cloud-mu 1.9.0.pre.beta

data/modules/mu/clouds/google/server_pool.rb

@@ -0,0 +1,274 @@
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module MU
+  class Cloud
+    class Google
+      # A server pool as configured in {MU::Config::BasketofKittens::server_pools}
+      class ServerPool < MU::Cloud::ServerPool
+
+        @deploy = nil
+        @config = nil
+        attr_reader :mu_name
+        attr_reader :cloud_id
+        attr_reader :config
+
+        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
+        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::server_pools}
+        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
+          @deploy = mommacat
+          @config = MU::Config.manxify(kitten_cfg)
+          @cloud_id ||= cloud_id
+          if !mu_name.nil?
+            @mu_name = mu_name
+          elsif @config['scrub_mu_isms']
+            @mu_name = @config['name']
+          else
+            @mu_name = @deploy.getResourceName(@config['name'])
+          end
+        end
+
+        # Called automatically by {MU::Deploy#createResources}
+        def create
+          port_objs = []
+
+          @config['named_ports'].each { |port_cfg|
+            port_objs << MU::Cloud::Google.compute(:NamedPort).new(
+              name: port_cfg['name'],
+              port: port_cfg['port']
+            )
+          }
+
+#          subnet = @vpc.getSubnet(cloud_id: @config['vpc']['subnets'].first["subnet_id"].to_s)
+
+          labels = {}
+          MU::MommaCat.listStandardTags.each_pair { |name, value|
+            if !value.nil?
+              labels[name.downcase] = value.downcase.gsub(/[^a-z0-9\-\_]/i, "_")
+            end
+          }
+          labels["name"] = MU::Cloud::Google.nameStr(@mu_name)
+
+          size = nil
+          if !@config['basis']['launch_config'].nil?
+            size = @config['basis']['launch_config']['size']
+            @config['image_id'] = @config['basis']['launch_config']['image_id']
+          end
+          az = @config['availability_zone']
+          if az.nil?
+            az = MU::Cloud::Google.listAZs(@config['region']).sample
+          end
+
+          instance_props = MU::Cloud::Google.compute(:InstanceProperties).new(
+            can_ip_forward: !@config['src_dst_check'],
+            description: @deploy.deploy_id,
+#            machine_type: "zones/"+az+"/machineTypes/"+size,
+            machine_type: size,
+            labels: labels,
+            disks: MU::Cloud::Google::Server.diskConfig(@config, false, false),
+            network_interfaces: MU::Cloud::Google::Server.interfaceConfig(@config, @vpc),
+            metadata: {
+              :items => [
+                :key => "ssh-keys",
+                :value => @config['ssh_user']+":"+@deploy.ssh_public_key
+              ]
+            },
+            tags: MU::Cloud::Google.compute(:Tags).new(items: [MU::Cloud::Google.nameStr(@mu_name)])
+          )
+
+          template_obj = MU::Cloud::Google.compute(:InstanceTemplate).new(
+            name: MU::Cloud::Google.nameStr(@mu_name),
+            description: @deploy.deploy_id,
+            properties: instance_props
+          )
+
+          MU.log "Creating instance template #{@mu_name}", details: template_obj
+          template = MU::Cloud::Google.compute.insert_instance_template(
+            @config['project'],
+            template_obj
+          )
+
+# XXX AWS-style @config['health_check_type'] doesn't make a lick of sense here
+          healing_obj = MU::Cloud::Google.compute(:InstanceGroupManager).new(
+            initial_delay_sec: @config['health_check_grace_period']
+# TODO here's where health_checks go
+          )
+
+          mgr_obj = MU::Cloud::Google.compute(:InstanceGroupManager).new(
+            name: MU::Cloud::Google.nameStr(@mu_name),
+            description: @deploy.deploy_id,
+            target_size: @config['desired_capacity'] || @config['min_size'],
+            base_instance_name: MU::Cloud::Google.nameStr(@mu_name),
+            instance_template: template.self_link,
+            named_ports: port_objs,
+            auto_healing_policies: [healing_obj]
+          )
+
+          MU.log "Creating region instance group manager #{@mu_name}", details: mgr_obj
+          mgr = MU::Cloud::Google.compute.insert_region_instance_group_manager(
+            @config['project'],
+            @config['region'],
+            mgr_obj
+          )
+
+# TODO this thing supports based on CPU usage, LB usage, or an arbitrary Cloud
+# Monitoring metric. The default is "sustained 60%+ CPU usage". We should
+# support all that.
