Automatic Rebuilds

Klarity ImageFactory is designed to ensure that your golden images are always secure and up to date. Instead of manually triggering builds, the platform uses a sophisticated system of automated triggers to rebuild images whenever changes occur in the underlying infrastructure, security landscape, or software components.

Rebuild Triggers

The platform identifies the reason for a rebuild using the RebuildReasonType. The following triggers are supported:

1. SECURITY_CHECK

This trigger is activated when a security vulnerability is detected in an existing image. ImageFactory performs automated security scanning to identify software vulnerabilities (CVEs) and known malware patterns. If a high-severity issue is found, a rebuild is automatically scheduled to apply the latest security patches.

2. SOURCE_IMAGE_CHANGE

The Distribution Scanner periodically checks for new versions of the base images provided by cloud vendors (e.g., a new Ubuntu AMI or a new Windows Server marketplace image). When a newer version of the source image is detected, ImageFactory triggers a rebuild to ensure your golden image is based on the latest available foundation.

3. HARDENING_SCRIPT_CHANGE

When Nordcloud updates the central repository of hardening scripts or when you update your custom build components, ImageFactory detects these changes. A rebuild is then triggered to apply the updated configurations to your images.

4. WEEKLY_UPDATES

To ensure that all OS packages are current, ImageFactory can be configured to perform a scheduled weekly rebuild. This process installs the latest security updates and bug fixes from the OS package manager (e.g., apt, yum, or Windows Update).

5. MANUAL

Users can always trigger a manual rebuild through the console or the API if they need to force an update outside of the automated schedule.

How the Scheduler Works

ImageFactory includes a central scheduler function that runs periodically. This function performs the following checks:

1. It invokes the Distribution Scanner to look for new source images.
2. It runs security checks to evaluate existing images against vulnerability databases.
3. It checks for any scheduled weekly updates.
4. It verifies if any build components have been updated.

Disabling Automatic Rebuilds

If you prefer to have full manual control over your image lifecycle, you can disable automatic rebuilds for a specific template. Set the disableCyclicalRebuilds property to true in your template configuration. This prevents all automated triggers from starting new builds for that template.

Triggering a Manual Rebuild

To trigger a manual rebuild, open the template detail page and click Rebuild. ImageFactory will immediately queue a new build using the template's current configuration.

For a detailed walkthrough of the template detail page, see the Template Details guide.

Via API

You can also trigger a manual rebuild programmatically using the GraphQL API:

mutation {
  rebuildTemplate(customerId: "your-customer-id", templateId: "your-template-id") {
    id
    state { status }
  }
}

Rebuild Blocking Logic

To prevent conflicts and resource waste, ImageFactory will block a rebuild request if the template already has an active build in progress. A rebuild is blocked if the template is in any of the following states:

• TEMPLATE_PENDING
• IMAGE_QUEUED
• IMAGE_BUILDING
• IMAGE_TESTING

Once the current build reaches a terminal state (IMAGE_CREATED or IMAGE_ERROR), the template becomes eligible for a new rebuild.

Summary of Rebuild Reasons

Reason	Source	Description
SECURITY_CHECK	Security Scan	Vulnerability or malware detected.
SOURCE_IMAGE_CHANGE	Cloud Provider	New base image version available.
HARDENING_SCRIPT_CHANGE	ImageFactory	Updates to security hardening scripts.
WEEKLY_UPDATES	OS Packages	Scheduled maintenance and patching.
MANUAL	User Action	Forced rebuild via API or Console.

By leveraging these automatic triggers, you can maintain a high security posture and ensure your infrastructure always uses the most recent and compliant machine images.