diff --git a/builder/googlecompute/config.go b/builder/googlecompute/config.go index 7f4325a20..41c36d517 100644 --- a/builder/googlecompute/config.go +++ b/builder/googlecompute/config.go @@ -285,13 +285,17 @@ type Config struct { // https://www.vaultproject.io/docs/commands/#environment-variables // Example:`"vault_gcp_oauth_engine": "gcp/token/my-project-editor",` VaultGCPOauthEngine string `mapstructure:"vault_gcp_oauth_engine"` - // The zone in which to launch the instance used to create the image. - // Example: "us-central1-a" - - // The time to wait between instance creation and adding SSH keys. + // The time to wait between the creation of the instance used to create the image, + // and the addition of SSH configuration, including SSH keys, to that instance. + // The delay is intended to protect packer from anything in the instance boot + // sequence that has potential to disrupt the creation of SSH configuration + // (e.g. SSH user creation, SSH key creation) on the instance. + // Note: All other instance metadata, including startup scripts, are still added to the instance + // during it's creation. // Example value: `5m`. WaitToAddSSHKeys time.Duration `mapstructure:"wait_to_add_ssh_keys"` - + // The zone in which to launch the instance used to create the image. + // Example: "us-central1-a" Zone string `mapstructure:"zone" required:"true"` account *ServiceAccount diff --git a/builder/googlecompute/driver.go b/builder/googlecompute/driver.go index 65243250b..96fef6574 100644 --- a/builder/googlecompute/driver.go +++ b/builder/googlecompute/driver.go @@ -69,6 +69,9 @@ type Driver interface { // DeleteOSLoginSSHKey deletes the SSH public key for OSLogin with the given key. DeleteOSLoginSSHKey(user, fingerprint string) error + + // Add to the instance metadata for the existing instance + AddToInstanceMetadata(zone string, name string, metadata map[string]string) (<-chan error, error) } type InstanceConfig struct { diff --git a/builder/googlecompute/driver_gce.go b/builder/googlecompute/driver_gce.go index 5ade084c2..8678fd7eb 100644 --- a/builder/googlecompute/driver_gce.go +++ b/builder/googlecompute/driver_gce.go @@ -727,3 +727,43 @@ func waitForState(errCh chan<- error, target string, refresh stateRefreshFunc) e errCh <- err return err } + +func (d *driverGCE) AddToInstanceMetadata(zone string, name string, metadata map[string]string) (<-chan error, error) { + + instance, err := d.service.Instances.Get(d.projectId, zone, name).Do() + if err != nil { + return nil, err + } + + // Build up the metadata + metadataForInstance := make([]*compute.MetadataItems, len(metadata)) + for k, v := range metadata { + vCopy := v + metadataForInstance = append(metadataForInstance, &compute.MetadataItems{ + Key: k, + Value: &vCopy, + }) + } + + instance.Metadata.Items = append(instance.Metadata.Items, metadataForInstance...) + + op, err := d.service.Instances.SetMetadata(d.projectId, zone, name, &compute.Metadata{ + Fingerprint: instance.Metadata.Fingerprint, + Items: instance.Metadata.Items, + }).Do() + + if err != nil { + return nil, err + } + + newErrCh := make(chan error, 1) + go waitForState(newErrCh, "DONE", d.refreshZoneOp(zone, op)) + + select { + case err = <-newErrCh: + case <-time.After(time.Second * 30): + err = errors.New("time out while waiting for SSH keys to be added to instance") + } + + return newErrCh, err +} \ No newline at end of file diff --git a/builder/googlecompute/driver_mock.go b/builder/googlecompute/driver_mock.go index da5599bc9..bd455841b 