feat: enable incus support in actionsdind container

- add incus-images backend
- set incus-images as default backend
- manage deploying client.key/client.crt from vault to specific containers

Makefile

@@ -91,6 +91,8 @@ $(DIRS):
 	export SUFFIX=$(SUFFIX) && \
 	export GIT_COMMIT=$(GIT_COMMIT) && \
 	export GIT_BRANCH=$(GIT_BRANCH) && \
+	export VAULT_ADDR=https://vault.query.consul:8200
+	export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID) && \
 	/usr/bin/packer init . && \
 	/usr/bin/packer build . )
 

builds/docker.pkr.hcl

@@ -21,6 +21,18 @@ build {
     destination = "/"
   }
 
+  # manage deploying incus client certficates
+  # this isnt super-secure, as the key ends up baked into the docker image
+  provisioner "shell" {
+    inline = [
+      "if [ ${var.include_incus_client_certs} = true ]; then",
+      "  mkdir -p /root/.config/incus",
+      "  echo '${replace(local.incus_crt, "'", "'\\''")}' > /root/.config/incus/client.crt",
+      "  echo '${replace(local.incus_key, "'", "'\\''")}' > /root/.config/incus/client.key",
+      "fi"
+    ]
+  }
+
   # post-file-copy scripts
   provisioner "shell" {
     inline = var.scripts_post_file_copy

images/almalinux/8.10/actionsdind/variables.auto.pkrvars.hcl

@@ -1,4 +1,6 @@
 # almalinux/8.10/actionsdind
+deploy_files_from_common = true
+include_incus_client_certs = true
 docker_source = "git.query.consul/unkin/almalinux8-base:latest"
 packages = [
   "bash",

images/almalinux/9.5/actionsdind/variables.auto.pkrvars.hcl

@@ -1,4 +1,6 @@
 # almalinux/9.5/actionsdind
+deploy_files_from_common = true
+include_incus_client_certs = true
 docker_source = "git.query.consul/unkin/almalinux9-base:latest"
 packages = [
   "bash",

library/locals.pkr.hcl

@@ -7,4 +7,6 @@ locals {
   incus_base_name = "${var.os_name}${var.os_version_major}/${var.os_image}"
   incus_output_image = "${local.incus_base_name}/${var.suffix}"
   is_master  = "${var.git_branch}" == "master"
+  incus_key = vault("kv/data/service/packer/builder/docker-incus-client", "private_key")
+  incus_crt = vault("kv/data/service/packer/builder/docker-incus-client", "public_key")
 }

library/variables.pkr.hcl

@@ -121,3 +121,8 @@ variable "git_branch" {
   type = string
   default = env("GIT_BRANCH")
 }
+
+variable "include_incus_client_certs" {
+  type    = bool
+  default = false
+}