为什么使用 Cloud Scheduler 和 Cloud Functions 启动 GCP 虚拟机时会出现延迟启动完整性错误？

Question

I have a preemptible VM on Google Cloud Platform that gets started at a certain time every day by a cloud function that is called through cloud scheduler. Although the VM starts and there is no visible problem, there is an error log each time stating that there is a late boot report of a failed integrity check. I understand that it is caused by an integrity validation failure. If I manually start the VM, there is no error log.

What is causing the integrity validation failure and how could I fix it? Thank you in advance!

{"@type":"type.googleapis.com/cloud_integrity.IntegrityEvent", "bootCounter":"50", "lateBootReportEvent":{…}}

{
  "insertId": "2",
  "jsonPayload": {
    "@type": "type.googleapis.com/cloud_integrity.IntegrityEvent",
    "lateBootReportEvent": {
      "policyEvaluationPassed": false,
      "actualMeasurements": [XXX],
      "policyMeasurements": [XXX]
    },
    "bootCounter": "50"
  },
  "resource": {
    "type": "gce_instance",
    "labels": {
      "instance_id": "XXX",
      "project_id": "XXX",
      "zone": "XXX"
    }
  },
  "timestamp": "XXX",
  "severity": "ERROR",
  "logName": "projects/XXX/logs/compute.googleapis.com%2Fshielded_vm_integrity",
  "receiveTimestamp": "XXX"
}

Answer 1

I have a similar issue with starting a GCP VM using ansible awx from a container. I recently moved these services from a Debian non-shielded VM to a RHEL shielded. Apparently the shielded instances are somehow not liking where the command is coming from or something to that affect.

Note that I've tried starting the VM with ansible awx using both the google.cloud collection api's and using the command/shell methods which essentially would be the same as me typing the command on the commandline using the google cloud sdk,which works if I do it manually, but not with ansible.

Support directed me to try this [command][1] to update the integrity policy but it still doesn't work. I've also tried disabling the shielded VM options.

https://cloud.google.com/compute/shielded-vm/docs/integrity-monitoring#updating-baseline