别用手动装服务器了：Packer 黄金镜像流水线从构建到安全扫描的完整实战

Source (基础镜像) → Provisioner (配置) → Post-Processors (后处理)

packer-golden-images/
├── variables.pkr.hcl          # 全局变量定义
├── sources.pkr.hcl            # 数据源定义
├── build.pkr.hcl              # 构建流程定义
├── scripts/                   # Shell 配置脚本
│   ├── base-setup.sh          # 基础系统配置
│   ├── security-hardening.sh  # 安全加固
│   └── cleanup.sh             # 清理临时文件
├── ansible/                   # Ansible Playbook
│   ├── playbook.yml
│   ├── inventory.ini
│   └── roles/
│       ├── common/
│       ├── monitoring/
│       └── hardening/
├── policies/                  # 策略文件
│   └── image-policy.json      # 镜像合规策略
└── ci/
    └── build-image.sh         # CI 构建脚本

# ====== 全局变量 ======
variable "aws_region" {
  type    = string
  default = "ap-northeast-1"
  description = "构建镜像的 AWS 区域"
}

variable "source_ami_filter_name" {
  type    = string
  default = "ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*"
  description = "基础 AMI 的名称过滤器，匹配 Ubuntu 22.04 LTS"
}

variable "instance_type" {
  type    = string
  default = "t3.medium"
  description = "构建用临时实例规格，t3.medium 够用了"
}

variable "ssh_username" {
  type    = string
  default = "ubuntu"
}

variable "ami_name_prefix" {
  type    = string
  default = "golden-ubuntu-2204"
}

variable "app_version" {
  type    = string
  default = ""
  description = "应用版本号，CI 注入，留空则用 timestamp"
}

# 用 timestamp 函数生成镜像名称的后缀
locals {
  ami_name = "${var.ami_name_prefix}-${var.app_version != "" ? var.app_version : formatdate("YYYYMMDDhhmmss", timestamp())}"
  common_tags = {
    Project   = "golden-images"
    ManagedBy = "packer"
    Os        = "ubuntu-22.04"
    CreatedAt = formatdate("YYYY-MM-DD", timestamp())
  }
}

# ====== AWS EBS 数据源 ======
source "amazon-ebs" "ubuntu-base" {
  region   = var.aws_region
  ami_name = local.ami_name

  # 用过滤器自动选择最新的 Ubuntu 22.04 AMI
  source_ami_filter {
    filters = {
      virtualization-type = "hvm"
      name                = var.source_ami_filter_name
      root-device-type    = "ebs"
      architecture        = "x86_64"
    }
    most_recent = true
    owners      = ["099720109477"]  # Canonical 官方账号
  }

  instance_type = var.instance_type
  ssh_username  = var.ssh_username

  # 临时安全组：只允许 Packer 构建机的 SSH
  temporary_iam_instance_profile_policy_document {
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["ssm:GetParameters", "ssm:GetParameter"]
        Resource = "*"
      }
    ]
  }

  # EBS 根卷配置
  launch_block_device_mappings {
    device_name           = "/dev/sda1"
    volume_size           = 20
    volume_type           = "gp3"
    delete_on_termination = true
  }

  tags = merge(local.common_tags, {
    Name = "packer-builder-ubuntu"
    Purpose = "image-build"
  })
}

# ====== 构建流程 ======
build {
  sources = [
    "source.amazon-ebs.ubuntu-base"
  ]

  # ---------- 第一步：Shell 基础配置 ----------
  provisioner "shell" {
    script = "./scripts/base-setup.sh"
    execute_command = "sudo -S sh -c '{{ .Vars }} {{ .Path }}'"
    environment_vars = [
      "DEBIAN_FRONTEND=noninteractive",
      "APP_VERSION=${var.app_version}"
    ]
  }

