murmur bake

Bakes a recipe into a VM image. By default the bake executes immediately under your own authority via the imperative Bake API. No change-request is created. With --propose the same content is staged as a BakeAction change-request, left PENDING for a reviewer whose approval runs the identical executor.

Synopsis

murmur bake <recipe> --environment ENV --placement PLACEMENT --service-profile PROFILE [flags]

<recipe> is the name of the recipe to bake.

Flags

Flag	Required	Description
`--environment ENV`	yes	Environment providing the scratch VM machine shape.
`--placement PLACEMENT`	yes	Placement where the image is baked.
`--service-profile PROFILE`	yes	Service-profile whose credentials the bake VM uses. A bake never carries your personal secrets; executing requires `service-profile.assume` on the profile.
`--service-account ID`	conditional	Cloud IAM identity for the bake VM. Required whenever the placement has service-account bindings: the action pins the exact identity, never a server default. Workspace bakes require binding admission and workspace authority; tenant-level bakes require `placement-sa.assume` on the identity.
`--force-new`	no	Skip the image cache and bake fresh. Without it, a bake whose computed image already exists is a no-op.
`--propose`	no	Stage a change-request `PENDING` for review instead of executing.
`--rationale TEXT`	no	Rationale recorded on the change-request (only with `--propose`).

Output

The command prints one line to stdout:

Outcome	Line
Bake started	`bake of recipe <recipe> started (run <run-id>); track with: murmur bakes ls`
Identical bake already running	`bake of recipe <recipe> already running (run <run-id>); track with: murmur bakes ls`
Image already baked	`image for recipe <recipe> already baked — nothing to do (use --force-new to bake fresh)`
`--propose`	`created change-request <id> for bake of recipe <recipe> (pending review)`

Examples

Bake now (executes immediately):

$ murmur bake go-python --environment default --placement us-central1 --service-profile infra-bot
bake of recipe go-python started (run 019f4368-…); track with: murmur bakes ls

Propose a bake for someone else to approve:

$ murmur bake go-python --environment default --placement us-central1 \
    --service-profile infra-bot --propose --rationale "toolchain bump"
created change-request cr-a1b2c3d4e5f6 for bake of recipe go-python (pending review)
$ murmur change-request approve cr-a1b2c3d4e5f6   # a reviewer with bake.create + assume

Semantics

One executor, two entry points. A direct bake and an approved BakeAction change-request use the same executor. Both require bake.create plus service-profile.assume, and workspace.use for workspace bakes. A workspace bake’s cloud identity must admit the workspace through workspace_use; a tenant-level bake instead requires placement-sa.assume on that identity. The authority belongs to whoever executes the bake, either the caller or the approver. Proposing requires only change-request.create plus recipe.read. A direct bake creates no change-request record.
Idempotent. The bake workflow ID is deterministic from the recipe content, so re-issuing identical content joins the running bake or no-ops on the cached image. It never double-bakes. Use --force-new to bake identical content fresh.
Validated up front. The full spec (base image for the placement’s substrate, machine-type region availability, service-account binding match) resolves before anything runs, and resolves again at execution for proposals, so an unbakeable request is rejected immediately.
Automated re-bakes. Modifying a recipe’s bake-consumed fields auto-proposes one BakeAction change-request per distinct configuration in your bake history (source: recipe_bake), so a reviewer approves each re-bake against the new content. Track executions with murmur bakes ls.

Errors

Error	Meaning	What to do
`--environment is required` (also `--placement`, `--service-profile`)	A required flag is missing.	Pass all three flags.
`--rationale only applies with --propose (a direct bake creates no change-request)`	`--rationale` was given without `--propose`.	Add `--propose`, or drop `--rationale`.
`service_account is required: placement "<name>" has service account bindings and the bake must pin one explicitly`	The placement has service-account bindings and no `--service-account` was given.	Pass `--service-account` with one of the placement’s bound identities.
`UNAUTHENTICATED`	Identity token is missing or expired.	Run `murmur login`, or check your `murmur.local.yaml` configuration.

Images: concept overview
Recipe: what a recipe defines
Change requests: review and apply proposed bakes
murmur bakes ls: track bake progress

Getting Started

Core Concepts

Guides

Synopsis

Flags

Output

Examples

Semantics

Errors

​Synopsis

​Flags

​Output

​Examples

​Semantics

​Errors

​Related

Synopsis

Flags

Output

Examples

Semantics

Errors

Related