创建GCP策略自动安装Ops Agent至Ubuntu22.04及合规异常排查

已创建GCP OS策略分配，目标为所有Ubuntu 22.04虚拟机自动安装Google Cloud Ops Agent，部署状态显示成功，但虚拟机始终标记为「Non-compliant」（不合规），且报告无失败原因。

用户提供的配置与报告 #

查看OS策略配置命令 #

gcloud compute os-config os-policy-assignments describe ops-agent-ubuntu-22-stag-os-policy --project=project-stag

配置输出 #

baseline: true
instanceFilter:
  inventories:
  - osShortName: ubuntu
    osVersion: '22.04'
name: projects/10777777778136/locations/europe-west1-b/osPolicyAssignments/ops-agent-ubuntu-22-stag-os-policy
osPolicies:
- id: ops-agent-ubuntu22-stag-os-policy1111111
  mode: ENFORCEMENT
  resourceGroups:
  - inventoryFilters:
    - osShortName: ubuntu-22.04
    resources:
    - exec:
        enforce:
          interpreter: SHELL
          script: |
            sudo bash add-google-cloud-ops-agent-repo.sh --uninstall 
            sudo bash add-google-cloud-ops-agent-repo.sh --also-install
        validate:
          interpreter: SHELL
          script: |
            sudo bash add-google-cloud-ops-agent-repo.sh --uninstall 
            sudo bash add-google-cloud-ops-agent-repo.sh --also-install
      id: uninstall-existing-agent
    - exec:
        enforce:
          interpreter: SHELL
          script: sudo systemctl start google-cloud-ops-agent.target && exit 100
        validate:
          interpreter: SHELL
          script: if (ps aux | grep 'opt[/].*google-cloud-ops-agent.*bin/'); then
            exit 100; else exit 101; fi
      id: ensure-agent-running
revisionCreateTime: '2024-02-26T07:23:44Z'
revisionId: fd1aa77c-4444-45ea-9e69-929678cf6b09
rollout:
  disruptionBudget:
    percent: 10
  minWaitDuration: 0s
rolloutState: SUCCEEDED
uid: 746d7ba2-07bd-44444-a466-8f298f2b7cfe

查看实例合规报告命令 #

gcloud compute os-config os-policy-assignment-reports describe ops-agent-ubuntu-22-stag-os-policy --instance=test-opsagent --location=europe-west1-b --project=project-stag

报告输出 #

instance: test-opsagent
lastRunId: ''
name: projects/10777777778136/locations/europe-west1-b/instances/1924903941761499182/osPolicyAssignments/ops-agent-ubuntu-22-stag-os-policy/report
osPolicyAssignment: projects/10777777778136/locations/europe-west1-b/osPolicyAssignments/ops-agent-ubuntu-22-stag-os-policy@fd1aa77c-ad48-45ea-9e69-929678cf6b09
osPolicyCompliances:
- complianceState: NON_COMPLIANT
  complianceStateReason: ''
  osPolicyId: ops-agent-ubuntu22-stag-os-policy1111111
updateTime: '2024-02-26T07:33:50.896031Z'

问题排查 #

从配置和报告来看，两个核心问题导致了不合规：

1. 资源组库存过滤规则不匹配
   实例过滤规则是osShortName: ubuntu + osVersion: '22.04'，但资源组内的过滤写成了osShortName: ubuntu-22.04，这会导致资源组无法匹配到目标实例，策略根本没在实例上执行。

2. 验证脚本逻辑错误

   • 第一个资源的validate脚本和enforce脚本完全相同，重复执行卸载再安装操作，且没有按照OS策略规则返回合规状态（要求exit 100表示合规，exit 101表示不合规）。
   • 第二个资源的enforce脚本返回exit 100，这会触发OS策略重复执行enforce操作，因为exit 100表示执行成功但需要重新验证，而不是执行完成。

正确的OS策略配置方法 #

1. 修正库存过滤规则 #

把资源组内的inventoryFilters改成和实例过滤一致的规则：

inventoryFilters:
  - osShortName: ubuntu
    osVersion: '22.04'

2. 修正脚本逻辑（符合OS策略返回码规则） #

OS策略exec资源的返回码规则：

• validate脚本：exit 100 = 实例合规；exit 101 = 实例不合规，需要执行enforce
• enforce脚本：exit 0-99 = 执行成功，无需重新验证；exit 100 = 执行成功，但需要重新验证

资源1：安装/验证Agent

- exec:
    enforce:
      interpreter: SHELL
      script: |
        # 下载官方安装脚本并完成安装
        curl -sSO https://dl.google.com/cloudagents/add-google-cloud-ops-agent-repo.sh
        sudo bash add-google-cloud-ops-agent-repo.sh --also-install
        exit 0  # 执行完成，无需重复验证
    validate:
      interpreter: SHELL
      script: |
        # 检查Agent包是否已安装
        if dpkg -l | grep -q google-cloud-ops-agent; then
          exit 100  # 合规
        else
          exit 101  # 不合规，需要执行安装
        fi
  id: install-ops-agent

资源2：确保Agent服务运行

- exec:
    enforce:
      interpreter: SHELL
      script: |
        # 设置服务开机自启并立即启动
        sudo systemctl enable --now google-cloud-ops-agent.target
        exit 0  # 执行完成，无需重复验证
    validate:
      interpreter: SHELL
      script: |
        # 检查服务是否处于活跃状态
        if systemctl is-active --quiet google-cloud-ops-agent.target; then
          exit 100  # 合规
        else
          exit 101  # 不合规，需要启动服务
        fi
  id: ensure-agent-running

3. 完整的策略配置示例 #

baseline: true
instanceFilter:
  inventories:
  - osShortName: ubuntu
    osVersion: '22.04'
osPolicies:
- id: ops-agent-ubuntu22-install
  mode: ENFORCEMENT
  resourceGroups:
  - inventoryFilters:
    - osShortName: ubuntu
      osVersion: '22.04'
    resources:
    - exec:
        enforce:
          interpreter: SHELL
          script: |
            curl -sSO https://dl.google.com/cloudagents/add-google-cloud-ops-agent-repo.sh
            sudo bash add-google-cloud-ops-agent-repo.sh --also-install
            exit 0
        validate:
          interpreter: SHELL
          script: |
            if dpkg -l | grep -q google-cloud-ops-agent; then
              exit 100
            else
              exit 101
            fi
      id: install-ops-agent
    - exec:
        enforce:
          interpreter: SHELL
          script: |
            sudo systemctl enable --now google-cloud-ops-agent.target
            exit 0
        validate:
          interpreter: SHELL
          script: |
            if systemctl is-active --quiet google-cloud-ops-agent.target; then
              exit 100
            else
              exit 101
            fi
      id: ensure-agent-running
rollout:
  disruptionBudget:
    percent: 10
  minWaitDuration: 0s

4. 更新策略并验证 #

用以下命令更新现有策略：

gcloud compute os-config os-policy-assignments update ops-agent-ubuntu-22-stag-os-policy \
  --project=project-stag \
  --location=europe-west1-b \
  --file=path/to/your/policy.yaml

等待策略生效后，验证实例合规性：

gcloud compute os-config os-policy-assignment-reports describe ops-agent-ubuntu-22-stag-os-policy \
  --instance=test-opsagent \
  --location=europe-west1-b \
  --project=project-stag

内容的提问来源于stack exchange，提问作者devops on the road