  # ---------- 第二步：Ansible 配置 ----------
  provisioner "ansible" {
    playbook_file    = "./ansible/playbook.yml"
    inventory_directory = "./ansible/"
    user              = var.ssh_username
    use_proxy         = false
    ansible_env_vars = [
      "ANSIBLE_HOST_KEY_CHECKING=False",
      "ANSIBLE_PIPELINING=True",
      "ANSIBLE_PYTHON_INTERPRETER=/usr/bin/python3"
    ]
    extra_arguments = [
      "--extra-vars", "app_version=${var.app_version}",
      "--extra-vars", "image_build=true"
    ]
  }

  # ---------- 第三步：安全加固脚本 ----------
  provisioner "shell" {
    script = "./scripts/security-hardening.sh"
    execute_command = "sudo -S sh -c '{{ .Vars }} {{ .Path }}'"
  }

  # ---------- 第四步：清理 ----------
  provisioner "shell" {
    script = "./scripts/cleanup.sh"
    execute_command = "sudo -S sh -c '{{ .Vars }} {{ .Path }}'"
  }

  # ---------- 后处理：打标签 ----------
  post-processors {
    post-processor "amazon-import" {
      only = ["amazon-ebs.ubuntu-base"]
    }
    post-processor "manifest" {
      output_file = "manifest.json"
      strip_path = true
      custom_data = {
        app_version = var.app_version
        build_date = formatdate("YYYY-MM-DD", timestamp())
      }
    }
  }
}

#!/bin/bash
set -euo pipefail

# ============================================================
# 基础系统配置：包更新、时区、内核参数、用户管理
# ============================================================

echo ">>> [1/5] 更新系统包"
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get upgrade -y -qq
apt-get install -y -qq \
  curl wget vim htop tree jq unzip \
  ca-certificates gnupg lsb-release \
  software-properties-common \
  python3 python3-pip \
  chrony

echo ">>> [2/5] 设置时区"
timedatectl set-timezone Asia/Shanghai

echo ">>> [3/5] 配置 chrony 时间同步"
cat > /etc/chrony/chrony.conf << 'EOF'
# 使用阿里云 NTP，国内更稳
server ntp.aliyun.com iburst
server ntp1.aliyun.com iburst

# 允许时间大步调整（新机器时间偏差可能很大）
makestep 1.0 3
rtcsync
logdir /var/log/chrony
EOF
systemctl enable chrony
systemctl restart chrony

echo ">>> [4/5] 内核参数调优"
cat > /etc/sysctl.d/99-golden-image.conf << 'EOF'
# 文件描述符
fs.file-max = 1048576
fs.nr_open = 1048576

# 网络参数
net.core.somaxconn = 4096
net.core.netdev_max_backlog = 16384
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.ip_local_port_range = 10000 65535

# 内存参数
vm.swappiness = 10
vm.overcommit_memory = 1
vm.max_map_count = 262144

# BBR 拥塞控制
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
EOF
sysctl -p /etc/sysctl.d/99-golden-image.conf

echo ">>> [5/5] 创建运维用户"
if ! id -u ops >/dev/null 2>&1; then
  useradd -m -s /bin/bash -G sudo ops
  # 禁止密码登录，只允许密钥
  passwd -l ops
fi

echo ">>> 基础配置完成"

#!/bin/bash
set -euo pipefail

# ============================================================
# 安全加固：SSH 加固、防火墙、审计、fail2ban
# ============================================================

echo ">>> [1/6] SSH 加固"
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
cat > /etc/ssh/sshd_config.d/99-hardening.conf << 'EOF'
# 禁止 root 直接登录
PermitRootLogin no

# 只允许密钥认证
PasswordAuthentication no
PubkeyAuthentication yes

# 禁止空密码
PermitEmptyPasswords no

# 限制最大认证尝试次数
MaxAuthTries 3

# 登录超时 120 秒
LoginGraceTime 120

# 禁止 X11 转发（服务器不需要图形界面）
X11Forwarding no

# 禁止端口转发
AllowTcpForwarding no

# 客户端活检测间隔
ClientAliveInterval 300
ClientAliveCountMax 2

# 只允许 ops 用户 SSH
AllowUsers ops
EOF
systemctl restart sshd

echo ">>> [2/6] 配置 UFW 防火墙"
apt-get install -y -qq ufw
ufw --force reset
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw --force enable

echo ">>> [3/6] 安装 fail2ban"
apt-get install -y -qq fail2ban
cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3
backend = systemd

