70 lines
3.8 KiB
Shell
Executable file
70 lines
3.8 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
if [[ $# -ne 1 ]]; then
|
|
printf 'usage: %s ARTIFACT_DIRECTORY\n' "$0" >&2
|
|
exit 2
|
|
fi
|
|
|
|
root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
|
|
artifact_directory="$(realpath "$1")"
|
|
template="$root/services/oci-l4-relay-guest/image/relay.pkr.hcl"
|
|
image_directory="$root/services/oci-l4-relay-guest/image"
|
|
terraform="$root/terraform/external/oci-relay"
|
|
tofu="$root/scripts/tofu-pg-state"
|
|
packer="${PACKER:-packer}"
|
|
manifest="$artifact_directory/image-manifest.json"
|
|
pending_manifest="$manifest.pending"
|
|
|
|
command -v "$packer" >/dev/null
|
|
command -v jq >/dev/null
|
|
command -v uv >/dev/null
|
|
command -v vault >/dev/null
|
|
test ! -e "$manifest"
|
|
test ! -e "$pending_manifest"
|
|
for artifact in artifact-manifest.json oci-l4-relay-admission oci-l4-relay-guest oci-l4-relay-smtp-deny oci-l4-relay-smtp-evidence vlagent; do
|
|
test -f "$artifact_directory/$artifact"
|
|
done
|
|
|
|
credentials="$(vault kv get -format=json "${OCI_OPERATOR_API_VAULT_PATH:-secret/oci/operator-api}")"
|
|
guest_sha256="$(jq -er '.guest_sha256' "$artifact_directory/artifact-manifest.json")"
|
|
admission_sha256="$(jq -er '.admission_sha256' "$artifact_directory/artifact-manifest.json")"
|
|
smtp_deny_sha256="$(jq -er '.smtp_deny_sha256' "$artifact_directory/artifact-manifest.json")"
|
|
smtp_evidence_sha256="$(jq -er '.smtp_evidence_sha256' "$artifact_directory/artifact-manifest.json")"
|
|
vlagent_sha256="$(jq -er '.vlagent_sha256' "$artifact_directory/artifact-manifest.json")"
|
|
image_revision_sha256="$(
|
|
tar --create --file=- --sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0 --numeric-owner \
|
|
--directory="$image_directory" provision.sh relay.pkr.hcl etc systemd |
|
|
sha256sum | awk '{print $1}'
|
|
)"
|
|
|
|
export PKR_VAR_admission_binary_path="$artifact_directory/oci-l4-relay-admission"
|
|
export PKR_VAR_admission_sha256="$admission_sha256"
|
|
export PKR_VAR_smtp_deny_binary_path="$artifact_directory/oci-l4-relay-smtp-deny"
|
|
export PKR_VAR_smtp_deny_sha256="$smtp_deny_sha256"
|
|
export PKR_VAR_smtp_evidence_binary_path="$artifact_directory/oci-l4-relay-smtp-evidence"
|
|
export PKR_VAR_smtp_evidence_sha256="$smtp_evidence_sha256"
|
|
export PKR_VAR_availability_domain="$("$tofu" -chdir="$terraform" output -raw availability_domain)"
|
|
export PKR_VAR_base_image_ocid="$("$tofu" -chdir="$terraform" output -raw base_image_ocid)"
|
|
export PKR_VAR_compartment_ocid="$("$tofu" -chdir="$terraform" output -raw compartment_id)"
|
|
export PKR_VAR_guest_binary_path="$artifact_directory/oci-l4-relay-guest"
|
|
export PKR_VAR_guest_sha256="$guest_sha256"
|
|
export PKR_VAR_image_manifest_path="$manifest"
|
|
export PKR_VAR_image_name="oci-l4-relay-${guest_sha256:0:12}-${admission_sha256:0:12}-${smtp_deny_sha256:0:12}-${smtp_evidence_sha256:0:12}-${vlagent_sha256:0:12}-${image_revision_sha256:0:12}"
|
|
export PKR_VAR_image_revision_sha256="$image_revision_sha256"
|
|
export PKR_VAR_network_security_group_ocid="$("$tofu" -chdir="$terraform" output -raw image_builder_network_security_group_id)"
|
|
export PKR_VAR_operator_api_vault_path="${OCI_OPERATOR_API_VAULT_PATH:-secret/oci/operator-api}"
|
|
export PKR_VAR_oci_fingerprint="$(jq -er '.data.data.fingerprint' <<<"$credentials")"
|
|
export PKR_VAR_oci_private_key="$(jq -er '.data.data.private_key' <<<"$credentials")"
|
|
export PKR_VAR_oci_region="$(jq -er '.data.data.region' <<<"$credentials")"
|
|
export PKR_VAR_oci_tenancy_ocid="$(jq -er '.data.data.tenancy_ocid' <<<"$credentials")"
|
|
export PKR_VAR_oci_user_ocid="$(jq -er '.data.data.user_ocid' <<<"$credentials")"
|
|
export PKR_VAR_subnet_ocid="$("$tofu" -chdir="$terraform" output -raw relay_subnet_id)"
|
|
export PKR_VAR_uv_cache_directory="$artifact_directory/.uv-cache"
|
|
export PKR_VAR_uv_project_environment="$artifact_directory/.oci-image-venv"
|
|
export PKR_VAR_vlagent_binary_path="$artifact_directory/vlagent"
|
|
export PKR_VAR_vlagent_sha256="$vlagent_sha256"
|
|
|
|
"$packer" init "$template"
|
|
"$packer" validate "$template"
|
|
"$packer" build "$template"
|