We will be using some pieces of information repeatedly, so it makes sense to create some variables to store that information. This will make the instructions more efficient and easier to read.
***Then we will create the identity, image definition and gallery that we will need for the image.
Set variables for use throughout the tutorial
We will create a new resource group for this tutorial. The name should be one you are not already using. We will delete the resource group at the end of the tutorial.
Please note that in order to create a custom image, the VM Image Builder must be in the same resource group as the source-managed image.
# Resource group name - we are using ibUbuntuFIPSGalleryRG in this example
sigResourceGroup=ibUbuntuFIPSGalleryRG
# Datacenter location - we are using West US 2 in this example
location=westus2
# Additional region to replicate the image to - we are using East US in this example
additionalregion=eastus
Now we will set variables for the Gallery Name and Image Definition Name. The image will be displayed in the Azure Portal as sigName/imageDefName.
# Name of the Azure Compute Gallery - myGallery in this example
sigName=myIbGallery
# Name of the image definition to be created - myImageDef in this example
imageDefName=myIbImageDef
# image distribution metadata reference name
runOutputName=aibUbuntuSIG
Create a variable for your subscription ID:
subscriptionID=$(az account show --query id --output tsv)
Now we are going to set variables for the Ubuntu Pro plan we are going to use in this tutorial. If you have an Ubuntu Pro private offer with Canonical that includes 24x7 Technical Support with SLAs, you will have a custom Offer and Sku. If not, we will use the plan name and product for the public Ubuntu Pro 20.04 FIPS from the Azure Marketplace, please note that we are using the gen2 Sku.
# ProPlanPublisher the 'Publisher' field for the Marketplace VM Offer we want to start from
ProPlanPublisher=canonical
# ProPlanOffer the 'Offer' field for the Marketplace VM Offer we want to start from
ProPlanOffer=0001-com-ubuntu-pro-focal-fips
# ProPlanSku the 'Sku' field for the Marketplace VM Offer we want to start from
ProPlanSku=pro-fips-20_04-gen2
Create required resources, identities and permissions
Create the resource group:
az group create -n $sigResourceGroup -l $location --subscription $subscriptionID
Image Builder will use the user-identity provided to inject the image into the Azure Shared Image Gallery (SIG). In this example, you will create an Azure role definition that has the actions needed to distribute the image to the SIG. The role definition will then be assigned to the user-identity.
# create user assigned identity for image builder to access the storage account where the script is located
identityName=aibBuiUserId$(date +'%s')
az identity create -g $sigResourceGroup -n $identityName --subscription $subscriptionID
# get identity id
imgBuilderCliId=$(az identity show -g $sigResourceGroup -n $identityName --subscription $subscriptionID -o json | grep "clientId" | cut -c16- | tr -d '",')
# get the user identity URI, needed for the template
imgBuilderId=/subscriptions/$subscriptionID/resourcegroups/$sigResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$identityName
# this command will download an Azure role definition template, and update the template with the parameters specified earlier.
curl https://raw.githubusercontent.com/Azure/azvmimagebuilder/master/solutions/12_Creating_AIB_Security_Roles/aibRoleImageCreation.json -o aibRoleImageCreation.json
imageRoleDefName="Azure Image Builder Image Def"$(date +'%s')
# update the definition
sed -i -e "s/<subscriptionID>/$subscriptionID/g" aibRoleImageCreation.json
sed -i -e "s/<rgName>/$sigResourceGroup/g" aibRoleImageCreation.json
sed -i -e "s/Azure Image Builder Service Image Creation Role/$imageRoleDefName/g" aibRoleImageCreation.json
# create role definitions
az role definition create --role-definition ./aibRoleImageCreation.json
# grant role definition to the user assigned identity
# If this gives an error, wait a bit longer and try again
az role assignment create \
--assignee $imgBuilderCliId \
--role "$imageRoleDefName" \
--scope /subscriptions/$subscriptionID/resourceGroups/$sigResourceGroup
Create an image definition and gallery
In order to use VM Image Builder with Azure Compute Gallery, you will need to have an existing gallery and image definition. VM Image Builder does not create the gallery and image definition for you.
First, create a gallery:
az sig create \
-g $sigResourceGroup \
--gallery-name $sigName \
--subscription $subscriptionID
Then, create an image definition, note the “hyper-v-generation” flag, this needs to be the same gen as the base image you are using.
az sig image-definition create \
-g $sigResourceGroup \
--gallery-name $sigName \
--gallery-image-definition $imageDefName \
--publisher $ProPlanPublisher \
--offer $ProPlanOffer \
--sku $ProPlanSku \
--os-type Linux \
--plan-name $ProPlanSku \
--plan-product $ProPlanOffer \
--plan-publisher $ProPlanPublisher \
--hyper-v-generation V2 \
--subscription $subscriptionID