[sshd]
enabled = true
port = 22
EOF
systemctl enable fail2ban
systemctl restart fail2ban

echo ">>> [4/6] 配置审计日志"
apt-get install -y -qq auditd
cat > /etc/audit/rules.d/hardening.rules << 'EOF'
# 监控关键文件变更
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudo
-w /etc/ssh/sshd_config -p wa -k ssh

# 监控系统调用
-a always,exit -F arch=b64 -S chmod -S chown -S umask -k perm
EOF
systemctl enable auditd
systemctl restart auditd

echo ">>> [5/6] 禁用不需要的服务"
SERVICES_TO_DISABLE=(
  "cups"          # 打印服务
  "bluetooth"     # 蓝牙
  "avahi-daemon"  # mDNS 发现
  "speech-dispatcher"  # 语音
)
for svc in "${SERVICES_TO_DISABLE[@]}"; do
  if systemctl list-unit-files | grep -q "$svc"; then
    systemctl disable "$svc" 2>/dev/null || true
    systemctl mask "$svc" 2>/dev/null || true
  fi
done

echo ">>> [6/6] 自动安全更新"
cat > /etc/apt/apt.conf.d/50unattended-upgrades << 'EOF'
Unattended-Upgrade::Allowed-Origins {
  "${distro_id}:${distro_codename}-security";
};
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
EOF
apt-get install -y -qq unattended-upgrades
dpkg-reconfigure -f noninteractive unattended-upgrades

echo ">>> 安全加固完成"

#!/bin/bash
set -euo pipefail

# ============================================================
# 清理：减小镜像体积，移除敏感信息
# ============================================================

echo ">>> [1/5] 清理 apt 缓存"
apt-get autoremove -y
apt-get autoclean -y
apt-get clean
rm -rf /var/lib/apt/lists/*
rm -rf /var/cache/apt/archives/*.deb

echo ">>> [2/5] 清理临时文件"
rm -rf /tmp/*
rm -rf /var/tmp/*
rm -rf /var/log/*.gz
rm -rf /var/log/apt/*
rm -rf /root/.bash_history
rm -rf /home/*/.bash_history
rm -rf /var/lib/cloud/instances/*

echo ">>> [3/5] 清理 SSH 主机密钥"
# 镜像不应该带 SSH host key，启动时自动生成
rm -f /etc/ssh/ssh_host_*
cat > /etc/rc.local << 'EOF'
#!/bin/bash
if [ ! -f /etc/ssh/ssh_host_rsa_key ]; then
  ssh-keygen -A
fi
systemctl restart sshd
EOF
chmod +x /etc/rc.local

echo ">>> [4/5] 清理机器 ID（systemd 用的唯一标识）"
# 不清理的话，所有用这个镜像启动的机器会共享同一个 ID
echo "" > /etc/machine-id

echo ">>> [5/5] 磁盘填零（减小压缩体积）"
# 对 EBS 快照有意义：填零后快照只存实际数据
dd if=/dev/zero of=/zerofile bs=1M 2>/dev/null || true
rm -f /zerofile

echo ">>> 清理完成"

---
- name: 配置黄金镜像中的应用层组件
  hosts: all
  become: true
  gather_facts: true

  pre_tasks:
    - name: 确认 Python3 可用
      raw: test -f /usr/bin/python3
      changed_when: false