+# http://www.rubydoc.info/github/google/google-api-ruby-client/Google/Apis/ComputeBeta/AutoscalingPolicyCpuUtilization
+# http://www.rubydoc.info/github/google/google-api-ruby-client/Google/Apis/ComputeBeta/AutoscalingPolicyLoadBalancingUtilization
+# http://www.rubydoc.info/github/google/google-api-ruby-client/Google/Apis/ComputeBeta/AutoscalingPolicyCustomMetricUtilization
+          policy_obj = MU::Cloud::Google.compute(:AutoscalingPolicy).new(
+            cooldown_period_sec: @config['default_cooldown'],
+            max_num_replicas: @config['max_size'],
+            min_num_replicas: @config['min_size']
+          )
+
+          scaler_obj = MU::Cloud::Google.compute(:Autoscaler).new(
+            name: MU::Cloud::Google.nameStr(@mu_name),
+            description: @deploy.deploy_id,
+            target: mgr.self_link,
+            autoscaling_policy: policy_obj
+          )
+
+          MU.log "Creating autoscaler policy #{@mu_name}", details: scaler_obj
+          MU::Cloud::Google.compute.insert_region_autoscaler(
+            @config['project'],
+            @config['region'],
+            scaler_obj
+          )
+
+# TODO honor wait_for_instances
+        end
+
+        # This is a NOOP right now, because we're really an empty generator for
+        # Servers, and that's what we care about having in deployment
+        # descriptors. Should we log some stuff though?
+        def notify
+          return {}
+        end
+
+        # Locate an existing ServerPool or ServerPools and return an array containing matching Google resource descriptors for those that match.
+        # @param cloud_id [String]: The cloud provider's identifier for this resource.
+        # @param region [String]: The cloud provider region
+        # @param tag_key [String]: A tag key to search.
+        # @param tag_value [String]: The value of the tag specified by tag_key to match when searching by tag.
+        # @param flags [Hash]: Optional flags
+        # @return [Array<Hash<String,OpenStruct>>]: The cloud provider's complete descriptions of matching ServerPools
+        def self.find(cloud_id: nil, region: MU.curRegion, tag_key: "Name", tag_value: nil, flags: {})
+          MU.log "XXX ServerPool.find not yet implemented", MU::WARN
+          return {}
+        end
+
+        # Cloud-specific configuration properties.
+        # @param config [MU::Config]: The calling MU::Config object
+        # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
+        def self.schema(config)
+          toplevel_required = []
+          schema = {
+            "named_ports" => {
+              "type" => "array",
+              "items" => {
+                "type" => "object",
+                "required" => ["name", "port"],
+                "additionalProperties" => false,
+                "description" => "A named network port for a Google instance group, used for health checks and forwarding targets.",
+                "properties" => {
+                  "name" => {
+                    "type" => "string"
+                  },
+                  "port" => {
+                    "type" => "integer"
+                  }
+                }
+              }
+            }
+          }
+          [toplevel_required, schema]
+        end
+
+        # Cloud-specific pre-processing of {MU::Config::BasketofKittens::server_pools}, bare and unvalidated.
+        # @param pool [Hash]: The resource to process and validate
+        # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
+        # @return [Boolean]: True if validation succeeded, False otherwise
+        def self.validateConfig(pool, configurator)
+          ok = true
+
+          pool['named_ports'] ||= []
+          if !pool['named_ports'].include?({"name" => "ssh", "port" => 22})
+            pool['named_ports'] << {"name" => "ssh", "port" => 22}
+          end
+          
+          if pool['basis']['launch_config']
+            launch = pool["basis"]["launch_config"]
+
+            launch['size'] = MU::Cloud::Google::Server.validateInstanceType(launch["size"], pool["region"])
+            ok = false if launch['size'].nil?
+
+            if launch['image_id'].nil?
