Membuat pipeline image OS kustom menggunakan gcloud atau Terraform

gcloud

Untuk men-deploy dan menjalankan pipeline penyesuaian gambar, dari direktori terminal lokal yang berisi kedua file konfigurasi, jalankan perintah gcloud builds submit:

gcloud builds submit . \
    --config=cloudbuild.yaml \
    --project=PROJECT_ID \
    --service-account="projects/PROJECT_ID/serviceAccounts/SERVICE_ACCOUNT_EMAIL" \
    --region=REGION

Ganti kode berikut:

• PROJECT_ID: Cloud de Confiance Project ID Anda.
• REGION: Cloud de Confiance region tempat menjalankan tugas pipeline penyesuaian gambar.
• SERVICE_ACCOUNT_EMAIL: alamat email akun layanan yang dikonfigurasi dengan izin IAM yang diperlukan.

Perintah ini mengupload ruang kerja penyesuaian Anda, mendaftarkan eksekusi Cloud Build, dan meluncurkan container orkestrasi.

Terraform

Untuk menyediakan infrastruktur yang diperlukan untuk membangun dan memvalidasi image OS yang disesuaikan secara otomatis, Anda dapat menggunakan Terraform. Konfigurasi Terraform ini menyelesaikan tugas berikut:

• Mengaktifkan API Cloud de Confiance yang diperlukan.
• Membuat bucket Cloud Storage khusus (workdir_bucket) untuk menyimpan log sementara dan artefak build.
• Mengonfigurasi pemicu Cloud Build (image_builder_trigger) yang ditautkan ke koneksi repositori GitHub Developer Connect Anda.

Buat file konfigurasi Terraform Anda

Untuk mengatur dan men-deploy infrastruktur pipeline menggunakan Terraform, selesaikan langkah-langkah berikut:

1. Buat direktori khusus di workstation lokal atau lingkungan CI/CD, terpisah dari repositori aplikasi Anda, lalu ubah ke direktori tersebut:

   mkdir terraform-image-builder && cd terraform-image-builder
   

2. Di direktori ini, buat lima file konfigurasi Terraform berikut:

   • terraform.tfvars: menetapkan nilai untuk variabel khusus project.
   • main.tf: menyediakan resource di Cloud de Confiance project Anda, termasuk mengaktifkan API yang diperlukan, membuat bucket penyiapan Cloud Storage (workdir_bucket), dan men-deploy pemicu Cloud Build (image_builder_trigger).
   • outputs.tf: menentukan nilai output yang ditampilkan di terminal Anda setelah deployment, seperti ID pemicu dan nama bucket penyiapan.
   • providers.tf: menentukan versi Terraform yang diperlukan (>= 1.3) dan mengonfigurasi penyedia Cloud de Confiance by S3NS (hashicorp/google).
   • variables.tf: menentukan variabel input, nilai default, dan aturan validasi untuk deployment.

   Pilih salah satu tab berikut untuk melihat dan menyalin konfigurasi setiap file ke direktori lokal Anda:

   terraform.tfvars

   File ini menentukan nilai parameter untuk lingkungan Anda untuk variabel yang dideklarasikan:

   project_id                = "PROJECT_ID"
   builder_service_account   = "SERVICE_ACCOUNT_EMAIL"
   github_repo_name          = "projects/PROJECT_ID/locations/LOCATION/connections/CONNECTION/repositories/REPO_NAME"
   region                    = "REGION"
   trigger_name              = "TRIGGER_NAME"
   cloudbuild_yaml_path      = "CLOUDBUILD_YAML_PATH"
   image_builder_config_path = "RECIPE_PATH"
   gcs_lifecycle_age_days    = LIFECYCLE_DAYS
   ar_repository_id          = "REPOSITORY_NAME"
   ar_package_name           = "PACKAGE_NAME"
   

   Ganti placeholder berikut untuk resource yang sudah ada:

   • PROJECT_ID: project ID Cloud de Confiance by S3NS yang ada.
   • SERVICE_ACCOUNT_EMAIL: alamat email akun layanan build yang dikonfigurasi di Konfigurasi akun layanan Image Builder.
   • LOCATION, CONNECTION, dan REPO_NAME: region host Developer Connect, nama koneksi, dan link repositori yang dikonfigurasi di Menghubungkan repositori.
   • CLOUDBUILD_YAML_PATH: jalur relatif ke file cloudbuild.yaml di direktori lokal Anda. Anda tidak perlu mencentang cloudbuild.yaml ke repositori Git Anda.
   • RECIPE_PATH: jalur relatif ke file resep penyesuaian imagebuilder.yaml yang dicentang ke repositori Git Anda.
   • REPOSITORY_NAME: repositori Artifact Registry generik yang ada dan dibuat di Mengonfigurasi Artifact Registry.