    - name: 设置 hostname（构建临时用）
      hostname:
        name: "packer-build-{{ ansible_distribution_version | default('unknown') }}"

  roles:
    - role: common
      tags: [common]
    - role: monitoring
      tags: [monitoring]
      when: not image_build | default(false) | bool or true
    - role: hardening
      tags: [hardening]

  post_tasks:
    - name: 验证关键服务已安装
      command: "which {{ item }}"
      loop:
        - curl
        - jq
        - python3
        - chronyc
      changed_when: false

    - name: 验证 Node Exporter 端口可监听
      wait_for:
        port: 9100
        state: started
        timeout: 30
      when: "'monitoring' in group_names or true"

---
- name: 创建应用目录结构
  file:
    path: "{{ item }}"
    state: directory
    owner: ops
    group: sudo
    mode: "0755"
  loop:
    - /opt/app
    - /opt/app/bin
    - /opt/app/conf
    - /opt/app/logs
    - /opt/app/data

- name: 安装运行时依赖
  apt:
    name:
      - libssl-dev
      - libcurl4-openssl-dev
      - libxml2-dev
      - zlib1g-dev
    state: present
    update_cache: true

- name: 配置日志轮转
  template:
    src: app-logrotate.j2
    dest: /etc/logrotate.d/app
    mode: "0644"

- name: 配置 sysctl 中的文件描述符限制
  pam_limits:
    domain: ops
    limit_type: "-"
    limit_item: nofile
    value: "65536"

---
- name: 下载 Node Exporter
  unarchive:
    src: "https://github.com/prometheus/node_exporter/releases/download/v{{ node_exporter_version }}/node_exporter-{{ node_exporter_version }}.linux-amd64.tar.gz"
    dest: /tmp/
    remote_src: true
    creates: "/tmp/node_exporter-{{ node_exporter_version }}.linux-amd64/node_exporter"

- name: 安装 Node Exporter 二进制
  copy:
    src: "/tmp/node_exporter-{{ node_exporter_version }}.linux-amd64/node_exporter"
    dest: /usr/local/bin/node_exporter
    mode: "0755"
    remote_src: true

- name: 创建 systemd 服务
  template:
    src: node_exporter.service.j2
    dest: /etc/systemd/system/node_exporter.service
    mode: "0644"
  notify: enable node_exporter

- name: 确保不在构建阶段启动（镜像启动后才跑）
  systemd:
    name: node_exporter
    enabled: true
    state: stopped
  when: image_build | default(false) | bool

[Unit]
Description=Prometheus Node Exporter
After=network.target

[Service]
User=ops
Group=sudo
Type=simple
ExecStart=/usr/local/bin/node_exporter \
  --web.listen-address=:9100 \
  --collector.systemd \
  --collector.processes \
  --no-collector.infiniband \
  --no-collector.mdadm
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

#!/bin/bash
set -euo pipefail

# ============================================================
# CI 构建 + 扫描脚本
# 用法: ./ci/build-and-scan.sh <app_version>
# ============================================================

APP_VERSION="${1:-}"
if [ -z "$APP_VERSION" ]; then
  APP_VERSION=$(date '+%Y%m%d%H%M%S')
  echo "未指定版本号，使用时间戳: $APP_VERSION"
fi

echo "========== [1/5] Packer 初始化 =="
packer init .
echo "Packer plugins 初始化完成"

echo "========== [2/5] Packer 格式校验 =="
packer fmt -check -diff .
if [ $? -ne 0 ]; then
  echo "格式检查失败，请运行 packer fmt . 修复"
  exit 1
fi
echo "HCL 格式校验通过"

echo "========== [3/5] Packer 构建 =="
PACKER_LOG=1 packer build \
  -var "app_version=${APP_VERSION}" \
  -var-file=variables.prod.pkr.hcl \
  . 2>&1 | tee build.log

# 从 manifest 中提取 AMI ID
AMI_ID=$(jq -r '.builds[0].artifact_id' manifest.json | head -1)
echo "构建完成，AMI: ${AMI_ID}"

echo "========== [4/5] Trivy 漏洞扫描 =="
# 用 Trivy 扫描 AMI（需要 AWS 权限）
trivy server --listen 0.0.0.0:4954 &
TRIVY_PID=$!
sleep 3