+              if MU::Config.google_images.has_key?(pool['platform'])
+                launch['image_id'] = configurator.getTail("server_pool"+pool['name']+"Image", value: MU::Config.google_images[pool['platform']], prettyname: "server_pool"+pool['name']+"Image", cloudtype: "Google::Apis::ComputeBeta::Image")
+              else
+                MU.log "No image specified for #{pool['name']} and no default available for platform #{pool['platform']}", MU::ERR, details: launch
+                ok = false
+              end
+            end
+
+            real_image = nil
+            begin
+              real_image = MU::Cloud::Google::Server.fetchImage(launch['image_id'].to_s)
+            rescue ::Google::Apis::ClientError => e
+              MU.log e.inspect, MU::WARN
+            end
+
+            if real_image.nil?
+              MU.log "Image #{launch['image_id']} for server_pool #{pool['name']} does not appear to exist", MU::ERR
+              ok = false
+            else
+              launch['image_id'] = real_image.self_link
+            end
+          end
+
+          ok
+        end
+
+        # Remove all autoscale groups associated with the currently loaded deployment.
+        # @param noop [Boolean]: If true, will only print what would be done
+        # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
+        # @param region [String]: The cloud provider region
+        # @return [void]
+        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, flags: {})
+          flags["project"] ||= MU::Cloud::Google.defaultProject
+
+          if !flags["global"]
+            ["region_autoscaler", "region_instance_group_manager"].each { |type|
+              MU::Cloud::Google.compute.delete(
+                type,
+                flags["project"],
+                region,
+                noop
+              )
+            }
+          else
+            MU::Cloud::Google.compute.delete(
+              "instance_template",
+              flags["project"],
+              noop
+            )
+          end
+
+        end
+      end
+    end
+  end
+end

data/modules/mu/clouds/google/user.rb

@@ -0,0 +1,266 @@
+# Copyright:: Copyright (c) 2018 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module MU
+  class Cloud
+    class Google
+      # A user as configured in {MU::Config::BasketofKittens::users}
+      class User < MU::Cloud::User
+        @deploy = nil
+        @config = nil
+        attr_reader :mu_name
+        attr_reader :config
+        attr_reader :cloud_id
+
+        # @param mommacat [MU::MommaCat]: A {MU::Mommacat} object containing the deploy of which this resource is/will be a member.
+        # @param kitten_cfg [Hash]: The fully parsed and resolved {MU::Config} resource descriptor as defined in {MU::Config::BasketofKittens::users}
+        def initialize(mommacat: nil, kitten_cfg: nil, mu_name: nil, cloud_id: nil)
+          @deploy = mommacat
+          @config = MU::Config.manxify(kitten_cfg)
+          @cloud_id ||= cloud_id
+          @mu_name ||= @deploy.getResourceName(@config["name"])
+        end
+
+        # Called automatically by {MU::Deploy#createResources}
+        def create
+          if @config['type'] == "interactive"
+            bind_human_user
+          else
+            req_obj = MU::Cloud::Google.iam(:CreateServiceAccountRequest).new(
+              account_id: @deploy.getResourceName(@config["name"], max_length: 30).downcase,
+              service_account: MU::Cloud::Google.iam(:ServiceAccount).new(
+                display_name: @mu_name
+              )
+            )
+            MU.log "Creating service account #{@mu_name}"
+            MU::Cloud::Google.iam.create_service_account(
+              "projects/"+@config['project'],
+              req_obj
+            )
+          end
+        end
+
+        # Called automatically by {MU::Deploy#createResources}
+        def groom
+          if @config['type'] == "interactive"
+            bind_human_user
+          else
+            if @config['create_api_key']
+              resp = MU::Cloud::Google.iam.list_project_service_account_keys(
+                cloud_desc.name
+              )
+              if resp.keys.size == 0
+                MU.log "Generating API keys for service account #{@mu_name}"
+                resp = MU::Cloud::Google.iam.create_service_account_key(
+                  cloud_desc.name
+                )
+                scratchitem = MU::Master.storeScratchPadSecret("Google Cloud Service Account credentials for #{@mu_name}:\n<pre style='text-align:left;'>#{resp.private_key_data}</pre>")
+                MU.log "User #{@mu_name}'s Google Cloud Service Account credentials can be retrieved from: https://#{$MU_CFG['public_address']}/scratchpad/#{scratchitem}", MU::SUMMARY
+              end
+            end
+          end
+        end
+
+        # Retrieve the cloud descriptor for this resource.
