Packer Image Pipelines

The image factory produces the node template that every cluster in every site boots from. If the factory is manual or inconsistent, every cluster inherits drift from its template. This page collects the pipeline shape, versioning strategy, validation gates, and operating model for a Packer-based image factory with vSphere. Pipeline Shape graph LR TRIGGER[Git Tag / Schedule] --> BUILD[Packer Build] BUILD --> VALIDATE[Boot + Validate] VALIDATE --> HARDEN[Apply Baselines] HARDEN --> TEMPLATE[Convert To Template] TEMPLATE --> TEST[Test Instance] TEST --> PROMOTE[Promote Template] PROMOTE --> CLEANUP[Cleanup Temp Resources] Show Mermaid source graph LR TRIGGER[Git Tag / Schedule] --> BUILD[Packer Build] BUILD --> VALIDATE[Boot + Validate] VALIDATE --> HARDEN[Apply Baselines] HARDEN --> TEMPLATE[Convert To Template] TEMPLATE --> TEST[Test Instance] TEST --> PROMOTE[Promote Template] PROMOTE --> CLEANUP[Cleanup Temp Resources] Template Versioning Date-based versioning works for node templates because consumers (cluster autoscaler, Terraform modules) select images by a version string, not by semantic compatibility: ...

Base images are production dependencies. Treat them like versioned platform artifacts, not disposable installer output. Packer should create the repeatable baseline. Per-environment configuration should happen later through Terraform, cloud-init, configuration management, or bootstrap scripts. Baseline Contents Images should include: OS updates at build time. required agents. VMware tools or cloud guest agents. logging and monitoring prerequisites. bootstrap entrypoint. security baseline packages. cleanup of machine identity before sealing. Images should not include environment-specific secrets, static hostnames, or one-off workload configuration. ...

A Packer build that completes is not necessarily a usable image. Validation gates should prove that downstream provisioning can consume the image without rediscovering template defects. Build-Time Validation During the build, validate: package installation. service enablement. guest agent status. SSH or WinRM access. cleanup scripts. cloud-init or customization readiness. Post-Build Validation After the template is created, clone it in a test environment. Check: VM boots cleanly. hostname customization works. primary network config works. SSH access works through expected users. guest tools report healthy. bootstrap logs are present. storage prerequisites are installed. For Kubernetes node images, also validate container runtime, kubelet prerequisites, CSI prerequisites, and any required kernel modules or packages. ...

Image versioning should make rollback boring. If operators cannot tell which template built a VM, what changed in that template, and whether it is safe to roll back, the image pipeline is incomplete. Version Format Use a version format that carries time and intent: ubuntu-22.04-k8s-node-2026.06.10-1 ubuntu-22.04-base-2026.06.10-1 Include: OS family and version. purpose. build date. build sequence or semantic version. Metadata Store metadata with the image: Git commit. Packer version. builder plugin versions. package manifest or important package versions. validation result. deprecation state. In vSphere, use template names, notes, tags, or custom attributes consistently. ...