# 扫描方式：拉取 AMI 的文件系统清单（通过 AWS Systems Manager）
trivy fs --server http://localhost:4954 \
  --severity HIGH,CRITICAL \
  --ignore-unfixed \
  --format json \
  --output scan-result.json \
  --exit-code 1 \
  /tmp/scan-target/

SCAN_EXIT=$?
kill $TRIVY_PID 2>/dev/null || true

if [ $SCAN_EXIT -ne 0 ]; then
  echo "!!! 安全扫描发现 HIGH/CRITICAL 漏洞，构建失败"
  echo "扫描结果:"
  jq '.Results[] | select(.Vulnerabilities != null) | .Vulnerabilities[] | {ID: .VulnerabilityID, Pkg: .PkgName, Severity: .Severity, Fix: .FixedVersion}' scan-result.json
  exit 1
fi
echo "安全扫描通过，无 HIGH/CRITICAL 漏洞"

echo "========== [5/5] 更新镜像版本注册表 =="
# 记录到版本文件，供后续部署使用
echo "{\"ami_id\": \"${AMI_ID}\", \"version\": \"${APP_VERSION}\", \"date\": \"$(date -Iseconds)\", \"scan\": \"passed\"}" >> docs/image-versions.jsonl
echo "版本注册完成"
echo ""
echo "构建成功！"
echo "  AMI ID: ${AMI_ID}"
echo "  Version: ${APP_VERSION}"
echo "  Scan: PASSED"

# policies/image_policy.rego
package image.compliance

# 规则1：必须安装 fail2ban
deny[msg] {
  not input.installed_packages["fail2ban"]
  msg := "合规失败：未安装 fail2ban"
}

# 规则2：不允许安装 telnet
deny[msg] {
  input.installed_packages["telnet"]
  msg := "合规失败：检测到 telnet 已安装，存在安全风险"
}

# 规则3：SSH 必须禁止密码登录
deny[msg] {
  input.ssh_config.password_authentication == "yes"
  msg := "合规失败：SSH 仍允许密码登录"
}

# 规则4：必须有自动安全更新
deny[msg] {
  not input.unattended_upgrades_enabled
  msg := "合规失败：未配置自动安全更新"
}

# .gitlab-ci.yml
stages:
  - validate
  - build
  - scan
  - publish

variables:
  PACKER_VERSION: "1.11"
  TF_IN_AUTOMATION: "true"

validate_template:
  stage: validate
  image: hashicorp/packer:${PACKER_VERSION}
  script:
    - packer init .
    - packer fmt -check -diff .
    - packer validate -var "app_version=ci-test" .
  rules:
    - changes:
        - "*.pkr.hcl"
        - scripts/**/*
        - ansible/**/*

build_image:
  stage: build
  image: hashicorp/packer:${PACKER_VERSION}
  script:
    - apk add --no-cache jq
    - export APP_VERSION=${CI_COMMIT_SHORT_SHA}
    - packer build -var "app_version=${APP_VERSION}" .
    - AMI_ID=$(jq -r '.builds[0].artifact_id' manifest.json)
    - echo "AMI_ID=${AMI_ID}" > build.env
  artifacts:
    reports:
      dotenv: build.env
    paths:
      - manifest.json
      - scan-result.json
    expire_in: 30 days
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      changes:
        - "*.pkr.hcl"
        - scripts/**/*
        - ansible/**/*
  needs:
    - validate_template

scan_image:
  stage: scan
  image: aquasec/trivy:latest
  script:
    - trivy fs --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --format json --output scan-result.json /tmp/
    - trivy fs --severity HIGH,CRITICAL --ignore-unfixed --format table .
  needs:
    - build_image
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