+        def cloud_desc
+          if @config['type'] == "interactive"
+            return nil
+          else
+            resp = MU::Cloud::Google.iam.list_project_service_accounts(
+              "projects/"+@config["project"]
+            )
+
+            if resp and resp.accounts
+              resp.accounts.each { |sa|
+                if sa.display_name and sa.display_name == @mu_name
+                  return sa
+                end
+              }
+            end
+          end
+        end
+
+        # Return the metadata for this user configuration
+        # @return [Hash]
+        def notify
+          description = MU.structToHash(cloud_desc)
+          if description
+            description.delete(:etag)
+            return description
+          end
+          {
+          }
+        end
+
+        # Remove all users associated with the currently loaded deployment.
+        # @param noop [Boolean]: If true, will only print what would be done
+        # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
+        # @param region [String]: The cloud provider region
+        # @return [void]
+        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, flags: {})
+          flags["project"] ||= MU::Cloud::Google.defaultProject
+          resp = MU::Cloud::Google.iam.list_project_service_accounts(
+            "projects/"+flags["project"]
+          )
+
+          if resp and resp.accounts and MU.deploy_id
+            resp.accounts.each { |sa|
+              if sa.display_name and sa.display_name.match(/^#{Regexp.quote(MU.deploy_id)}-/i)
+                begin
+                  MU.log "Deleting service account #{sa.name}", details: sa
+                  if !noop
+                    MU::Cloud::Google.iam.delete_project_service_account(sa.name)
+                  end
+                rescue ::Google::Apis::ClientError => e
+                  raise e if !e.message.match(/^notFound: /)
+                end
+              end
+            }
+          end
+        end
+
+        # Locate an existing user group.
+        # @param cloud_id [String]: The cloud provider's identifier for this resource.
+        # @param region [String]: The cloud provider region.
+        # @param flags [Hash]: Optional flags
+        # @return [OpenStruct]: The cloud provider's complete descriptions of matching user group.
+        def self.find(cloud_id: nil, region: MU.curRegion, flags: {})
+          found = nil
+          resp = MU::Cloud::Google.iam.list_project_service_accounts(
+            "projects/"+flags["project"]
+          )
+
+          if resp and resp.accounts
+            resp.accounts.each { |sa|
+              if sa.display_name and sa.display_name == cloud_id
+                found ||= {}
+                found[cloud_id] = sa
+              end
+            }
+          end
+
+          found
+        end
+
+        # Cloud-specific configuration properties.
+        # @param config [MU::Config]: The calling MU::Config object
+        # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
+        def self.schema(config)
+          toplevel_required = []
+          schema = {
+            "name" => {
+              "type" => "string",
+              "description" => "This must be the email address of an existing Google user account (+foo@gmail.com+), or of a federated GSuite or Cloud Identity domain account from your organization."
+            },
+            "type" => {
+              "type" => "string",
+              "description" => "'interactive' will attempt to bind an existing user; 'service' will create a service account and generate API keys"
+            },
+            "roles" => {
+              "type" => "array",
+              "description" => "One or more Google IAM roles to associate with this user.",
+              "default" => ["roles/viewer"],
+              "items" => {
+                "type" => "string",
+                "description" => "One or more Google IAM roles to associate with this user. Google Cloud human user accounts (as distinct from service accounts) are not created directly; pre-existing Google accounts are associated with a project by being bound to one or more roles in that project. If no roles are specified, we default to +roles/viewer+, which permits read-only access project-wide."
+              }
+            },
+            "project" => {
+              "type" => "string",
+              "description" => "The project into which to deploy resources"
+            }
+          }
+          [toplevel_required, schema]
+        end
+
+        # Cloud-specific pre-processing of {MU::Config::BasketofKittens::users}, bare and unvalidated.
