azure-VM-image-create-job.yaml

apiVersion: batch/v1
kind: Job
metadata:
  name: azure-image-creation
  namespace: openshift-sandboxed-containers-operator
spec:
  parallelism: 1
  completions: 1
  backoffLimit: 1
  template:
    metadata:
      name: azure-image-creation
    spec:
      volumes:
      - name: shared-data
        emptyDir: {}
      - name: image-id
        emptyDir: {}

      initContainers:
      - name: payload
        image: registry.redhat.io/openshift-sandboxed-containers/osc-podvm-payload-rhel9:latest
        imagePullPolicy: Always
        volumeMounts:
        - name: shared-data
          mountPath: /payload
        command: ["/bin/sh"]
        args: ["-c", "cp /podvm-binaries.tar.gz /payload/"]

      containers:
      - name: create
        image: registry.access.redhat.com/ubi9/ubi:9.2
        securityContext:
          runAsUser: 0 # needed for container mode dnf access
        volumeMounts:
        - name: shared-data
          mountPath: /payload
        - name: image-id
          mountPath: /output
        env:
#          - name: VM_SIZE
#            value: "Standard_A2_v2"
          - name: CLOUD_PROVIDER
            value: azure
          - name: PODVM_DISTRO
            value: rhel
          - name: PUBLISHER
            value: "RedHat"
          - name: OFFER
            value: "rhel-raw"
          - name: SKU
            value: "9_2"
          - name: IMAGE_NAME
            value: "peer-pod-vmimage"
        envFrom:
        - secretRef:
            name: peer-pods-secret
        - configMapRef:
            name: peer-pods-cm
            optional: true
        command:
        - /bin/sh
        - -c
        - |
          set -e
          rpm --import https://packages.microsoft.com/keys/microsoft.asc
          dnf install -y https://packages.microsoft.com/config/rhel/9.0/packages-microsoft-prod.rpm
          dnf install -y make git azure-cli unzip
          curl https://releases.hashicorp.com/packer/1.9.4/packer_1.9.4_linux_amd64.zip -o packer_1.9.4_linux_amd64.zip
          echo "6cd5269c4245aa8c99e551d1b862460d63fe711c58bec618fade25f8492e80d9  packer_1.9.4_linux_amd64.zip" | sha256sum -c
          unzip packer_1.9.4_linux_amd64.zip -d /usr/bin/
          PATH="/usr/bin:${PATH}"
          curl -L https://github.com/mikefarah/yq/releases/download/v4.35.2/yq_linux_amd64 -o /usr/bin/yq # TODO: remove?
          echo "8afd786b3b8ba8053409c5e7d154403e2d4ed4cf3e93c237462dc9ef75f38c8d /usr/bin/yq" | sha256sum -c
          chmod +x /usr/bin/yq
          git clone https://github.com/confidential-containers/cloud-api-adaptor.git && (cd cloud-api-adaptor && git checkout 90ccfc3fa0ee56c2fc61b23ecf3731f819faf875)
          [ "$BOOT_FIPS" == "true" ] && sed -i '/exit 0/ifips-mode-setup --enable' cloud-api-adaptor/azure/image/misc-settings.sh
          tar xvf /payload/podvm-binaries.tar.gz -C cloud-api-adaptor/podvm/files
          mkdir cloud-api-adaptor/podvm/files/pause_bundle # workaround to avoid pause image requirement
          [[ ! "${AZURE_REGION}" ]] && echo "AZURE_REGION is missing" && exit 1
          [[ ! "${AZURE_TENANT_ID}" ]] && echo "AZURE_TENANT_ID is missing" && exit 1
          [[ ! "${AZURE_RESOURCE_GROUP}" ]] && echo "AZURE_RESOURCE_GROUP is missing" && exit 1
          [[ ! "${AZURE_SUBSCRIPTION_ID}" ]] && echo "AZURE_SUBSCRIPTION_ID is missing" && exit 1
          [[ ! "${AZURE_CLIENT_SECRET}" ]] && echo "AZURE_CLIENT_SECRET is missing" && exit 1
          [[ ! "${AZURE_CLIENT_ID}" ]] && echo "AZURE_CLIENT_ID is missing" && exit 1
          export PKR_VAR_client_id=${AZURE_CLIENT_ID}
          export PKR_VAR_client_secret=${AZURE_CLIENT_SECRET}
          export PKR_VAR_subscription_id=${AZURE_SUBSCRIPTION_ID}
          export PKR_VAR_tenant_id=${AZURE_TENANT_ID}
          export PKR_VAR_resource_group=${AZURE_RESOURCE_GROUP}
          export PKR_VAR_location=${AZURE_LOCATION}
          export PKR_VAR_az_image_name=${IMAGE_NAME}
          export PKR_VAR_vm_size=${VM_SIZE:-Standard_A2_v2}
          export PKR_VAR_ssh_username=${SSH_USERNAME:-peerpod}
          export PKR_VAR_publisher=${PUBLISHER}
          export PKR_VAR_offer=${OFFER}
          export PKR_VAR_sku=${SKU}
          export PKR_VAR_plan_name=${PLAN_NAME}
          export PKR_VAR_plan_product=${PLAN_PRODUCT}
          export PKR_VAR_plan_publisher=${PLAN_PUBLISHER}
          cd cloud-api-adaptor/azure/image
          packer init ${PODVM_DISTRO}/
          make BINARIES= PAUSE_BUNDLE= image && \
          az login --service-principal --user=${AZURE_CLIENT_ID} --password=${AZURE_CLIENT_SECRET} --tenant=${AZURE_TENANT_ID} && \
          AZURE_IMAGE_ID=$(az image list --resource-group ${AZURE_RESOURCE_GROUP} --query "[].{Id: id} | [? contains(Id, '${IMAGE_NAME}')]" --output tsv) && \
          echo ${AZURE_IMAGE_ID} >> /output/image-id
          echo "DONE: ${AZURE_IMAGE_ID}"

      - name: result
        image: registry.access.redhat.com/ubi9/ubi:9.2
        volumeMounts:
        - name: image-id
          mountPath: /output
        envFrom:
        - secretRef:
            name: peer-pods-secret
        - configMapRef:
            name: peer-pods-cm
            optional: true
        command:
        - /bin/sh
        - -c
        - |
          while  [ ! -f /output/image-id  ]; do sleep 5; done
          cat /output/image-id

      restartPolicy: Never