`az bake`

Microsoft Azure CLI Extension for creating (or "baking") custom virtual machine (VM) images.

Install

To install the Azure CLI Custom Image Helper extension, simply run the following command:

az extension add --source https://github.com/colbylwilliams/az-bake/releases/latest/download/bake-0.3.11-py3-none-any.whl -y

Update

To update Azure CLI DevCenter Helper extension to the latest version:

az bake upgrade

or for the latest pre-release version:

az bake upgrade --pre

Quickstart

1. Create a new GitHub or Azure DevOps repository, clone it locally, and open a shell at the root

2. Create a Service Principal (or use an existing one)

You'll have to install the Azure CLI if you haven't already

az ad sp create-for-rbac -n MyUniqueName

output:

{
   "appId": "<GUID>",
   "displayName": "MyUniqueName",
   "password": "<STRING>",
   "tenant": "<GUID>"
}

3. Create three new GitHub repository secrets or DevOps secret variables with the values output above

AZURE_CLIENT_ID (appId)
AZURE_CLIENT_SECRET (password)
AZURE_TENANT_ID (tenant)

4. Install the `az bake` Azure CLI extension

5. Create a new sandbox, providing an Azure Compute Gallery and the Service Principal's ID (created above)

Important: The GUID passed in for the --principal argument is the principal's Id NOT its AppId from the output above. To get the principal's ID, run: az ad sp show --id appId -o tsv --query id

az bake sandbox create --name MySandbox --gallery MyGallery --principal 00000000-0000-0000-0000-000000000000

6. Setup the repo for use with `az bake`

az bake repo setup --sandbox MySandbox --gallery MyGallery

This will generate a GitHub workflow or a DevOps pipeline yaml file in your repo that will build your images on commit.

7. Create an image definiiton in your repo

az bake image create --name MyImage

8. Commit and push your changes

This will kick off a workflow/pipeline to build your custom images. Once it is is finished, you can continue to monitor the image builds:

az bake image logs --sandbox MySandbox --name MyImage

Sandbox

In the context of az bake, a sandbox is a collection of resources in a resource group that are used to create (or "bake") custom VM images. It's a secure, self-contained environment where Packer will be executed from Azure Container Instance in a private virtual network. A sandbox is required to use az bake. You can be create a new sandbox using the az bake sandbox create command.

Each sandbox includes a:

Key Vault
Storage Account
Azure Container Instance (ACI) group for each custom image
Virtual Network, with two subnets
- A default subnet to which the temporary VMs will be joined. This also hosts a private endpoint for the Key Vault.
- A builders subnet to which the ACI containers will be joined. This subnet must be set up to delegate access to ACI, and must only contain ACI container groups.
User-assigned Managed Identity that is assigned to the ACI containers executing Packer and the temporary VMs. This identity will also require the Contributor role on the resource group that contains the Azure Compute Gallery where your custom images will be published.

Commands

This extension adds the following commands. Use az bake -h for more information.

Command	Description
`az bake sandbox create`	Create a sandbox.
`az bake sandbox validate`	Validate a sandbox.
`az bake repo build`	Bake images defined in a repo (usually run in CI).
`az bake repo setup`	Setup a repo for baking.
`az bake repo validate`	Validate a repo.
`az bake image create`	Create an image.
`az bake image logs`	Get the logs for an image build.
`az bake image rebuild`	Rebuild an image that failed.
`az bake image bump`	Bump the version number of images.
`az bake yaml export`	Export a bake.yaml file.
`az bake validate sandbox`	Validate a sandbox. This is an alias for `az bake sandbox validate`.
`az bake validate repo`	Validate a repo. This is an alias for `az bake repo validate`.
`az bake version`	Show the version of the bake extension.
`az bake upgrade`	Update bake cli extension.

