Google Cloud
Primcoat builds your hardened image, uploads it to Google Cloud Storage, and registers it as a custom image in your project.
- Uploads to
- Google Cloud Storage
- Registers as
- a custom image
Compute Engine will not take a disk on its own — it wants RAW inside a .tar.gz. That is a quirk rather than a difficulty: Primcoat converts the hardened QCOW2 master, wraps it, stages the archive in Google Cloud Storage, and hands it to image registration.
The Google guest environment is already inside by then — the guest agent and metadata-server integration Compute Engine relies on for SSH key propagation and instance metadata — so the image behaves like a native one rather than a stranger on the platform.
Image families
A custom image can be registered into an image family, and a family always resolves to its newest non-deprecated member. Point an instance template or a managed instance group at the family instead of a specific image, and the next build Primcoat publishes becomes what new instances boot — without an edit to your Terraform. Primcoat registers into the family you name on the publish target.
Compute Engine images are a project resource rather than a regional one, so unlike an AMI there is no per-region copy step to plan around.
Naming the image
Compute Engine has the strictest name rules of any destination Primcoat publishes to: lowercase letters, digits and hyphens only, starting with a letter, no trailing hyphen, 63 characters maximum. The name tokens do not naturally respect that — {date} produces dots, {build} produces an underscore, {os_title} produces capitals — so rather than reject a reasonable template, Primcoat normalises it for this destination: dots and underscores become hyphens, and the result is lowercased.
That means one template can serve every destination you publish to, and GCP gets a legal name without you maintaining a second template just for it.
What you configure
A publish target holds the service account credentials, the destination project, the GCS staging bucket, and the image family to register into. You define the image name, and add version information and other details as you like.
The recommended credential setup is Workload Identity Federation rather than a downloaded service-account key — see the platform overview, and the image pipeline for what happens before the upload.
Machine-readable:/integrations/gcp.md