publish_image:
  stage: publish
  image: amazon/aws-cli:latest
  script:
    - aws ec2 create-tags --resources ${AMI_ID} --tags Key=Status,Value=approved Key=Version,Value=${CI_COMMIT_SHORT_SHA}
    - aws ssm put-parameter --name "/golden-images/latest" --value ${AMI_ID} --type String --overwrite
    - |
      # 保留最近 5 个版本，旧版本标记为 deprecated
      aws ec2 describe-images --owners self --filters "Name=tag:Project,Values=golden-images" --query 'sort_by(Images,&CreationDate)[::-1]' > images.json
      DEPRECATED_COUNT=$(echo $(echo $(cat images.json | jq length)) - 5 | bc)
      if [ $DEPRECATED_COUNT -gt 0 ]; then
        for i in $(seq 0 $((DEPRECATED_COUNT - 1))); do
          OLD_AMI=$(jq -r ".[$((${i} + 5))].ImageId" images.json)
          aws ec2 create-tags --resources ${OLD_AMI} --tags Key=Status,Value=deprecated
          echo "Deprecated: ${OLD_AMI}"
        done
      fi      
  needs:
    - scan_image
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

name: Build Golden Image

on:
  push:
    branches: [main]
    paths:
      - 'packer/**'
      - 'scripts/**'
      - 'ansible/**'
  workflow_dispatch:
    inputs:
      app_version:
        description: 'Image version tag'
        required: false

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      id-token: write
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-packer
          aws-region: ap-northeast-1

      - name: Setup Packer
        uses: hashicorp/packer-github-action@v4
        with:
          version: latest

      - name: Init and Validate
        working-directory: packer
        run: |
          packer init .
          packer fmt -check -diff .
          packer validate -var "app_version=test" .          

      - name: Build Image
        id: build
        working-directory: packer
        run: |
          VERSION="${{ github.event.inputs.app_version || github.sha }}"
          packer build -var "app_version=${VERSION}" .
          AMI_ID=$(jq -r '.builds[0].artifact_id' manifest.json)
          echo "ami_id=${AMI_ID}" >> $GITHUB_OUTPUT
          echo "version=${VERSION}" >> $GITHUB_OUTPUT          

      - name: Trivy Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '/tmp/scan-target'
          severity: 'HIGH,CRITICAL'
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          exit-code: '1'

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

      - name: Publish to SSM
        run: |
          aws ssm put-parameter \
            --name "/golden-images/latest" \
            --value "${{ steps.build.outputs.ami_id }}" \
            --type String --overwrite          

source "amazon-ebs" "ubuntu-base" {
  # ... 其他配置 ...
  ssh_timeout = "10m"  # 默认 5 分钟，网络差时不够
  temporary_security_group_source_ip = "0.0.0.0/0"
}

build {
  sources = ["source.amazon-ebs.ubuntu-base"]

  # ... provisioners ...

  post-processor "amazon-ami-copy" {
    regions = ["us-east-1", "eu-west-1", "ap-southeast-1"]
    ami_name = local.ami_name
    tags = merge(local.common_tags, {
      CopiedFrom = var.aws_region
    })
  }
}

#!/bin/bash
# cleanup-packer-residuals.sh
# 清理 2 小时前创建的 Packer 残留资源

REGIONS=("ap-northeast-1" "us-east-1")

for REGION in "${REGIONS[@]}"; do
  echo ">>> 清理区域: ${REGION}"

  # 清理残留 EC2 实例
  INSTANCES=$(aws ec2 describe-instances \
    --region "$REGION" \
    --filters "Name=tag:ManagedBy,Values=packer" "Name=instance-state-name,Values=running,pending" \
    --query 'Reservations[].Instances[].InstanceId' \
    --output text)

  for INSTANCE_ID in $INSTANCES; do
    LAUNCH_TIME=$(aws ec2 describe-instances \
      --region "$REGION" \
      --instance-ids "$INSTANCE_ID" \
      --query 'Reservations[0].Instances[0].LaunchTime' \
      --output text)