100644 --- a/builder/googlecompute/driver_mock.go +++ b/builder/googlecompute/driver_mock.go @@ -88,6 +88,12 @@ type DriverMock struct { WaitForInstanceZone string WaitForInstanceName string WaitForInstanceErrCh <-chan error + + AddToInstanceMetadataZone string + AddToInstanceMetadataName string + AddToInstanceMetadataKVPairs map[string]string + AddToInstanceMetadataErrCh <-chan error + AddToInstanceMetadataErr error } func (d *DriverMock) CreateImage(name, description, family, zone, disk string, image_labels map[string]string, image_licenses []string, image_encryption_key *compute.CustomerEncryptionKey, imageStorageLocations []string) (<-chan *Image, <-chan error) { @@ -288,3 +294,18 @@ func (d *DriverMock) ImportOSLoginSSHKey(user, key string) (*oslogin.LoginProfil func (d *DriverMock) DeleteOSLoginSSHKey(user, fingerprint string) error { return nil } + +func (d *DriverMock) AddToInstanceMetadata(zone string, name string, metadata map[string]string) (<-chan error, error) { + d.AddToInstanceMetadataZone = zone + d.AddToInstanceMetadataName = name + d.AddToInstanceMetadataKVPairs = metadata + + resultCh := d.AddToInstanceMetadataErrCh + if resultCh == nil { + ch := make(chan error) + close(ch) + resultCh = ch + } + + return resultCh, d.AddToInstanceMetadataErr +} \ No newline at end of file diff --git a/builder/googlecompute/startup.go b/builder/googlecompute/startup.go index 743778a2c..bdb147479 100644 --- a/builder/googlecompute/startup.go +++ b/builder/googlecompute/startup.go @@ -1,7 +1,7 @@ package googlecompute import ( - "fmt" + "fmt" ) const StartupScriptKey string = "startup-script" @@ -57,4 +57,4 @@ SetMetadata %s %s exit $RETVAL `, StartupWrappedScriptKey, StartupScriptStatusKey, StartupScriptStatusDone) -var StartupScriptWindows string = "" +var StartupScriptWindows string = "" \ No newline at end of file diff --git a/builder/googlecompute/step_create_instance.go b/builder/googlecompute/step_create_instance.go index 9e9eb5094..fa52ae8b6 100644 --- a/builder/googlecompute/step_create_instance.go +++ b/builder/googlecompute/step_create_instance.go @@ -7,6 +7,7 @@ import ( "io/ioutil" "strings" "time" + "log" "github.com/hashicorp/packer/packer" "github.com/hashicorp/packer/packer-plugin-sdk/multistep" @@ -17,14 +18,23 @@ type StepCreateInstance struct { Debug bool } -func (c *Config) createInstanceMetadata(sourceImage *Image, sshPublicKey string) (map[string]string, error) { - instanceMetadata := make(map[string]string) +func (c *Config) createInstanceMetadata(sourceImage *Image, sshPublicKey string) (map[string]string, map[string]string, error) { + + instanceMetadataNoSSHKeys := make(map[string]string) + instanceMetadataSSHKeys := make(map[string]string) + + sshMetaKey := "ssh-keys" + var err error var errs *packer.MultiError // Copy metadata from config. for k, v := range c.Metadata { - instanceMetadata[k] = v + if k == sshMetaKey { + instanceMetadataSSHKeys[k] = v + } else { + instanceMetadataNoSSHKeys[k] = v + } } // Merge any existing ssh keys with our public key, unless there is no @@ -34,40 +44,40 @@ func (c *Config) createInstanceMetadata(sourceImage *Image, sshPublicKey string) sshMetaKey := "ssh-keys" sshPublicKey = strings.TrimSuffix(sshPublicKey, "\n") sshKeys := fmt.Sprintf("%s:%s %s", c.Comm.SSHUsername, sshPublicKey, c.Comm.SSHUsername) - if confSshKeys, exists := instanceMetadata[sshMetaKey]; exists { - sshKeys = fmt.Sprintf("%s\n%s", sshKeys, confSshKeys) + if confSSHKeys, exists := instanceMetadataSSHKeys[sshMetaKey]; exists { + sshKeys = fmt.Sprintf("%s\n%s", sshKeys, confSSHKeys) } - instanceMetadata[sshMetaKey] = sshKeys + instanceMetadataSSHKeys[sshMetaKey] = sshKeys } - startupScript := instanceMetadata[StartupScriptKey] + startupScript := instanceMetadataNoSSHKeys[StartupScriptKey] if c.StartupScriptFile != "" { var content []byte content, err = ioutil.ReadFile(c.StartupScriptFile) if err != nil { - return nil, err + return nil, instanceMetadataNoSSHKeys, err } startupScript = string(content) } - instanceMetadata[StartupScriptKey] = startupScript + instanceMetadataNoSSHKeys[StartupScriptKey] = startupScript // Wrap any found startup script with our own startup script wrapper. if startupScript != "" && c.WrapStartupScriptFile.True() { - instanceMetadata[StartupScriptKey] = StartupScriptLinux - instanceMetadata[StartupWrappedScriptKey] = startupScript - instanceMetadata[StartupScriptStatusKey] = StartupScriptStatusNotDone + instanceMetadataNoSSHKeys[StartupScriptKey] = StartupScriptLinux + instanceMetadataNoSSHKeys[StartupWrappedScriptKey] = startupScript + instanceMetadataNoSSHKeys[StartupScriptStatusKey] = StartupScriptStatusNotDone } if sourceImage.IsWindows() { // Windows startup script support is not yet implemented so clear any script data and set status to done - instanceMetadata[StartupScriptKey] = StartupScriptWindows - instanceMetadata[StartupScriptStatusKey] = StartupScriptStatusDone + instanceMetadataNoSSHKeys[StartupScriptKey] = StartupScriptWindows + instanceMetadataNoSSHKeys[StartupScriptStatusKey] = StartupScriptStatusDone } // If UseOSLogin is true, force `enable-oslogin` in metadata // In the event that `enable-oslogin` is not enabled at project level if c.UseOSLogin { - instanceMetadata[EnableOSLoginKey] = "TRUE" + instanceMetadataNoSSHKeys[EnableOSLoginKey] = "TRUE" } for key, value := range c.MetadataFiles { @@ -76,50 +86,13 @@ func (c *Config) createInstanceMetadata(sourceImage *Image, sshPublicKey string) if err != nil { errs = packer.MultiErrorAppend(errs, err) } - instanceMetadata[key] = string(content) + instanceMetadataNoSSHKeys[key] = string(content) } if errs != nil && len(errs.Errors) > 0 { - return instanceMetadata, errs - } - return instanceMetadata, nil -} - -func (s *StepCreateInstance) addMetadataToInstance(ctx context.Context, errCh chan<- error, name, state multistep.StateBag, metadata map[string]string) { - - c := state.Get("config").(*Config) - d := state.Get("driver").(Driver) - - instance, err := d.service.Instances.Get(d.projectId, c.Zone, name).Do() - if err != nil { - errCh <- err - return - } - instance.Metadata.Items = append(instance.Metadata.Items, &compute.MetadataItems{Key: "windows-keys", Value: &sshPublicKey}) - - op, err := d.service.Instances.SetMetadata(d.projectId, zone, name, &compute.Metadata{ - Fingerprint: instance.Metadata.Fingerprint, - Items: instance.Metadata.Items, - }).Do() - - if err != nil { - errCh <- err - return - } - - newErrCh := make(chan error, 1) - go waitForState(newErrCh, "DONE", d.refreshZoneOp(zone, op)) - - select { - case err = <-newErrCh: - case <-time.After(time.Second * 30): - err = errors.New("time out while waiting for SSH public key to be added to instance") - } - - if err != nil { - errCh <- err - return + return instanceMetadataNoSSHKeys, instanceMetadataSSHKeys, errs } + return instanceMetadataNoSSHKeys, instanceMetadataSSHKeys, nil } func getImage(c *Config, d Driver) (*Image, error) { @@ -168,17 +141,26 @@ func (s *StepCreateInstance) Run(ctx context.Context, state multistep.StateBag) name := c.InstanceName var errCh <-chan error - var metadata map[string]string - metadata, errs := c.createInstanceMetadata(sourceImage, string(c.Comm.SSHPublicKey)) + metadataNoSSHKeys := make(map[string]string) + metadataSSHKeys := make(map[string]string) + metadataForInstance := make(map[string]string) + + metadataNoSSHKeys, metadataSSHKeys, errs := c.createInstanceMetadata(sourceImage, string(c.Comm.SSHPublicKey)) if errs != nil { state.Put("error", errs.Error()) ui.Error(errs.Error()) return multistep.ActionHalt } - if c.WaitToAddSSHKeys == 0 { - ui.Message("Adding SSH keys during instance creation...") - metadata = make(map[string]string) + if c.WaitToAddSSHKeys > 0 { + log.Printf("[DEBUG] Adding metadata during instance creation, but not SSH keys...") + metadataForInstance = metadataNoSSHKeys + } else { + log.Printf("[DEBUG] Adding metadata during instance creation...") + + // Union of both non-SSH key meta data and SSH key meta data + addmap(metadataForInstance, metadataSSHKeys) + addmap(metadataForInstance, metadataNoSSHKeys) } errCh, err = d.RunInstance(&InstanceConfig{ @@ -195,7 +177,7 @@ func (s *StepCreateInstance) Run(ctx context.Context, state multistep.StateBag) Image: sourceImage, Labels: c.Labels, MachineType: c.MachineType, - Metadata: metadata, + Metadata: metadataForInstance, MinCpuPlatform: c.MinCpuPlatform, Name: name, Network: c.Network, @@ -242,15 +224,18 @@ func (s *StepCreateInstance) Run(ctx context.Context, state multistep.StateBag) state.Put("instance_id", name) if c.WaitToAddSSHKeys > 0 { - ui.Say(fmt.Sprintf("Waiting %s before adding SSH keys...", + ui.Message(fmt.Sprintf("Waiting %s before adding SSH keys...", c.WaitToAddSSHKeys.String())) - cancelled := s.wait(c.WaitToAddSSHKeys, ctx) + cancelled := s.waitForBoot(ctx, c.WaitToAddSSHKeys) if cancelled { return multistep.ActionHalt } + + log.Printf("[DEBUG] %s wait is over. Adding SSH keys to existing instance...", + c.WaitToAddSSHKeys.String()) + errCh, err = d.AddToInstanceMetadata(c.Zone, name, metadataSSHKeys) - metadata, errs = s.addMetadataToInstance(metadata, d, c) - if errs != nil { + if err != nil { state.Put("error", errs.Error()) ui.Error(errs.Error()) return multistep.ActionHalt @@ -260,14 +245,14 @@ func (s *StepCreateInstance) Run(ctx context.Context, state multistep.StateBag) return multistep.ActionContinue } -func (s *StepCreateInstance) wait(waitLen time.Duration, ctx context.Context) bool { +func (s *StepCreateInstance) waitForBoot(ctx context.Context, waitLen time.Duration) bool { // Use a select to determine if we get cancelled during the wait select { case <-ctx.Done(): return true case <-time.After(waitLen): } - ui.Message("Wait over; adding SSH keys to instance...") + return false } @@ -329,3 +314,9 @@ func (s *StepCreateInstance) Cleanup(state multistep.StateBag) { return } + +func addmap(a map[string]string, b map[string]string) { + for k,v := range b { + a[k] = v + } +} \ No newline at end of file diff --git a/builder/googlecompute/step_create_instance_test.go b/builder/googlecompute/step_create_instance_test.go index 42fa74d8c..86870d86f 100644 --- a/builder/googlecompute/step_create_instance_test.go +++ b/builder/googlecompute/step_create_instance_test.go @@ -305,12 +305,12 @@ func TestCreateInstanceMetadata(t *testing.T) { key := "abcdefgh12345678" // create our metadata - metadata, err := c.createInstanceMetadata(image, key) + _, metadataSSHKeys, err := c.createInstanceMetadata(image, key) assert.True(t, err == nil, "Metadata creation should have