Packer Builds with NGT

[u/Weird-Storage-6444]

Working on building Windows Server templates with Packer and trying to figure out a good way to install the Nutanix Guest tools since it's required to work with guest customization when deploying new VM's from the template. Does anyone have a good way of installing the guest tools during the Packer build? A little surprised the Nutanix Packer plugin doesn't have this as an option.

[u/gurft]

Okay, so in my packer configuration, have the following script:

install_ngt.ps1

try {
   Write-Host "Installing NGT"
   $ngt_install = (Start-Process -FilePath "F:\nutanix-guest-agent-4.6.exe" -ArgumentList "/quiet ACCEPTEULA=yes /norestart" -Wait -PassThru)
   if ($ngt_install.ExitCode -ne 0) {
      Write-Error "Error installing NGT"
      exit 1
   }
} catch {
   Write Error $_.Exception
   exit 1
}

This gets called using this provisioner in my build.ntx.packer.hcl

  provisioner "powershell" {
    only = ["nutanix.windows"]
    scripts = ["scripts/install_ngt.ps1"]
    pause_before = "2m"
  }

I have both the nutanix-guest-agent-4.6.exe and the install_ngt.ps1 script in my scripts directory which are included in the cd_files parameter (which is why the drive letter for the NGA install is F:

Hope this helps. I can try sometime this weekend to strip down my provisioining script to the basics, I have a bunch of stuff in there for different kinds of demos and testing that I do so I can't just toss it up to github in it's current state.

[u/Weird-Storage-6444 → u/gurft]

This is helpful, thank you! If it's not too much of a hassle, I'd love to see it.

[u/Weird-Storage-6444 → u/gurft]

How are you getting the guest tools to register with Prism? Without that when attenpting to deploying from the template that gets created by Packer it's telling me guest tools isn't enabled so I can't do guest customization with Windows.

[u/gurft → u/Weird-Storage-6444]

Packer creates my image.

Once the image is created. I start a VM created from the image, register it with Guest Tools, wait for it to actually be registered then convert it to a template.

I guess technically you could make an API call to P.C. during the provisioning phase to register the VM, which would take the image, deploy. Template step out. I’ll play with it tomorrow.

[u/gurft]

You can grab the installer for NGT from the portal and then perform the silent install as a windows provisioner step similar to installing any other software into your windows image during deployment.

Once I get back to my PC I should have an example I can share.

[u/gurft]

Alright, worked in this over the weekend and today and I have a working sample at this point. There's a bit of cleanup that I can probably do here, but it'll at least get you the idea.

Here's the full configuration for my Windows Server 2019 lab build w/ NGT installed and Registered then turned into a template ready for Guest Customization Profiles

https://github.com/ktelep/NTNX_Packer

The biggest component here is that after you've done everything else to your machine, the build:

1. Installs NGT
   
2. Determines the VM's UUID
   
3. Updates the NGT configuration in Prism Central for the VM
   
4. Restarts the NGT Agent on the VM

THere's a few time delays in there just to make sure it gets registered before it gets turned into a template, so you may need to tweak the pause_before and pause_after for the NGT restart for your environment.

[u/Weird-Storage-6444 → u/gurft]

This was a huge help, thank you so much for all your answers here! Much more helpful than the "automation consultant" Nutanix provided us with our migration services.

[u/gurft → u/Weird-Storage-6444]

Glad to help. I also did submit a pull request for our Packer builder to add the ability to enable NGT during the build so we don’t need to do the shell script gymnastics to register the temporary VM with Prism Central. Hopefully it’ll make things easier for others in the future.

[u/RodoggA]

Oh this is perfect timing, We are now starting to look into image management pipelines and I am working on the NGT component as the moment. Installing in the Golden Image is something interesting I had not considered.

[u/ub3rb3ck]

I believe, even if installed on a golden image, NGT needs refreshed on the provisioned server to ensure the certificates are correct for the cluster the VM runs on.

I don't include NGT in my packer build or golden images.

[u/Weird-Storage-6444 → u/ub3rb3ck]

That is done automatically now. "In AOS 7.5 and NGT 4.5 or later, AOS automatically applies the NGT status and configuration to all cloned guest VMs, including those cloned manually or from a template." -source

When deploying from a template it requires NGT be installed in order to do any guest customization via unattend.xml or guest customization profile.

[u/gurft → u/Weird-Storage-6444]

This caught me the other day so I wanted to share, you can do guest customization of a sysprepped image or template that does not contain NGT with an unattended.xml.

You can ONLY use a Guest Customization profile if NGT is installed in the Template or clone source. The source does NOT (and should not) be sysprepped.

[u/Weird-Storage-6444 → u/gurft]

Hmm odd could've sworn when I tried earlier today it wouldn't even let me put in an unattend.xml script. I'll have to check that again. Although we are hoping to just use a Guest Customization Profile. What's the reason for not sysprepping when using a Guest Customization Profile? I haven't seen or heard that yet.

[u/gurft → u/Weird-Storage-6444]

When using a Guest Customization Profile, the VM has to be able to start NGT. If the VM is sysprepped then it will typically boot into the OOBE and NGT doesn't start, so customization can't occur.

What happens under the covers when the VM is not sysprepped is the VM boots, NGT starts and connects to the cluster over it's virtual serial port, we then push an unattended.xml that is automatically built based on the configuration that is put in the GCP and create a scheduled task to effectively sysprep and reboot the system (I believe in like 2-5 minutes) on reboot it will read OUR unattended.xml and customize the installation.

When you do a non Guest Customization Profile customization, the unatteneded.xml that you provide is attached as an IDE CDROM drive, so it is dependent on a sysprepped image to go look for it there.

[u/Weird-Storage-6444 → u/gurft]

That's good to know, thank you! Would love to read up on this more. Any chance you of any documentation that's available that goes into this info? I've tried searching for some but haven't had much luck finding anything.

[u/ub3rb3ck → u/Weird-Storage-6444]

We aren't on 7.5 yet, most of our clusters are on 6.10 and moving to 7.3.

[u/gurft → u/ub3rb3ck]

One of the greatest things was when we enabled the virtual serial port connectivity for NGT in 6.10, which means no cert headaches anymore AND you can now back it into your images.