    # 只清理 2 小时前启动的（假设构建不会超过 2 小时）
    if [ -n "$LAUNCH_TIME" ]; then
      AGE_HOURS=$(echo $(($(date +%s) - $(date -d "$LAUNCH_TIME" +%s))) / 3600)
      if [ "$AGE_HOURS" -ge 2 ]; then
        echo "  终止残留实例: ${INSTANCE_ID} (运行 ${AGE_HOURS}h)"
        aws ec2 terminate-instances --region "$REGION" --instance-ids "$INSTANCE_ID"
      fi
    fi
  done

  # 清理残留安全组
  SGs=$(aws ec2 describe-security-groups \
    --region "$REGION" \
    --filters "Name=group-name,Values=packer-*" \
    --query 'SecurityGroups[].GroupId' \
    --output text 2>/dev/null || true)

  for SG_ID in $SGs; do
    echo "  删除残留安全组: ${SG_ID}"
    aws ec2 delete-security-group --region "$REGION" --group-id "$SG_ID" 2>/dev/null || true
  done
done

构建 → 测试 → 批准 → 灰度发布 → 全量替换 → 退役旧版本

# 在构建后写入版本注册表
post-processor "manifest" {
  output_file = "manifest.json"
  strip_path = true
  custom_data = {
    version      = var.app_version
    build_date   = formatdate("YYYY-MM-DD'T'HH:mm:ssZ", timestamp())
    git_commit   = var.git_commit_sha
    scan_status  = "pending"
    release_stage = "pending"
  }
}

# main.tf
data "aws_ssm_parameter" "latest_golden_ami" {
  name = "/golden-images/latest"
}

# 生产环境 ASG 使用最新黄金镜像
resource "aws_launch_template" "app" {
  name          = "app-launch-template"
  image_id      = data.aws_ssm_parameter.latest_golden_ami.value
  instance_type = "t3.large"
  key_name      = "ops-key"

  user_data = base64encode(<<-EOF
    #!/bin/bash
    # 镜像里已经装好了所有基础组件
    # user_data 只做运行时配置
    echo "Instance started with golden image: $(cat /etc/golden-image-version)"
    systemctl start node_exporter
  EOF
  )

  monitoring {
    enabled = true
  }

  tag_specifications {
    resource_type = "instance"
    tags = {
      Name    = "app-server"
      Managed = "terraform"
      Image   = "golden"
    }
  }
}

resource "aws_autoscaling_group" "app" {
  name                = "app-asg"
  vpc_zone_identifier = module.vpc.private_subnets
  target_group_arns   = [aws_lb_target_group.app.arn]

  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }

  min_size         = 3
  max_size         = 10
  desired_capacity = 3

  # 滚动更新策略
  instance_refresh {
    strategy = "Rolling"
    preferences {
      min_healthy_percentage = 50
      instance_warmup        = 120
    }
    triggers = ["tag"]
  }
}

# 定期清理旧镜像脚本
#!/bin/bash
# 清理 30 天前标记为 deprecated 的 AMI
DEPRECATED_AMIS=$(aws ec2 describe-images \
  --owners self \
  --filters "Name=tag:Status,Values=deprecated" \
  --query "Images[?CreationDate<='$(date -d '30 days ago' -Iseconds)'].ImageId" \
  --output text)

for AMI_ID in $DEPRECATED_AMIS; do
  # 先删快照再删 AMI
  SNAPSHOTS=$(aws ec2 describe-images \
    --image-ids "$AMI_ID" \
    --query 'BlockDeviceMappings[?Ebs.SnapshotId].Ebs.SnapshotId' \
    --output text)

  aws ec2 deregister-image --image-id "$AMI_ID"
  for SNAP_ID in $SNAPSHOTS; do
    aws ec2 delete-snapshot --snapshot-id "$SNAP_ID"
  done
  echo "Cleaned up: ${AMI_ID}"
done