Golden OS Images

A project for building and managing golden (pre-configured) operating system images using Packer and Ansible, with automated deployment to Azure.

Overview

This project automates the creation of golden Ubuntu images with hardened security configurations and monitoring setup. The built images are stored as Azure Managed Images in your resource group.

Project Structure

├── ansible/                 # Ansible playbooks and roles for image provisioning
│   ├── playbooks/          # Main playbooks
│   │   └── configure.yml   # Image configuration playbook
│   └── roles/              # Reusable Ansible roles
│       ├── base/           # Base OS configuration
│       ├── hardening/      # Security hardening
│       └── monitoring/     # Monitoring setup
├── packer/                 # Packer configurations
│   └── ubuntu/             # Ubuntu image builder
│       ├── ubuntu.pkr.hcl  # Main Packer configuration
│       ├── variables.pkr.hcl # Packer variables
│       └── version.json    # Version information
├── scripts/                # Utility scripts
│   ├── generate-metadata.sh # Generate image metadata
│   └── validate.sh         # Validation scripts
└── .github/workflows/      # CI/CD pipelines
    └── build-image.yml     # Automated build workflow

Prerequisites

• Packer >= 1.8.0
• Ansible >= 2.9
• Azure CLI for authentication and image management
• Azure Subscription with appropriate permissions
• GitHub Secrets configured (see Configuration section)

Getting Started

1. Configure Azure Credentials

Set the following secret in your GitHub repository:

• AZURE_CREDENTIALS - Azure service principal credentials (JSON format)

2. Local Testing

To build the image locally:

cd packer/ubuntu
packer build -var-file="variables.pkr.hcl" ubuntu.pkr.hcl

3. Automated Build via GitHub Actions

Push to the main branch to trigger the automated build workflow:

git push origin main

The workflow will:

1. Check out the code
2. Authenticate with Azure
3. Build the golden image with Packer
4. Run Ansible provisioning (base, hardening, monitoring)
5. Upload the image to Azure Storage (if configured)

Roles

• base: Installs and configures base OS components
• hardening: Applies security hardening policies (SSH configuration, firewall, etc.)
• monitoring: Sets up monitoring agents and logging

Customize these roles by editing the corresponding tasks/main.yml and defaults/main.yml files.

Variables

Edit packer/ubuntu/variables.pkr.hcl to customize:

• image_name - Base image name
• location - Azure region
• resource_group - Target resource group
• image_sku - Ubuntu version

Usage

Building a Golden Image

packer build packer/ubuntu

Validating Configuration

bash scripts/validate.sh

Generating Metadata

bash scripts/generate-metadata.sh

Output

• Azure Managed Image: Stored in the specified resource group, named with format: {image_name}-golden-{date}
• Azure Storage (optional): VHD file uploaded with timestamp for archival and sharing

CI/CD Pipeline

The GitHub Actions workflow automates the entire process:

• Triggers on push to main branch

• Builds image with Packer

• Provisions with Ansible

• Uploads to storage (optional)

• Packer Build Fails: Check Azure credentials and ensure the service principal has necessary permissions

• Ansible Provisioning Fails: Verify Ansible syntax with ansible-playbook --syntax-check

• Upload Fails: Ensure storage account name and container name are correctly set in GitHub secrets

Contribution

1. Create a feature branch: git checkout -b feature/your-feature
2. Make changes and test locally
3. Push and create a pull request
4. Merge to main to trigger the build pipeline