`az bake sandbox create`

Create a sandbox.

az bake sandbox create --name
                       [--gallery]
                       [--location]
                       [--principal]
                       [--sandbox]
                       [--tags]
                       [--local]
                       [--pre]
                       [--template-file]
                       [--templates-url]
                       [--version]
                       [--builders-prefix]
                       [--builders-subnet]
                       [--default-prefix]
                       [--default-subnet]
                       [--vnet-address-prefix]

Examples

Create a sandbox.

az bake sandbox create -l eastus --name mySandbox \
  --gallery myGallery --principal CI_SP_ID

Create a sandbox with an existing resource group.

az bake sandbox create -l eastus -g mySandbox --name my-sandbox \
  --gallery myGallery --principal CI_SP_ID

Required Parameters

`--name --name-prefix -n`

The prefix to use in the name of all resources created in the build sandbox. For example if Contoso-Images is provided, the key vault, storage account, and vnet will be named Contoso-Images-kv, contosoimagesstorage, and contoso-images-vent respectively.

Optional Parameters

`--gallery -r`

Name or ID of a Azure Compute Gallery. You can configure the default using az configure --defaults bake-gallery=<id>.

`--location -l`

Location. Values from: az account list-locations. You can configure the default location using az configure --defaults location=<location>.

`--principal --principal-id`

The principal id of a service principal used to run az bake from a CI pipeline. It will be given contributor role to sandbox resource group.

`--sandbox -g -s`

Name of the sandbox resource group. You can configure the default using az configure --defaults bake-sandbox=<name>.

`--tags`

Space-separated tags: key[=value] [key[=value] ...]. Use '' to clear existing tags.

`--local --local-templates`

Use local template file that was packaged with the cli instead of downloading from GitHub.

`--pre`

Deploy latest template prerelease version.

`--template-file`

Path to custom sandbox arm/bicep template.

`--templates-url`

URL to custom templates.json file.

`--version -v`

Sandbox template release version.

^{default value: latest stable}

`--builders-prefix --builders-subnet-prefix`

The CIDR prefix to use when creating the subnet for the ACI containers that execute Packer.

^{default value: 10.0.0.128/25}

`--builders-subnet --builders-subnet-name`

The name to use when creating the subnet for the ACI containers that execute Packer.

^{default value: builders}

`--default-prefix --default-subnet-prefix`

The CIDR prefix to use when creating the subnet for the temporary VMs and private endpoints.

^{default value: 10.0.0.0/25}

`--default-subnet --default-subnet-name`

The name to use when creating the subnet for the temporary VMs and private endpoints.

^{default value: default}

`--vnet-address-prefix --vnet-prefix`

The CIDR prefix to use when creating a new VNet.

^{default value: 10.0.0.0/24}

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake sandbox validate`

Validate a sandbox.

az bake sandbox validate --sandbox
                         [--gallery]

Examples

Validate a sandbox.

az bake sandbox validate --sandbox mySandbox

Validate a sandbox and ensure the correct permissions on a gallery.

az bake sandbox validate --sandbox mySandbox --gallery myGallery

Required Parameters

`--sandbox -g -s`

Name of the sandbox resource group. You can configure the default using az configure --defaults bake-sandbox=<name>.

Optional Parameters

`--gallery -r`

Name or ID of a Azure Compute Gallery. You can configure the default using az configure --defaults bake-gallery=<id>.

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake repo build`

Bake images defined in a repo (usually run in CI).

az bake repo build --repo
                   [--images]
                   [--repo-revision]
                   [--repo-token]
                   [--repo-url]

Examples

Build all the images in a repo.

az bake repo build --repo .

Required Parameters

`--repo --repo-path -r`

Path to the locally cloned repository.

Optional Parameters

`--images -i`

Space separated list of images to bake.

^{default value: all images in repository}

`--repo-revision`

Repository revision.

`--repo-token`

Repository token.

`--repo-url`

Repository url.

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake repo setup`

Setup a repo for baking.

az bake repo setup --gallery
                   [--sandbox]
                   [--repo]

Examples

Setup a repo for baking.

az bake repo setup --sandbox mySandbox --gallery myGallery

Required Parameters

`--gallery -r`

Name or ID of a Azure Compute Gallery. You can configure the default using az configure --defaults bake-gallery=<id>.

`--sandbox -g -s`

Name of the sandbox resource group. You can configure the default using az configure --defaults bake-sandbox=<name>.

Optional Parameters

`--repo --repo-path`

Path to the locally cloned repository.

^{default value: ./}

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake repo validate`

Validate a repo.

az bake repo validate --repo

Examples

Validate a repo.

az bake repo validate --repo .

Required Parameters

`--repo --repo-path`

Path to the locally cloned repository.