   Ganti placeholder berikut untuk resource yang dibuat Terraform:

   • REGION: target Cloud de Confiance region tempat Terraform menyediakan bucket penyiapan Cloud Storage dan pemicu Cloud Build, misalnya, us-central1.
   • TRIGGER_NAME: nama pemicu repositori Cloud Build baru yang dibuat oleh Terraform, misalnya, git-push-os-builder.
   • LIFECYCLE_DAYS: periode retensi dalam hari sebelum artefak perantara di bucket penyiapan Cloud Storage yang dibuat oleh Terraform dihapus secara otomatis, misalnya, 30.
   • PACKAGE_NAME: nama yang Anda inginkan agar Terraform gunakan untuk paket yang dibuat di dalam repositori Artifact Registry Anda. Paket ini menyimpan versi image OS yang dipublikasikan, misalnya, ubuntu-custom.

   main.tf

   File ini mendeklarasikan sumber data dan resource infrastruktur inti untuk deployment:

   # Main resource configurations for Image Builder.
   # 1. Enable Required APIs
   resource "google_project_service" "apis" {
     for_each = toset([
       "compute.googleapis.com",
       "cloudbuild.googleapis.com",
       "artifactregistry.googleapis.com",
       "serviceusage.googleapis.com",
       "cloudresourcemanager.googleapis.com",
       "iam.googleapis.com",
       "storage.googleapis.com"
     ])
     project = var.project_id
     service = each.key
     disable_on_destroy = false
   }
   
   # 2. Project data source to retrieve Project Number
   data "google_project" "project" {
     project_id = var.project_id
     depends_on = [google_project_service.apis]
   }
   
   locals {
     builder_sa = var.builder_service_account
   }
   
   # 3. Storage Bucket for Image Builder Workdir
   resource "google_storage_bucket" "workdir_bucket" {
     name                        = var.gcs_bucket_name != "" ? var.gcs_bucket_name : "${var.project_id}-vm-builder-workdir"
     project                     = var.project_id
     location                    = var.region
     force_destroy               = true
     uniform_bucket_level_access = true
     lifecycle_rule {
       action {
         type = "Delete"
       }
       condition {
         age = var.gcs_lifecycle_age_days
       }
     }
     depends_on = [google_project_service.apis]
   }
   
   # 4. Cloud Build Trigger
   resource "google_cloudbuild_trigger" "image_builder_trigger" {
     name        = var.trigger_name
     location    = var.region
     project     = var.project_id
     description = "Trigger that runs Image Builder customization"
   
     service_account = var.builder_service_account != "" ? "projects/${var.project_id}/serviceAccounts/${var.builder_service_account}" : null
   
     repository_event_config {
       repository = replace(var.github_repo_name, "gitRepositoryLinks", "repositories")
       push {
         branch = "^main$"
       }
     }
     filename = var.cloudbuild_yaml_path
   
     substitutions = {
       _GCS_WORKDIR                    = "gs://${google_storage_bucket.workdir_bucket.name}/workdir/"
       _SERVICE_ACCOUNT                = "projects/${var.project_id}/serviceAccounts/${local.builder_sa}"
       _IMAGE_OUTPUT_PATH              = "image-builder/binaryOut"
       _PROJECT_ID                     = var.project_id
       _LOCATION                       = var.region
       _REPOSITORY_NAME                = var.ar_repository_id
       _PACKAGE_NAME                   = var.ar_package_name
       _IMAGE_BUILDER_CONFIG_PATH      = var.image_builder_config_path
       _ARTIFACT_REGISTRY_RESOURCE_URI = "projects/${var.project_id}/locations/${var.region}/repositories/${var.ar_repository_id}/packages/${var.ar_package_name}/versions/v$${BUILD_ID}"
     }
     depends_on = [
       google_project_service.apis
     ]
   }
   

