Automating XenServer® image builds with Packer

• Build VM templates (from an operating system ISO or an existing template)
• Configure the image hardware (vCPUs, memory, disk, networks, UEFI Secure Boot, vTPM, and vGPU)
• Install XenServer VM Tools during the build
• Deliver images as pool templates, XVAs, or disk images

• Automation: Builds images from a pipeline through Infrastructure-as-Code (IaC) practices, rather than from an operator working through an installer.
• Consistency: Ensures that every environment is deployed from the same image definition, minimizing drift.
• Traceability: Makes an image definition a reviewable file with a history, so that changes are approved like any other change.
• Integration: Produces the custom templates that the XenServer Terraform Provider deploys from, covering image creation and provisioning as a single workflow.

• xenserver-vm-iso: Builds a template from scratch, by driving an unattended install from an operating system ISO.
• xenserver-vm-clone: Builds a template from one that already exists, by re-provisioning a clone of it. Use this builder to patch a golden image without a full reinstall.

Prerequisites

• Packer version 1.7.0 or higher
  Download Packer from the official Packer Installation Guide.
  Windows users can install Packer using Chocolatey by running the following command:
  choco install packer
• XenServer 9 pool or standalone host with management network access
  Packer must connect to the pool coordinator or the standalone host, using the IP address of its management interface. In a pool, connecting to a supporter host fails.
• XenServer API credentials
  These are the user name and password of an account with the Pool Operator or Pool Admin role, such as root.
• CA certificate of your pool, in PEM format
  Certificate verification is enabled by default. To write the certificate of every host in the pool into a single file, run the following commands on the pool coordinator or the standalone host, and then copy pool-ca.pem to the machine that runs Packer:
  for uuid in $(xe host-list --minimal | tr ',' ' '); do
    xe host-get-server-certificate host=$uuid
done > pool-ca.pem
• An ISO authoring tool, if you deliver files to the VM with cd_files
  The CD is built on the machine that runs Packer, which needs one of oscdimg, xorriso, mkisofs, or hdiutil on its PATH. On Windows, oscdimg is part of the Windows Assessment and Deployment Kit (Windows ADK).

Network requirements

• Packer to the pool coordinator, over HTTPS on port 443. Always required.
• Packer to the build VM, over WinRM on port 5986 when winrm_use_ssl = true, as in the examples that follow, or on port 5985 otherwise. To use a different port, set winrm_port. Required to run provisioners in the guest, unless communicator is set to none.
• The build VM to Packer, over HTTP on a port between 8000 and 9000. Required when you serve answer files from http_directory, which is also how Packer learns the address of the VM. When the answer file is delivered on a CD instead, as in the examples that follow, the build learns the address from XenServer VM Tools, which the guest must install during the unattended pass.

Get started

1. Prepare the Packer configuration.
   To start, add the XenServer Packer Plugin to your Packer configuration file xenserver.pkr.hcl:
   packer {
    required_plugins {
        xenserver = {
            version = ">= 1.0.0"
            source  = "github.com/xenserver/xenserver"
        }
    }
}

variable "xenserver_password" {
    type      = string
    sensitive = true
}

variable "winrm_password" {
    type      = string
    sensitive = true
}
   Do not store credentials in the configuration file. Declare them as sensitive Packer variables, or set the XENSERVER_HOST, XENSERVER_USERNAME, XENSERVER_PASSWORD, XENSERVER_CA_CERT_PATH, XENSERVER_WINRM_USERNAME, and XENSERVER_WINRM_PASSWORD environment variables instead. Packer reads a declared variable from the matching PKR_VAR_ environment variable, such as PKR_VAR_winrm_password.
2. Define the build.
   For example, to build a Windows template from an ISO, define the source and build blocks in your configuration file:
   source "xenserver-vm-iso" "windows" {
    xenserver_host     = "<ip address of XenServer>"
    xenserver_username = "root"
    xenserver_password = var.xenserver_password
    ca_cert_path       = "pool-ca.pem"

    iso_name = "Win11.iso"
    iso_sr   = "ISO library"

    vm_name        = "windows-11-base"
    clone_template = "Windows 11"
    vcpus          = 4
    vm_memory_gb   = 8
    disk_size_gb   = 64
    firmware       = "uefi"
    secure_boot    = true
    vtpm           = true

    cd_files = [
        "./windows/Autounattend.xml",
        "./windows/managementagentx64.msi",
    ]

    boot_wait    = "3s"
    boot_command = ["<enter>"]

    communicator   = "winrm"
    winrm_username = "Administrator"
    winrm_password = var.winrm_password
    winrm_use_ssl  = true
    winrm_timeout  = "45m"

    format = "none"
}

build {
    sources = ["source.xenserver-vm-iso.windows"]
}
   Or, to patch a template that already exists:
   source "xenserver-vm-clone" "windows_patched" {
    xenserver_host     = "<ip address of XenServer>"
    xenserver_username = "root"
    xenserver_password = var.xenserver_password
    ca_cert_path       = "pool-ca.pem"

    clone_template = "windows-11-base"
    vm_name        = "windows-11-patched"

    communicator   = "winrm"
    winrm_username = "Administrator"
    winrm_password = var.winrm_password
    winrm_use_ssl  = true

    format = "none"
}

build {
    sources = ["source.xenserver-vm-clone.windows_patched"]

    provisioner "powershell" {
        inline = ["Write-Host 'Applying updates...'"]
    }
}
   Both examples connect over WinRM with HTTPS (winrm_use_ssl = true) and verify the build VM's certificate: the WinRM listener on port 5986 must present a certificate that the machine that runs Packer trusts, issued for the address that Packer connects to. For xenserver-vm-iso, the answer file must install XenServer VM Tools and create this listener. For xenserver-vm-clone, the template must already have both.
   For the meaning of each option, see the documentation of the xenserver-vm-iso and xenserver-vm-clone builders.
3. Initialize and run the build.
   To install the XenServer Packer Plugin from its GitHub releases, run:
   packer init .
   Then, to build the image, run:
   packer build .