ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay-guest/image/relay.pkr.hcl

@@ -0,0 +1,227 @@
+packer {
+  required_plugins {
+    oracle = {
+      source  = "github.com/hashicorp/oracle"
+      version = "= 1.1.2"
+    }
+  }
+}
+
+variable "availability_domain" {
+  type = string
+}
+
+variable "base_image_ocid" {
+  type = string
+}
+
+variable "compartment_ocid" {
+  type = string
+}
+
+variable "image_name" {
+  type = string
+}
+
+variable "image_manifest_path" {
+  type = string
+}
+
+variable "guest_sha256" {
+  type = string
+}
+
+variable "admission_sha256" {
+  type = string
+}
+
+variable "vlagent_sha256" {
+  type = string
+}
+
+variable "image_revision_sha256" {
+  type = string
+}
+
+variable "admission_binary_path" {
+  type = string
+}
+
+variable "smtp_deny_binary_path" {
+  type = string
+}
+
+variable "smtp_deny_sha256" {
+  type = string
+}
+
+variable "smtp_evidence_binary_path" {
+  type = string
+}
+
+variable "smtp_evidence_sha256" {
+  type = string
+}
+
+variable "guest_binary_path" {
+  type = string
+}
+
+variable "vlagent_binary_path" {
+  type = string
+}
+
+variable "network_security_group_ocid" {
+  type = string
+}
+
+variable "operator_api_vault_path" {
+  type = string
+}
+
+variable "oci_fingerprint" {
+  type = string
+}
+
+variable "oci_private_key" {
+  type      = string
+  sensitive = true
+}
+
+variable "oci_region" {
+  type = string
+}
+
+variable "oci_tenancy_ocid" {
+  type = string
+}
+
+variable "oci_user_ocid" {
+  type = string
+}
+
+variable "subnet_ocid" {
+  type = string
+}
+
+variable "uv_cache_directory" {
+  type = string
+}
+
+variable "uv_project_environment" {
+  type = string
+}
+
+source "oracle-oci" "relay" {
+  availability_domain = var.availability_domain
+  base_image_ocid     = var.base_image_ocid
+  compartment_ocid    = var.compartment_ocid
+  create_vnic_details {
+    assign_public_ip = true
+    nsg_ids          = [var.network_security_group_ocid]
+  }
+  image_name                                          = var.image_name
+  instance_name                                       = "oci-l4-relay-image-builder"
+  instance_options_are_legacy_imds_endpoints_disabled = true
+  fingerprint                                         = var.oci_fingerprint
+  key                                                 = var.oci_private_key
+  region                                              = var.oci_region
+  shape                                               = "VM.Standard.A1.Flex"
+  shape_config {
+    memory_in_gbs = 4
+    ocpus         = 1
+  }
+  skip_create_image = true
+  ssh_username      = "opc"
+  subnet_ocid       = var.subnet_ocid
+  tenancy_ocid      = var.oci_tenancy_ocid
+  tags = {
+    managed-by = "packer"
+    service    = "oci-l4-relay"
+  }
+  user_ocid = var.oci_user_ocid
+}
+
+build {
+  sources = ["source.oracle-oci.relay"]
+
+  provisioner "file" {
+    source      = var.guest_binary_path
+    destination = "/tmp/oci-l4-relay-guest"
+  }
+
+  provisioner "file" {
+    source      = var.admission_binary_path
+    destination = "/tmp/oci-l4-relay-admission"
+  }
+
+  provisioner "file" {
+    source      = var.smtp_deny_binary_path
+    destination = "/tmp/oci-l4-relay-smtp-deny"
+  }
+
+  provisioner "file" {
+    source      = var.smtp_evidence_binary_path
+    destination = "/tmp/oci-l4-relay-smtp-evidence"
+  }
+
+  provisioner "file" {
+    source      = var.vlagent_binary_path
+    destination = "/tmp/vlagent"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/etc/nftables.conf"
+    destination = "/tmp/nftables.conf"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/etc/modules-load.conf"
+    destination = "/tmp/modules-load.conf"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/etc/100-oracle-cloud-agent-run-command"
+    destination = "/tmp/100-oracle-cloud-agent-run-command"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/etc/[email protected]"
+    destination = "/tmp/[email protected]"
+  }
+
+  provisioner "file" {
+    source      = "${path.root}/systemd/"
+    destination = "/tmp"
+  }
+
+  provisioner "shell" {
+    execute_command = "chmod +x {{ .Path }}; sudo {{ .Vars }} {{ .Path }}"
+    script          = "${path.root}/provision.sh"
+  }
+
+  provisioner "shell-local" {
+    environment_vars = [
+      "OCI_IMAGE_ADMISSION_SHA256=${var.admission_sha256}",
+      "OCI_IMAGE_BASE_IMAGE_OCID=${var.base_image_ocid}",
+      "OCI_IMAGE_COMPARTMENT_ID=${var.compartment_ocid}",
+      "OCI_IMAGE_GUEST_SHA256=${var.guest_sha256}",
+      "OCI_IMAGE_INSTANCE_ID=${build.ID}",
+      "OCI_IMAGE_MANIFEST_PATH=${var.image_manifest_path}",
+      "OCI_IMAGE_NAME=${var.image_name}",
+      "OCI_IMAGE_REVISION_SHA256=${var.image_revision_sha256}",
+      "OCI_IMAGE_SMTP_DENY_SHA256=${var.smtp_deny_sha256}",
+      "OCI_IMAGE_SMTP_EVIDENCE_SHA256=${var.smtp_evidence_sha256}",
+      "OCI_IMAGE_VLAGENT_SHA256=${var.vlagent_sha256}",
+      "OCI_OPERATOR_API_VAULT_PATH=${var.operator_api_vault_path}",
+      "UV_CACHE_DIR=${var.uv_cache_directory}",
+      "UV_PROJECT_ENVIRONMENT=${var.uv_project_environment}",
+    ]
+    execute_command = [
+      "/bin/sh",
+      "-c",
+      "{{.Vars}} uv run --project '${path.root}' --locked python {{.Script}}",
+    ]
+    script = "${path.root}/create_image.py"
+  }
+}