+        # @param user [Hash]: The resource to process and validate
+        # @param configurator [MU::Config]: The overall deployment configurator of which this resource is a member
+        # @return [Boolean]: True if validation succeeded, False otherwise
+        def self.validateConfig(user, configurator)
+          ok = true
+
+          # admin_directory only works in a GSuite environment
+          if !user['name'].match(/@/i) and $MU_CFG['google']['masquerade_as']
+            # XXX flesh this check out, need to test with a GSuite site
+            pp MU::Cloud::Google.admin_directory.get_user(user['name'])
+          end
+
+          if user['groups'] and user['groups'].size > 0 and
+             !$MU_CFG['google']['masquerade_as']
+            MU.log "Cannot change Google group memberships in non-GSuite environments.\nVisit https://groups.google.com to manage groups.", MU::ERR
+            ok = false
+          end
+
+          if user['type'] != "service" and user["create_api_key"]
+            MU.log "Only service accounts can have API keys in Google Cloud", MU::ERR
+            ok = false
+          end
+
+          ok
+        end
+
+        private
+
+        def bind_human_user
+          bindings = []
+          ext_policy = MU::Cloud::Google.resource_manager.get_project_iam_policy(
+            @config['project']
+          )
+
+          change_needed = false
+          @config['roles'].each { |role|
+            seen = false
+            ext_policy.bindings.each { |b|
+              if b.role == role
+                seen = true
+                if !b.members.include?("user:"+@config['name'])
+                  change_needed = true
+                  b.members << "user:"+@config['name']
+                end
+              end
+            }
+            if !seen
+              ext_policy.bindings << MU::Cloud::Google.resource_manager(:Binding).new(
+                role: role,
+                members: ["user:"+@config['name']]
+              )
+              change_needed = true
+            end
+          }
+
+          if change_needed
+            req_obj = MU::Cloud::Google.resource_manager(:SetIamPolicyRequest).new(
+              policy: ext_policy
+            )
+            MU.log "Adding #{@config['name']} to Google Cloud project #{@config['project']}", details: @config['roles']
+
+            begin
+              MU::Cloud::Google.resource_manager.set_project_iam_policy(
+                @config['project'],
+                req_obj
+              )
+            rescue ::Google::Apis::ClientError => e
+              if e.message.match(/does not exist/i) and !$MU_CFG['google']['masquerade_as']
+                raise MuError, "User #{@config['name']} does not exist, and we cannot create Google user in non-GSuite environments.\nVisit https://accounts.google.com to create new accounts."
+              end
+              raise e
+            end
+          end
+        end
+
+      end
+    end
+  end
+end

data/modules/mu/clouds/google/userdata/README.md

@@ -0,0 +1,4 @@
+
+Baseline CloudInit userdata scripts for MU nodes to self-configure.
+
+See also: https://help.ubuntu.com/community/CloudInit

data/modules/mu/clouds/google/userdata/linux.erb

@@ -0,0 +1,137 @@
+#!/bin/sh
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+updates_run=0
+need_reboot=0
+instance_id="`curl http://metadata.google.internal/computeMetadata/v1/instance/name`"
+if [ -f /etc/debian_version ];then
+	if ! grep '^/bin/sh /var/lib/cloud/instance/user-data.txt$' /etc/rc.local > /dev/null;then
+		echo "/bin/sh /var/lib/cloud/instance/user-data.txt" >> /etc/rc.local
+	fi
+	apt-get update -y
+	if [ ! -f /usr/bin/curl ] ;then /usr/bin/apt-get --fix-missing -y install curl;fi
+<% if !$mu.skipApplyUpdates %>
+	if [ ! -f /.mu-installer-ran-updates ];then
+		service ssh stop
+		apt-get --fix-missing -y upgrade 
+		if [ $? -eq 0 ]
+		then
+		  echo "Successfully updated packages"
+		  updates_run=1
+		else
+		  echo "FAILED PACKAGE UPDATE" >&2
+		fi
+		# Proceed regardless
+		touch /.mu-installer-ran-updates
+
+		# XXX this logic works on Ubuntu, is it Debian-friendly?
