Merge pull request GoogleCloudPlatform#4423 from harshthakkar01/image-build

Disable upgrades for A* blueprints

Author: harshthakkar01

examples/machine-learning/a3-megagpu-8g/a3mega-slurm-blueprint.yaml

@@ -89,25 +89,10 @@ deployment_groups:
       # if you follow this rule, any module which supports DKMS will be
       # properly configured at the end of image building (gVNIC, NVIDIA, ...)
       - type: shell
-        destination: prevent_unintentional_upgrades.sh
+        destination: prevent_google_compute_upgrades.sh
         content: |
           #!/bin/bash
-          # Unattended upgrades are disabled in this blueprint so that software does not
-          # get updated daily and lead to potential instability in the cluster environment.
-          #
-          # Unattended Upgrades installs available security updates from the Ubuntu
-          # security pocket for installed packages daily by default. Administrators who
-          # disable this feature assume all responsibility for manually reviewing and
-          # patching their systems against vulnerabilities.
-          #
-          # To enable unattended upgrades, please remove the following lines:
-          #   systemctl stop unattended-upgrades.service
-          #   systemctl disable unattended-upgrades.service
-          #   systemctl mask unattended-upgrades.service
           set -e -o pipefail
-          systemctl stop unattended-upgrades.service
-          systemctl disable unattended-upgrades.service
-          systemctl mask unattended-upgrades.service
           apt-mark hold google-compute-engine
           apt-mark hold google-compute-engine-oslogin
           apt-mark hold google-guest-agent
@@ -383,6 +368,26 @@ deployment_groups:
       disk_size: $(vars.disk_size_gb)
       omit_external_ip: false
 
+      # Unattended upgrades are disabled in this blueprint so that software does not
+      # get updated daily and lead to potential instability in the cluster environment.
+      #
+      # Unattended Upgrades installs available security updates from the Ubuntu
+      # security pocket for installed packages daily by default. Administrators who
+      # disable this feature assume all responsibility for manually reviewing and
+      # patching their systems against vulnerabilities.
+      #
+      # To enable unattended upgrades, please remove this section.
+      metadata:
+        user-data: |
+          #cloud-config
+          write_files:
+          - path: /etc/apt/apt.conf.d/20auto-upgrades
+            permissions: '0644'
+            owner: root
+            content: |
+              APT::Periodic::Update-Package-Lists "0";
+              APT::Periodic::Unattended-Upgrade "0";
+
 - group: cluster
   modules:
   # if an existing bucket is desired, follow modules/file-system/pre-existing-network-storage/README.md

examples/machine-learning/a3-ultragpu-8g/a3ultra-slurm-blueprint.yaml

@@ -69,23 +69,6 @@ deployment_groups:
           Package: nvidia-container-toolkit nvidia-container-toolkit-base libnvidia-container-tools libnvidia-container1
           Pin: version 1.17.7-1
           Pin-Priority: 100
-      - type: shell
-        destination: disable_unattended_upgrades.sh
-        content: |
-          #!/bin/bash
-          # Unattended upgrades are disabled in this blueprint so that software does not
-          # get updated daily and lead to potential instability in the cluster environment.
-          #
-          # Unattended Upgrades installs available security updates from the Ubuntu
-          # security pocket for installed packages daily by default. Administrators who
-          # disable this feature assume all responsibility for manually reviewing and
-          # patching their systems against vulnerabilities.
-          #
-          # To enable unattended upgrades, please remove this section.
-          set -e -o pipefail
-          systemctl stop unattended-upgrades.service
-          systemctl disable unattended-upgrades.service
-          systemctl mask unattended-upgrades.service
       - type: data
         destination: /var/tmp/slurm_vars.json
         content: |
@@ -258,6 +241,25 @@ deployment_groups:
       source_image_project_id: [$(vars.base_image.project)]
       image_family: $(vars.instance_image.family)
       omit_external_ip: false
+      # Unattended upgrades are disabled in this blueprint so that software does not
+      # get updated daily and lead to potential instability in the cluster environment.
+      #
+      # Unattended Upgrades installs available security updates from the Ubuntu
+      # security pocket for installed packages daily by default. Administrators who
+      # disable this feature assume all responsibility for manually reviewing and
+      # patching their systems against vulnerabilities.
+      #
+      # To enable unattended upgrades, please remove this section.
+      metadata:
+        user-data: |
+          #cloud-config
+          write_files:
+          - path: /etc/apt/apt.conf.d/20auto-upgrades
+            permissions: '0644'
+            owner: root
+            content: |
+              APT::Periodic::Update-Package-Lists "0";
+              APT::Periodic::Unattended-Upgrade "0";
     use:
     - slurm-image-network
     - slurm-build-script

examples/machine-learning/a4-highgpu-8g/a4high-slurm-blueprint.yaml

@@ -70,23 +70,6 @@ deployment_groups:
           Package: nvidia-container-toolkit nvidia-container-toolkit-base libnvidia-container-tools libnvidia-container1
           Pin: version 1.17.7-1
           Pin-Priority: 100
-      - type: shell
-        destination: disable_unattended_upgrades.sh
-        content: |
-          #!/bin/bash
-          # Unattended upgrades are disabled in this blueprint so that software does not
-          # get updated daily and lead to potential instability in the cluster environment.
-          #
-          # Unattended Upgrades installs available security updates from the Ubuntu
-          # security pocket for installed packages daily by default. Administrators who
-          # disable this feature assume all responsibility for manually reviewing and
-          # patching their systems against vulnerabilities.
-          #
-          # To enable unattended upgrades, please remove this section.
-          set -e -o pipefail
-          systemctl stop unattended-upgrades.service
-          systemctl disable unattended-upgrades.service
-          systemctl mask unattended-upgrades.service
       - type: data
         destination: /var/tmp/slurm_vars.json
         content: |
@@ -259,6 +242,26 @@ deployment_groups:
       source_image_project_id: [$(vars.base_image.project)]
       image_family: $(vars.instance_image.family)
       omit_external_ip: false
+
+      # Unattended upgrades are disabled in this blueprint so that software does not
+      # get updated daily and lead to potential instability in the cluster environment.
+      #
+      # Unattended Upgrades installs available security updates from the Ubuntu
+      # security pocket for installed packages daily by default. Administrators who
+      # disable this feature assume all responsibility for manually reviewing and
+      # patching their systems against vulnerabilities.
+      #
+      # To enable unattended upgrades, please remove this section.
+      metadata:
+        user-data: |
+          #cloud-config
+          write_files:
+          - path: /etc/apt/apt.conf.d/20auto-upgrades
+            permissions: '0644'
+            owner: root
+            content: |
+              APT::Periodic::Update-Package-Lists "0";
+              APT::Periodic::Unattended-Upgrade "0";
     use:
     - slurm-image-network
     - slurm-build-script