Image Distribution

Image distribution is the final phase of the Klarity ImageFactory pipeline. Once an image is successfully built and tested in the central factory environment, it must be securely transferred and registered in your specific cloud accounts. This guide explains the distribution process for each supported provider.

Distribution Process Overview

The distribution process follows a hub-and-spoke model:

1. Build: The image is built in a central, secure factory account managed by Nordcloud.
2. Transfer: The image artifacts are copied or shared from the factory account to each of your onboarded cloud accounts.
3. Registration: The image is registered as a native resource (e.g., AMI, Gallery Image Version, Compute Image) in your account.

Tracking Distribution Results

For every build, ImageFactory provides a detailed breakdown of the distribution status across all target accounts. This information is stored in the cloud_distributions array, which includes:

• account_id: The unique identifier of the target cloud account.
• cloud_provider_id: The provider type (e.g., AWS, AZURE).
• result_image_id: The native ID of the image in the target account (e.g., ami-12345).
• error: A descriptive error message if the distribution failed for a specific account.

Provider-Specific Distribution

AWS

In AWS, the distribution process involves copying the AMI from the factory account to your account in the specified region.

• Sharing: You can optionally share the AMI with additional account IDs, entire Organizations, or specific Organizational Units (OUs).
• Encryption: If a kms_key_id is provided, the AMI is encrypted using your customer managed key during the copy process.

Azure

For Azure, the image is added as a new version to your Azure Compute Gallery (Shared Image Gallery).

• Replication: You can configure the gallery to automatically replicate the image version to multiple target regions.
• Managed Images: There is an option to create a standalone managed image instead of a gallery version.
• Azure Local: For Azure Local (formerly Azure Stack HCI) deployments, you can choose to retain the source VHD files.

GCP

In Google Cloud, the image is created directly in your target project. You can specify a custom naming convention for these images, and ImageFactory ensures they are correctly registered and available for use in Compute Engine.

Exoscale

On Exoscale, the resulting image is registered as a private template in the specified zone. This allows you to launch new instances using your golden image within the Exoscale infrastructure.

IBM Cloud

For IBM Cloud, the image is first stored in your Cloud Object Storage (COS) bucket and then registered as a custom image in your VPC infrastructure.

The Image Distributor Integrator

The logic for handling these complex cross-account and cross-region transfers is managed by the Image Distributor Integrator. This component is responsible for:

• Authenticating with target accounts.
• Initiating copy or share operations.
• Monitoring the progress of the distribution.
• Handling retries in case of transient network issues.

Error Handling

If the distribution fails for any reason, the status for that specific account is set to SHARE_ERROR. Common causes for distribution failures include:

• Missing permissions in the target account (e.g., the IAM role cannot be assumed).
• Reaching service quotas (e.g., maximum number of AMIs or gallery versions).
• Network connectivity issues between cloud regions.

Detailed logs for each distribution attempt are available in the ImageFactory console to help you troubleshoot and resolve these issues.

Summary Table

Provider	Target Resource	Key Features
AWS	AMI	Cross-account sharing, KMS encryption.
Azure	Gallery Image Version	Multi-region replication, Gen2 support.
GCP	Compute Image	Custom naming, project-level storage.
Exoscale	Private Template	Zone-specific registration.
IBM Cloud	VPC Custom Image	COS-backed transfers.

By automating the distribution process, ImageFactory ensures that your golden images are available exactly where you need them, without the need for manual intervention or complex custom scripts.