succeeded.") // ensure our key is listed - assert.True(t, strings.Contains(metadata["ssh-keys"], key), "Instance metadata should contain provided key") + assert.True(t, strings.Contains(metadataSSHKeys["ssh-keys"], key), "Instance metadata should contain provided key") } func TestCreateInstanceMetadata_noPublicKey(t *testing.T) { @@ -320,12 +320,12 @@ func TestCreateInstanceMetadata_noPublicKey(t *testing.T) { sshKeys := c.Metadata["ssh-keys"] // create our metadata - metadata, err := c.createInstanceMetadata(image, "") + _, metadataSSHKeys, err := c.createInstanceMetadata(image, "") assert.True(t, err == nil, "Metadata creation should have succeeded.") // ensure the ssh metadata hasn't changed - assert.Equal(t, metadata["ssh-keys"], sshKeys, "Instance metadata should not have been modified") + assert.Equal(t, metadataSSHKeys["ssh-keys"], sshKeys, "Instance metadata should not have been modified") } func TestCreateInstanceMetadata_metadataFile(t *testing.T) { @@ -337,12 +337,12 @@ func TestCreateInstanceMetadata_metadataFile(t *testing.T) { c.MetadataFiles["user-data"] = fileName // create our metadata - metadata, err := c.createInstanceMetadata(image, "") + metadataNoSSHKeys, _,err := c.createInstanceMetadata(image, "") assert.True(t, err == nil, "Metadata creation should have succeeded.") // ensure the user-data key in metadata is updated with file content - assert.Equal(t, metadata["user-data"], content, "user-data field of the instance metadata should have been updated.") + assert.Equal(t, metadataNoSSHKeys["user-data"], content, "user-data field of the instance metadata should have been updated.") } func TestCreateInstanceMetadata_withWrapStartupScript(t *testing.T) { @@ -377,11 +377,99 @@ func TestCreateInstanceMetadata_withWrapStartupScript(t *testing.T) { c.WrapStartupScriptFile = tc.WrapStartupScript // create our metadata - metadata, err := c.createInstanceMetadata(image, "") + metadataNoSSHKeys, _, err := c.createInstanceMetadata(image, "") assert.True(t, err == nil, "Metadata creation should have succeeded.") - assert.Equal(t, tc.StartupScriptContents, metadata[StartupScriptKey], fmt.Sprintf("Instance metadata for startup script should be %q.", tc.StartupScriptContents)) - assert.Equal(t, tc.WrappedStartupScriptContents, metadata[StartupWrappedScriptKey], fmt.Sprintf("Instance metadata for wrapped startup script should be %q.", tc.WrappedStartupScriptContents)) - assert.Equal(t, tc.WrappedStartupScriptStatus, metadata[StartupScriptStatusKey], fmt.Sprintf("Instance metadata startup script status should be %q.", tc.WrappedStartupScriptStatus)) + assert.Equal(t, tc.StartupScriptContents, metadataNoSSHKeys[StartupScriptKey], fmt.Sprintf("Instance metadata for startup script should be %q.", tc.StartupScriptContents)) + assert.Equal(t, tc.WrappedStartupScriptContents, metadataNoSSHKeys[StartupWrappedScriptKey], fmt.Sprintf("Instance metadata for wrapped startup script should be %q.", tc.WrappedStartupScriptContents)) + assert.Equal(t, tc.WrappedStartupScriptStatus, metadataNoSSHKeys[StartupScriptStatusKey], fmt.Sprintf("Instance metadata startup script status should be %q.", tc.WrappedStartupScriptStatus)) } } + +func TestCreateInstanceMetadataWaitToAddSSHKeys(t *testing.T) { + state := testState(t) + c := state.Get("config").