+		latest_kernel="`ls -1 /boot/vmlinuz-* | sed -r 's/^\/boot\/vmlinuz-//' | tail -1`"
+		running_kernel="`uname -r`"
+		if [ "$running_kernel" != "$latest_kernel" -a "$latest_kernel" != "" ];then
+			need_reboot=1
+		else
+			service ssh start
+		fi
+	fi
+<% end %>
+elif [ -x /usr/bin/yum ];then
+	version=`/bin/rpm -qa \*-release | grep -Ei "redhat|centos" | cut -d"-" -f3`
+	if [ -z "$version" ];then
+		amazon_version=`/bin/rpm -qa \*-release | grep -Ei "system-release"| cut -d"-" -f3 | cut -d"." -f1`
+		if [ "$amazon_version" == "2014" ] || [ "$amazon_version" == "2015" ] || [ "$amazon_version" == "2016" ];then
+			version=6
+		fi
+	fi
+	if [ $version -eq 7 ];then
+		userdata_dir="/var/lib/cloud/instances/$instance_id"
+	else
+		userdata_dir="/var/lib/cloud/instance"
+	fi
+	if ! grep "^/bin/sh $userdata_dir/user-data.txt$" /etc/rc.d/rc.local > /dev/null;then
+		echo "/bin/sh $userdata_dir/user-data.txt" >> /etc/rc.d/rc.local
+	fi
+
+  sed -i 's/^Defaults.*requiretty$/Defaults   !requiretty/' /etc/sudoers
+
+	if [ $version == 7 ];then
+		chmod 755 /etc/rc.d/rc.local
+	fi
+	if [ ! -f /usr/bin/curl ] ;then /usr/bin/yum -y install curl;fi
+	# Ugh, rando EPEL mirror
+	if [ ! -f /etc/yum.repos.d/epel.repo ];then
+		/bin/rpm -ivh http://mirror.metrocast.net/fedora/epel/epel-release-latest-$version.noarch.rpm
+	fi
+<% if !$mu.skipApplyUpdates %>
+	if [ ! -f /.mu-installer-ran-updates ];then
+		service sshd stop
+		kernel_update=`yum list updates | grep kernel`
+		yum -y update
+		if [ $? -eq 0 ]
+		then
+		  echo "Successfully updated packages"
+		  updates_run=1
+		else
+		  echo "FAILED PACKAGE UPDATE" >&2
+		fi
+		# Proceed regardless
+		touch /.mu-installer-ran-updates
+		if [ -n "$kernel_update" ]; then
+			need_reboot=1
+		else
+			service sshd start
+		fi
+	fi
+<% end %>
+fi
+
+umask 0077
+
+# Install Chef now, because why not?
+if [ ! -f /opt/chef/embedded/bin/ruby ];then
+	curl https://www.chef.io/chef/install.sh > chef-install.sh
+	set +e
+	# We may run afoul of a synchronous bootstrap process doing the same thing. So
+	# wait until we've managed to run successfully.
+	while ! sh chef-install.sh -v <%= MU.chefVersion %>;do
+		sleep 10
+	done
+	touch /opt/mu_installed_chef
+	set -e
+fi
+
+<% if !$mu.skipApplyUpdates %>
+if [ "$need_reboot" == "1" ];then
+	shutdown -r now "Applying new kernel"
+fi
+<% end %>
+
+gsutil cp gs://<%= MU.adminBucketName %>/<%= $mu.muID %>-secret .
+
+echo '
+require "openssl"
+require "base64"
+key = OpenSSL::PKey::RSA.new(Base64.urlsafe_decode64("<%= $mu.deployKey %>"))
+print Base64.urlsafe_encode64(key.public_encrypt(File.read("<%= $mu.muID %>-secret")))
+' > encrypt_deploy_secret.rb
+
+deploykey="<%= $mu.deployKey %>"
+instance_id="`curl http://metadata.google.internal/computeMetadata/v1/instance/name`"
+
+# Make double-sure sshd is actually up
+service sshd restart
+
+/usr/bin/curl -k --data mu_id="<%= $mu.muID %>" --data mu_resource_name="<%= $mu.resourceName %>" --data mu_resource_type="<%= $mu.resourceType %>" --data mu_instance_id="$instance_id" --data mu_bootstrap="1" --data mu_user="<%= $mu.muUser %>" --data mu_deploy_secret="`/opt/chef/embedded/bin/ruby encrypt_deploy_secret.rb`" https://<%= $mu.publicIP %>:2260/
+/bin/rm -f <%= $mu.muID %>-secret mu_deploy_key.pub chef-install.sh encrypt_deploy_secret.rb
+touch /.mu_userdata_complete