Chapter 2. Uploading images to GCP with RHEL image builder

Procedure

1. Use a text editor to create a gcp-config.toml configuration file with the following content:

   provider = "gcp"
   [settings]
   bucket = "GCP_BUCKET"
   region = "GCP_STORAGE_REGION"
   object = "OBJECT_KEY"
   credentials = "GCP_CREDENTIALS"

   • GCP_BUCKET points to an existing bucket. It is used to store the intermediate storage object of the image which is being uploaded.
   • GCP_STORAGE_REGION is both a regular Google storage region and a dual or multi region.
   • OBJECT_KEY is the name of an intermediate storage object. It must not exist before the upload, and it is deleted when the upload process is done. If the object name does not end with .tar.gz, the extension is automatically added to the object name.

   • GCP_CREDENTIALS is a Base64-encoded scheme of the credentials JSON file downloaded from GCP. The credentials determine which project the GCP uploads the image to.

     Note

     Specifying GCP_CREDENTIALS in the gcp-config.toml file is optional if you use a different mechanism to authenticate with GCP. For other authentication methods, see Authenticating with GCP.

2. Retrieve the GCP_CREDENTIALS from the JSON file downloaded from GCP.

   $ sudo base64 -w 0 cee-gcp-nasa-476a1fa485b7.json

3. Create a compose with an additional image name and cloud provider profile:

   $ sudo composer-cli compose start BLUEPRINT-NAME gce IMAGE_KEY gcp-config.toml

   The image build, upload, and cloud registration processes can take up to ten minutes to complete.

1. Credentials specified with the composer-cli command in the configuration file.
2. Credentials configured in the osbuild-composer worker configuration.

3. Application Default Credentials from the Google GCP SDK library, which tries to automatically find a way to authenticate by using the following options:

   1. If the GOOGLE_APPLICATION_CREDENTIALS environment variable is set, Application Default Credentials tries to load and use credentials from the file pointed to by the variable.

   2. Application Default Credentials tries to authenticate by using the service account attached to the resource that is running the code. For example, Google Compute Engine VM.

      Note

      You must use the GCP credentials to determine which GCP project to upload the image to. Therefore, unless you want to upload all of your images to the same GCP project, you always must specify the credentials in the gcp-config.toml configuration file with the composer-cli command.