(*Config) + image := StubImage("test-image", "test-project", []string{}, 100) + key := "abcdefgh12345678" + + var waitTime int = 4 + c.WaitToAddSSHKeys = time.Duration(waitTime) * time.Second + c.Metadata = map[string]string{ + "metadatakey1": "xyz", + "metadatakey2": "123", + } + + // create our metadata + metadataNoSSHKeys, metadataSSHKeys, err := c.createInstanceMetadata(image, key) + + assert.True(t, err == nil, "Metadata creation should have succeeded.") + + // ensure our metadata is listed + assert.True(t, strings.Contains(metadataSSHKeys["ssh-keys"], key), "Instance metadata should contain provided SSH key") + assert.True(t, strings.Contains(metadataNoSSHKeys["metadatakey1"], "xyz"), "Instance metadata should contain provided key: metadatakey1") + assert.True(t, strings.Contains(metadataNoSSHKeys["metadatakey2"], "123"), "Instance metadata should contain provided key: metadatakey2") +} + +func TestStepCreateInstanceWaitToAddSSHKeys(t *testing.T) { + state := testState(t) + step := new(StepCreateInstance) + defer step.Cleanup(state) + + state.Put("ssh_public_key", "key") + + c := state.Get("config").(*Config) + d := state.Get("driver").(*DriverMock) + d.GetImageResult = StubImage("test-image", "test-project", []string{}, 100) + + key := "abcdefgh12345678" + + var waitTime int = 5 + c.WaitToAddSSHKeys = time.Duration(waitTime) * time.Second + c.Comm.SSHPublicKey = []byte(key) + + c.Metadata = map[string]string{ + "metadatakey1": "xyz", + "metadatakey2": "123", + } + + // run the step + assert.Equal(t, step.Run(context.Background(), state), multistep.ActionContinue, "Step should have passed and continued.") + + // Verify state + _, ok := state.GetOk("instance_name") + assert.True(t, ok, "State should have an instance name.") + + // cleanup + step.Cleanup(state) +} + +func TestStepCreateInstanceNoWaitToAddSSHKeys(t *testing.T) { + state := testState(t) + step := new(StepCreateInstance) + defer step.Cleanup(state) + + state.Put("ssh_public_key", "key") + + c := state.Get("config").(*Config) + d := state.Get("driver").(*DriverMock) + d.GetImageResult = StubImage("test-image", "test-project", []string{}, 100) + + key := "abcdefgh12345678" + + c.Comm.SSHPublicKey = []byte(key) + + c.Metadata = map[string]string{ + "metadatakey1": "xyz", + "metadatakey2": "123", + } + + // run the step + assert.Equal(t, step.Run(context.Background(), state), multistep.ActionContinue, "Step should have passed and continued.") + + // Verify state + _, ok := state.GetOk("instance_name") + assert.True(t, ok, "State should have an instance name.") + + // cleanup + step.Cleanup(state) +} \ No newline at end of file diff --git a/website/pages/partials/builder/googlecompute/Config-not-required.mdx b/website/pages/partials/builder/googlecompute/Config-not-required.mdx index f1cb5a9eb..3bc4a6647 100644 --- a/website/pages/partials/builder/googlecompute/Config-not-required.mdx +++ b/website/pages/partials/builder/googlecompute/Config-not-required.mdx @@ -241,3 +241,12 @@ instance. For more information, see the Vault docs: https://www.vaultproject.io/docs/commands/#environment-variables Example:`"vault_gcp_oauth_engine": "gcp/token/my-project-editor",` + +- `wait_to_add_ssh_keys` (duration string | ex: "1h5m2s") - The time to wait between the creation of the instance used to create the image, + and the addition of SSH configuration, including SSH keys, to that instance. + The delay is intended to protect packer from anything in the instance boot + sequence that has potential to disrupt the creation of SSH configuration + (e.g. SSH user creation, SSH key creation) on the instance. + Note: All other instance metadata, including startup scripts, are still added to the instance + during it's creation. + Example value: `5m`.