   outputs.tf

   File ini menentukan atribut output yang ditampilkan ke terminal Anda setelah deployment:

   output "builder_service_account" {
     value       = local.builder_sa
     description = "The email representation of the resolved Image Builder service account."
   }
   
   output "workdir_bucket" {
     value       = google_storage_bucket.workdir_bucket.name
     description = "The name of the storage workdir bucket."
   }
   
   output "artifact_registry_repository" {
     value       = "projects/${var.project_id}/locations/${var.region}/repositories/${var.ar_repository_id}"
     description = "The fully qualified resource path of the Artifact Registry repository."
   }
   
   output "cloud_build_trigger_id" {
     value       = google_cloudbuild_trigger.image_builder_trigger.trigger_id
     description = "The unique ID for the created Cloud Build Trigger."
   }
   

   providers.tf

   File ini mengonfigurasi setelan versi dan region Terraform yang diperlukan:

   terraform {
     required_version = ">= 1.3"
     required_providers {
       google = {
         source  = "hashicorp/google"
         version = ">= 5.0, < 7.0"
       }
     }
   }
   
   provider "google" {
     project = var.project_id
     region  = var.region
   }
   

   variables.tf

   File ini mendeklarasikan semua variabel input wajib dan opsional serta aturan validasi:

   variable "project_id" {
     type        = string
     description = "The target Project ID where resources will be created."
     validation {
       condition     = can(regex("^[a-z0-9-]{6,30}$", var.project_id))
       error_message = "The project_id must consist of lowercase letters, numbers, and hyphens, and be between 6 and 30 characters."
     }
   }
   
   variable "region" {
     type        = string
     default     = "us-central1"
     description = "Location used for cloud build triggers, storage buckets, and artifact registry."
   }
   
   variable "github_repo_name" {
     type        = string
     default     = ""
     description = "Developer Connect github repository details, format: projects/PROJECT_ID/locations/LOCATION/connections/CONNECTION/repositories/REPO_LINK"
     validation {
       condition     = can(regex("^projects/[^/]+/locations/[^/]+/connections/[^/]+/(gitRepositoryLinks|repositories)/[^/]+$", var.github_repo_name))
       error_message = "The github_repo_name must follow either the Cloud Build v2 repository link format (using '/repositories/') or the Developer Connect resource format (using '/gitRepositoryLinks/')."
     }
   }
   
   variable "builder_service_account" {
     type        = string
     default     = ""
     description = "The email representation of the pre-existing Image Builder service account. If omitted, the default Cloud Build service account will be used."
   }
   
   variable "gcs_bucket_name" {
     type        = string
     default     = ""
     description = "Custom name for the workdir storage bucket. If left empty, a default name using the project ID will be constructed."
   }
   
   variable "gcs_lifecycle_age_days" {
     type        = number
     default     = 30
     description = "The number of days after which temporary logs and artifacts in the storage workdir bucket are deleted."
   }
   
   variable "ar_repository_id" {
     type        = string
     default     = "vm-images"
     description = "The repository ID for the generic Artifact Registry hosting the final OS image tarballs."
   }
   
   variable "ar_package_name" {
     type        = string
     default     = "image-builder"
     description = "The package name under which the generic OS image artifact will be registered in Artifact Registry."
   }
   
   variable "trigger_name" {
     type        = string
     default     = "custom-os-image-builder"
     description = "The name of the Cloud Build trigger."
   }
   
   variable "cloudbuild_yaml_path" {
     type        = string
     default     = "cloudbuild.yaml"
     description = "The path to the cloudbuild.yaml configuration file relative to the repository root."
   }
   
   variable "image_builder_config_path" {
     type        = string
     default     = "imagebuilder.yaml"
     description = "The path to the imagebuilder.yaml configuration file relative to the repository root."
   }
   

3. Untuk men-deploy konfigurasi, jalankan perintah berikut di direktori yang berisi file Terraform Anda:

   1. Lakukan inisialisasi direktori:

      terraform init

   2. Validasi sintaksis:

      terraform validate

   3. Melihat pratinjau deployment:

      terraform plan

   4. Terapkan konfigurasi:

      terraform apply