^{default value: ./}

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake image create`

Create an image.

az bake image create --name
                     [--repo]

Examples

Create an image.yml file.

az bake image create --name myImage

Required Parameters

`--name -n`

Name of the image to create.

Optional Parameters

`--repo --repo-path -r`

Path to the locally cloned repository.

^{default value: ./}

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake image logs`

Get the logs for an image build.

az bake image logs --name
                   --sandbox

Examples

Get the logs for an image.

az bake image logs --sandbox mySandbox --name myImage

Required Parameters

`--name -n`

Name of the image.

`--sandbox -g -s`

Name of the sandbox resource group. You can configure the default using az configure --defaults bake-sandbox=<name>.

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake image rebuild`

Rebuild an image that failed.

az bake image rebuild --name
                      --sandbox
                      [--no-wait]

Examples

Rebuild an image that failed.

az bake image rebuild --sandbox mySandbox --name myImage

Required Parameters

`--name -n`

Name of the image to rebuild.

`--sandbox -g -s`

Name of the sandbox resource group. You can configure the default using az configure --defaults bake-sandbox=<name>.

Optional Parameters

`--no-wait`

Do not wait for the long-running operation to finish.

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake image bump`

Bump the version numbers of images.

az bake image bump [--images]
                   [--repo]
                   [--major]
                   [--minor]

Examples

Bump the patch version of all images.

az bake image bump

Bump the minor version of all images.

az bake image bump --minor

Bump the major version of specific images.

az bake image bump --major --images myImage1 MyImage2

Optional Parameters

`--images -i`

Space separated list of images to bump.

^{default value: all images in repository}

`--repo --repo-path`

Path to the locally cloned repository.

`--major`

Bump the major version.

`--minor`

Bump the minor version

^{default value: ./}

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake yaml export`

Export a bake.yaml file.

az bake yaml export --gallery
                    --sandbox
                    [--outdir]
                    [--outfile]
                    [--stdout]

Examples

Export a bake.yaml file to a directory.

az bake yaml export --sandbox mySandbox --gallery myGallery --outdir ./myDir

Export a bake.yaml file to a specific file.

az bake yaml export --sandbox mySandbox --gallery myGallery --outfile ./myDir/myFile.yaml

Print the bake.yaml file output to the console.

az bake yaml export --sandbox mySandbox --gallery myGallery --stdout

Required Parameters

`--gallery -r`

Name or ID of a Azure Compute Gallery. You can configure the default using az configure --defaults bake-gallery=<id>.

`--sandbox -g -s`

Name of the sandbox resource group. You can configure the default using az configure --defaults bake-sandbox=<name>.

Optional Parameters

`--outdir`

When set, saves the output at the specified directory.

`--outfile`

When set, saves the output as the specified file path.

^{default value: ./bake.yml}

`--stdout`

When set, prints all output to stdout instead of corresponding files.

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake validate sandbox`

Validate a sandbox. This is an alias for az bake sandbox validate.

az bake validate sandbox --sandbox
                         [--gallery]

Examples

Validate a sandbox.

az bake validate sandbox --sandbox mySandbox --gallery /My/Gallery/Resource/ID

Required Parameters

`--sandbox -g -s`

Name of the sandbox resource group. You can configure the default using az configure --defaults bake-sandbox=<name>.

Optional Parameters

`--gallery -r`

Name or ID of a Azure Compute Gallery. You can configure the default using az configure --defaults bake-gallery=<id>.

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake validate repo`

Validate a repo. This is an alias for az bake repo validate.

az bake validate repo --repo

Examples

Validate a repo.

az bake validate repo --repo .

Required Parameters

`--repo --repo-path`

Path to the locally cloned repository.

^{default value: ./}

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake version`

Show the version of the bake extension.

az bake version

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

`az bake upgrade`

Update bake cli extension.

az bake upgrade [-pre]
                [--version]

Examples

Update bake cli extension to the latest stable release.

az bake upgrade

Update bake cli extension to the latest pre-release.

az bake upgrade --pre

Update bake cli extension a specific version.

az bake upgrade --version 0.1.0

Optional Parameters

`--pre`

Update to the latest template prerelease version.

`--version -v`

Version (tag). Default: latest stable.

