Adds `enable_secure_boot`, `enable_vtpm` and `enable_integrity_monitoring`
config options to enable building of custom Shielded GCP Compute images.
Feedback on this is more than welcome as this is my first attempt in
contributing to anything Packer related.
Packer is great for us to build custom images on top of GCP but we would
like to enhance that to support Shielded VM images. This will allow us
to have more secure and trusted images which our team(s) will be using.
It is simply the best/simplest solution and trying to prevent users from passing and integer here would be like opening a can of worms. Because:
* we cannot make mapstructure validate our duration string ( with an UnmarshalJSON func etc.)
* we cannot make mapstructure spit a string instead of a duration and packer will decode-encode-decode config.
* the hcl2 generated code asks for a string, so this will be enforced by default.
Before this commit it was possible to set a duration using an integer or a float. Go's time.Duration is an int64 internally an mapstructure will take advantage of this and load the number as a int64 but `1` means one ns which is unexpected/confusing. To avoid confusion and enforce readability this forces users to pass a string with a unit for a duration; ex "56s".
The ability to use a service account other than the default was
introduced in #5928. This change adds to that by introducing the
'disable_default_service_account' config option. If true - and
'service_account_email' is not set - Packer will create a GCE VM
with no service account.
This commit allows user to specify the service account they want
to associate with the virtual machine provisionned by setting
the service_account_email field in the config.
It allows to manage permissions of the instantiated VM properly,
using a service account that can be tied up to IAM roles and
permissions.
Run now takes a context as well as a statebag. We'll assign the context
to the blank identifier to prevent namespace collisions. We'll let the
step authors opt-in to using the context.
`find . -iname "step_*.go" -exec gsed -i'' 's/func \(.*\)Run(/func \1Run(_ context.Context, /' {} \;`
This seemed to be missing from the googlecompute provider. Now if the
ssh_private_key_file is provided, that will be used in place of a temporary
key. I didn't update the googlecompute specific docs under `./website/`, since
this parameter is already documented under the communicators templates page.
- startup scripts don't run for Windows since it is isn't implemented yet.
- startup scripts use instance metadata instead of serial port output to flag when they are done.
- added licenses to Image data type (to check if an Image is a Windows Image).
- added GetImage and GetImageFromProject to googlecompute Drivers.
- changed some of the builder/googlecompute tests to use github.com/stretchr/testify/assert.
Tests:
- (in the Packer directory) `go test .`, `go test ./builder/googlecompute`, and `go test ./post-processor/googlecompute-export`
- manual run of `packer build packer_template.json` with the following files
--packer_template.json--
{
"builders": [
{
"type": "googlecompute",
"account_file": "creds.json",
"project_id": "google.com:packer-test",
"source_image": "debian-8-jessie-v20160629",
"zone": "us-central1-a",
"startup_script_file": "startup_script.sh",
"metadata": {
"startup-script": "#!/bin/sh\necho \"This should be overwritten.\"",
"startup-script-log-dest": "gs://packer-test.google.com.a.appspot.com/startup-script.log"
},
"image_name": "test-packer-modifications",
"ssh_username": "foo"
}
],
"post-processors": [
{
"type": "googlecompute-export",
"paths": [
"gs://packer-test.google.com.a.appspot.com/foo.tar.gz",
"gs://packer-test.google.com.a.appspot.com/bar.tar.gz"
],
"keep_input_artifact": true
}
]
}
--startup_script.sh--
\#!/bin/sh
echo "Hi, my name is Scott. I'm waiting 60 seconds!" >> /scott
sleep 60
echo "I'm done waiting!" >> /scott
This change adds an `omit_external_ip` configuration property that, when true,
will cause no external IP address to be associated with the Google Compute
Engine VM provisioned to create an image. When using `omit_external_ip`, you
must also set the `use_internal_ip` configuration property to true.
Addresses #3296
- Startup scripts can be provided through the instance creation metadata field 'startup-script'.
- Script log can be copied to a GCS location by setting the metadata field 'startup-script-log-dest'.
Added Retry method to googlecompute package.
Added GetSerialPortOutput to googlecompute Drivers.
Added StepWaitInstanceStartup (and associated test) which waits for an
instance startup-script to finish.
Changed the instance service account to use the same service account as the one provided in the Packer config template. It was the project default service account.
Tested googlecompute package with 'go test' and also performed builds
with a startup script and without a startup script.
The new flow:
1) Provision the instance
2) Tear down the instance, but keep the boot disk
3) Create an image from the disk
4) Tear down the disk
The step to update gcloud is no longer needed, since gceimagebundle isn't used anymore.
Fixes#1507 and addresses https://github.com/mitchellh/packer/issues/1447#issuecomment-61610235.
Svetlin Zamfirov
Megan Marsh
desolatorxxl
Rens Sikma
Adrien Delorme
Pratyush singhal
Evan Brown
Christophe Courtaut
Matthew Hooker
Patrick Decat
Saulius Grusnys
Dimitri Rudnev
Alex Lov
Troy Toman
Rickard von Essen
Peter Schultz
Lars Wander
YAMADA Tsuyoshi
Pieter Lazzaro
Scott Crunkleton
crunk1
Evan Brown
Chris Bednarski
Matt Morrison
Caius Howcroft
Dan Buch
Mitchell Hashimoto
duftler
Dustin Carlino