trim_packer_config.txt

trim_packer_config.txt

packer {
  required_plugins {
    amazon = {
      version = ">= 1.2.9"
      source = "github.com/hashicorp/amazon"
    }
    ansible = {
      version = ">= 1.1.1"
      source  = "github.com/hashicorp/ansible"
    }
  }
}

variable "build_id" {
  type    = string
  default = env("CI_JOB_ID")
}

variable "filter_tag" {
  type    = string
  default = "architecture"
}

variable "filter_tag_value" {
  type    = string
  default = "*"
}

variable "iam_instance_profile" {
  type    = string
  default = env("IAM_INSTANCE_PROFILE")
}

variable "instance_type" {
  type    = string
  default = env("INSTANCE_TYPE")
}

variable "os_type" {
  type    = string
  default = env("OSTYPE")
}

variable "os_code" {
  type    = string
  default = env("OSCODE")
}

variable "os_vers" {
  type    = string
  default = env("OSVERS")
}

variable "os_nptype" {
  type    = string
  default = env("NPTYPE")
}

variable "product_os_and_version" {
  type    = string
  default = "${env("OSTYPE")}${env("OSVERS")}"
}

variable "product_os_and_version_and_variant" {
  type    = string
  default = "${env("OSTYPE")}${env("OSVERS")}-${env("NPTYPE")}"
}

variable "region" {
  type    = string
  default = env("AWS_REGION")
}

variable "release_cycle" {
  type    = string
  default = env("RELEASE_CYCLE")
}

variable "release_id" {
  type    = string
  default = env("RELEASE_ID")
}

variable "security_group_id" {
  type    = string
  default = env("SECURITY_GROUP_ID")
}

variable "subnet_id" {
  type    = string
  default = env("SUBNET_ID")
}

variable "vpc_id" {
  type    = string
  default = env("VPC_ID")
}

variable "ami_block_device_name" {
  type    = string
  default = env("AMI_BLOCK_DEVICE_NAME")
}

variable "boot_context" {
  type    = string
  default = env("BOOT_CONTEXT")
}

locals { timestamp = regex_replace(timestamp(), "[- TZ:]", "") }

variable "eks_version" {
  type    = string
  default = env("EKS_VERSION")
}

variable "eks_inspec_test" {
  type = string
}

variable "eks_gpu_inspec_test" {
  type = string
}

variable "ecs_inspec_test" {
  type = string
}

variable "os_user" {
  type = string
}

variable "artifactory_os_repo" {
  type = string
}

# Disable the below lines when we want to fetch the latest source AMI
#variable "source_ami" {
# type = string
#}

variable "ansible_playbook" {
  type = list(string)
}

variable "ansible_playbook_tags" {
  type    = string
  default = "--skip-tags=Sysdig"
}

variable "playbook_extra_vars" {
  type    = string
  default = "--extra-vars '{\"sysctl_overwrite\": {\"net.ipv4.ip_forward\":\"1\"}}'"
}

variable "repo_file" {
  type = string
}

variable "linux-baseline" {
  type = string
}

variable "np_release_file" {
  type    = string
  default = "np-release"
}

variable "sysctl_forwarding" {
  type = string
}

variable "ssh-baseline" {
  type    = string
  default = env("SSH_BASELINE_SKIP")
}

variable "hop_limit" {
  type    = string
  default = env("HOP_LIMIT")
}

variable "packer_source_ami" {
  type = string
}

variable "owners" {
  type = string
}

data "amazon-ami" "packer_source_ami" {
  filters = {
    name                = var.packer_source_ami
    root-device-type    = "ebs"
    virtualization-type = "hvm"
    "${var.filter_tag}" = "${var.filter_tag_value}"
  }
  owners      = ["${var.owners}"]
  most_recent = true
}


build {

  name = "main"

  sources = [
    "source.amazon-ebs.XYZ",
  ]

  provisioner "ansible-local" {
    clean_staging_directory = true
    staging_directory       = "/tmp/ansible"
    command                 = "GALAXY_DISPLAY_PROGRESS=1 ANSIBLE_FORCE_COLOR=1 PYTHONUNBUFFERED=1 ANSIBLE_CONFIG=/tmp/ansible/playbooks/ansible.cfg /usr/local/bin/ansible-playbook"
    extra_arguments = [
      # To debug ansible role, enable the below line
      # "-vvvv",
      var.ansible_playbook_tags,
      var.playbook_extra_vars,
      "--extra-vars \"ansible_python_interpreter=/bin/python3 NPTYPE=${var.os_nptype}\""
    ]
    playbook_dir   = "ansible"
    playbook_files = var.ansible_playbook
    galaxy_file    = "ansible/playbooks/requirements.yml"
  }

source "amazon-ebs" "XYZ" {
  ami_block_device_mappings {
    delete_on_termination = true
    device_name           = var.ami_block_device_name
  }
  ami_name             = "XYZAMI-${formatdate("YYYYMMDD-hhmm", timestamp())}-${var.release_id}-${var.product_os_and_version_and_variant}"
  iam_instance_profile = var.iam_instance_profile
  instance_type        = var.instance_type
  region               = var.region
  run_tags = {
    Name             = "Packer-${formatdate("YYYY-MM-DD-hh-mm-ss", timestamp())}-${var.release_id}-${var.product_os_and_version_and_variant}"
    SourceAMI        = data.amazon-ami.packer_source_ami.id   # Disable this line when we want to Hard Code AMI
    SourceAMIName    = data.amazon-ami.packer_source_ami.name # Disable this line wwhen we want to Hard Code AMI
   }
  run_volume_tags = {
    SourceAMI     = data.amazon-ami.packer_source_ami.id   # Disable this line when we want to Hard Code AMI
    SourceAMIName = data.amazon-ami.packer_source_ami.name # Disable this line when we want to Hard Code AMI
  }
  security_group_id        = var.security_group_id
  shutdown_behavior        = "terminate"
  source_ami               = data.amazon-ami.packer_source_ami.id # Disable this line when we want to Hard Code AMI
  ssh_file_transfer_method = "sftp"
  ssh_read_write_timeout   = "5m"
  ssh_username             = var.os_user
  temporary_key_pair_type  = "ed25519"
  subnet_id                = var.subnet_id
  tags = {
    Name             = "XYZAMI-${formatdate("YYYYMMDD-hhmm", timestamp())}-${var.release_id}-${var.product_os_and_version_and_variant}"
    OSDistribution   = var.os_code
    SourceAMI        = data.amazon-ami.packer_source_ami.id   # Disable this line when we want to Hard Code AMI
    SourceAMIName    = data.amazon-ami.packer_source_ami.name # Disable this line when we want to Hard Code AMI
    created          = local.timestamp
    decommissioned   = "0"
    distributed      = "0"
  }
  aws_polling {
    delay_seconds = 120
    max_attempts  = 60
  }

  # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-new-instances.html#configure-IMDS-new-instances
  metadata_options {
    http_endpoint               = "enabled"
    http_tokens                 = "required"
    http_put_response_hop_limit = var.hop_limit
  }
  # imds_support   = "v2.0"
  user_data_file = "packer/files/sshd_config.sh"
  vpc_id         = var.vpc_id
}