Global Parameters

`--debug`

Increase logging verbosity to show all debug logs.

`--help -h`

Show this help message and exit.

`--only-show-errors`

Only show errors, suppressing warnings.

`--output -o`

Output format. Allowed values: json, jsonc, none, table, tsv, yaml, yamlc.

^{default value: json}

`--query`

JMESPath query string. See http://jmespath.org/ for more information and examples.

`--subscription`

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

`--verbose`

Increase logging verbosity. Use --debug for full debug logs.

Name		Name	Last commit message	Last commit date
Latest commit History 126 Commits
.github/workflows		.github/workflows
.vscode		.vscode
bake		bake
builder		builder
docs		docs
examples		examples
schema		schema
tools		tools
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
linter_exclusions.yml		linter_exclusions.yml

License

colbylwilliams/az-bake

Folders and files

Latest commit

History

Repository files navigation

az bake

Install

Update

Quickstart

1. Create a new GitHub or Azure DevOps repository, clone it locally, and open a shell at the root

2. Create a Service Principal (or use an existing one)

3. Create three new GitHub repository secrets or DevOps secret variables with the values output above

4. Install the az bake Azure CLI extension

5. Create a new sandbox, providing an Azure Compute Gallery and the Service Principal's ID (created above)

6. Setup the repo for use with az bake

7. Create an image definiiton in your repo

8. Commit and push your changes

Sandbox

Commands

az bake sandbox create

Examples

Required Parameters

--name --name-prefix -n

Optional Parameters

--gallery -r

--location -l

--principal --principal-id

--sandbox -g -s

--tags

--local --local-templates

--pre

--template-file

--templates-url

--version -v

--builders-prefix --builders-subnet-prefix

--builders-subnet --builders-subnet-name

--default-prefix --default-subnet-prefix

--default-subnet --default-subnet-name

--vnet-address-prefix --vnet-prefix

Global Parameters

--debug

--help -h

--only-show-errors

--output -o

--query

--subscription

--verbose

az bake sandbox validate

Examples

Required Parameters

--sandbox -g -s

Optional Parameters

--gallery -r

Global Parameters

--debug

--help -h

--only-show-errors

--output -o

--query

--subscription

--verbose

az bake repo build

Examples

Required Parameters

--repo --repo-path -r

Optional Parameters

--images -i

--repo-revision

--repo-token

--repo-url

Global Parameters

--debug

--help -h

--only-show-errors

--output -o

--query

--subscription

--verbose

az bake repo setup

`az bake`

4. Install the `az bake` Azure CLI extension

6. Setup the repo for use with `az bake`

`az bake sandbox create`

`--name --name-prefix -n`

`--gallery -r`

`--location -l`

`--principal --principal-id`

`--sandbox -g -s`

`--tags`

`--local --local-templates`

`--pre`

`--template-file`

`--templates-url`

`--version -v`

`--builders-prefix --builders-subnet-prefix`

`--builders-subnet --builders-subnet-name`

`--default-prefix --default-subnet-prefix`

`--default-subnet --default-subnet-name`

`--vnet-address-prefix --vnet-prefix`

`--debug`

`--help -h`

`--only-show-errors`

`--output -o`

`--query`

`--subscription`

`--verbose`

`az bake sandbox validate`

`--sandbox -g -s`

`--gallery -r`

`--debug`

`--help -h`

`--only-show-errors`

`--output -o`

`--query`

`--subscription`

`--verbose`

`az bake repo build`

`--repo --repo-path -r`

`--images -i`

`--repo-revision`

`--repo-token`

`--repo-url`

`--debug`

`--help -h`

`--only-show-errors`

`--output -o`

`--query`

`--subscription`

`--verbose`

`az bake repo setup`

`--gallery -r`

`--sandbox -g -s`

`--repo --repo-path`

`--debug`

`--help -h`

`--only-show-errors`

`--output -o`

`--query`

`--subscription`

`--verbose`

`az bake repo validate`

`--repo --repo-path`

`--debug`

`--help -h`

`--only-show-errors`

`--output -o`

`--query`

`--subscription`

`--verbose`

`az bake image create`

`--name -n`

`--repo --repo-path -r`

`--debug`

`--help -h`

`--only-show-errors`

`--output -o`

`--query`

`--subscription`

`--verbose`