gcloud compute disks list command:

   gcloud compute disks list
   

5. Update the boot disk with the Ubuntu Pro license URI by using the gcloud beta compute disks update command:

   gcloud beta compute disks update BOOT_DISK_NAME \
      --zone=ZONE \
      --update-user-licenses="LICENSE_URI"
   

   Replace the following:

   • BOOT_DISK_NAME: the name of the boot disk to append the license to.

   • ZONE: the zone containing the boot disk to append the license to.

   • LICENSE_URI: the license URI for the version of Ubuntu Pro you are upgrading to. The following table shows the license URI for the supported versions of Ubuntu Pro:

     Ubuntu Pro version	License URI
     Ubuntu Pro 16.04 LTS	https://www.googleapis.com/compute/v1/projects/ubuntu-os-pro-cloud/global/licenses/ubuntu-pro-1604-lts
     Ubuntu Pro 18.04 LTS	https://www.googleapis.com/compute/v1/projects/ubuntu-os-pro-cloud/global/licenses/ubuntu-pro-1804-lts
     Ubuntu Pro 20.04 LTS	https://www.googleapis.com/compute/v1/projects/ubuntu-os-pro-cloud/global/licenses/ubuntu-pro-2004-lts

Validate the license

Permissions required for this task

To perform this task, you must have the following permissions:

• compute.disks.get on the boot disk

Validate the Ubuntu Pro license by using the following procedure:

1. Get information about the boot disk by running the gcloud beta compute disks describe command:

   gcloud beta compute disks describe BOOT_DISK_NAME \
      --zone=ZONE
   

   Replace the following:

   • BOOT_DISK_NAME: the name of the boot disk to validate the license of

   • ZONE: the zone containing the boot disk to validate the license of

2. Verify output similar to:

   creationTimestamp: '2021-10-20T17:20:26.616-07:00'
   guestOsFeatures:
   - type: VIRTIO_SCSI_MULTIQUEUE
   - type: SEV_CAPABLE
   - type: UEFI_COMPATIBLE
   - type: GVNIC
   id: '7008232787326864549'
   kind: compute#disk
   labelFingerprint: 42WmSpB8rSM=
   lastAttachTimestamp: '2021-10-20T17:20:26.617-07:00'
   licenseCodes:
   - '1000201'
   - '8045211386737108299'
   licenses:
   - https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/licenses/ubuntu-1604-xenial
   name: ubuntu
   physicalBlockSizeBytes: '4096'
   selfLink: https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/zones/ZONE/disks/DISK_NAME
   sizeGb: '10'
   sourceImage: https://www.googleapis.com/compute/v1/projects/IMAGE_PROJECT/global/images/IMAGE
   sourceImageId: '1233998915439563944'
   status: READY
   type: https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/zones/ZONE/diskTypes/DISK_TYPE
   userLicenses:
   - https://www.googleapis.com/compute/v1/projects/ubuntu-os-pro-cloud/global/licenses/ubuntu-pro-1604-lts
   users:
   - https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/zones/ZONE/instances/VM_NAME
   zone: https://www.googleapis.com/compute/v1/projects/PROJECT_NAME/zones/ZONE
   

3. Validate that the Ubuntu Pro license is appended to the boot disk by checking the output of the previous step for the userLicenses field for the appropriate license string.

   If the userLicenses field doesn't contain the intended license string, you might need to clear and update the user licenses. For more information, see the gcloud beta compute disks update command.

4. Start the VM by using the gcloud compute instances start command:

   gcloud compute instances start VM_NAME \
      --zone=ZONE \
      [--csek-key-file ENCRYPTION_KEY]
   

   Replace the following:

   • VM_NAME: the name of the VM to start

   • ZONE: the zone containing the VM to start

   • ENCRYPTION_KEY: an optional flag that specifies the path to the Customer-Supplied Encryption Key (CSEK) file if the boot disk is encrypted

5. After the VM boots, run the gcloud compute ssh command to verify that the Ubuntu ESM is entitled and enabled:

   gcloud compute ssh VM_NAME --command "sudo ua status --wait" \
      --zone=ZONE
   

   Replace the following:

   • VM_NAME: the name of the VM to verify

   • ZONE: the zone containing the VM to verify

6. Check that the Ubuntu ESM is entitled and enabled by verifying that the output is similar to:

   SERVICE       ENTITLED  STATUS    DESCRIPTION
   cis           yes       disabled  Center for Internet Security Audit Tools
   esm-apps      yes       enabled   UA Apps: Extended Security Maintenance (ESM)
   esm-infra     yes       enabled   UA Infra: Extended Security Maintenance (ESM)
   fips          yes       n/a       NIST-certified core packages
   fips-updates  yes       n/a       NIST-certified core packages with priority security updates
   livepatch     yes       n/a       Canonical Livepatch service
   

View audit logs

View the history of license updates by using the following procedure:

1. In the Google Cloud console, go to the Activity page.

   Go to Activity

2. In the Filters pane in Categories, for Activity types select Configuration.

3. In the Filters pane in Categories, for the Resource type select Disk.