Cirrus: Document and codify base-image production

A number of images required for future testing are not present in GCE.
Importing them is a long proscribed process prone to errors and
complications.

Improve this situation by documenting, and encoding the majority of the
steps required.  Due to the required complexity, these are clearly
identified as 'semi-automated'.  This means a discerning eye is
sometimes needed to address unforeseen problems (networking issues,
format or packaging changes, etc).

Nevertheless, having these steps in writing, will reduce current and
future  maintenance burden while supporting future testing needs of
RHEL, Fedora and Fedora Atomic Host.

Also:

* Add necessary configuration, scripts, and Makefile updates needed to
  prepare RHEL, Fedora, & FAH cloud images for use in GCE.  This
  is a complex, multi-step process where the cloud image is booted
  un a local user-mod qemu-kvm instance, where it can be modified.
  From there, it's converted into a specific format, and imported into
  GCE.  Lastly, the imported raw disk data is made available as a GCE
  VM image.

  Note: As of this commit, the RHEL base-image builds (CentOS has native
  image), however neither RHEL or CentOS cache-images build correctly.

* Left testing on FAH disabled, the GCE/Cirrus integration needs needs more
  work.  Specifically, the python3-based google startup script service
  throws a permission-denied (as root) when trying to create a temp.
  directory.  Did not investigate further, though manually running the
  startup script does allow the libpod tests to start running.

* Enabled Fedora 29 image to execute tests and general use.

* Utilize the standardized F28-based container image  for gating
  of more the intensive unit and integration testing.  Update
  documentation to reflect this as the standard platform for
  these checks.  Rename tasks with shorter names and to better
  reflect their purpose.

* Cirrus: Trim unnecessary env vars before testing since the vast
  majority are only required for orchestration purposes.  Since most
  are defined within `.cirrus.yml`, it's a good place to store the
  list of undesirables.  Since each of the cirrus-scripts runs in
  it's own shell, unsetting these near the end will have no
  consequence.  Also trim down the number of calls to show_env_vars()

Signed-off-by: Chris Evich <cevich@redhat.com>

14 files changed, 498 insertions, 46 deletions

diff --git a/contrib/cirrus/packer/.gitignore b/contrib/cirrus/packer/.gitignore
index 6080c9639..8f7bdeaf7 100644
--- a/contrib/cirrus/packer/.gitignore
+++ b/contrib/cirrus/packer/.gitignore
@@ -1,3 +1,7 @@
 *json
 packer
 packer*zip
+packer_cache
+cidata*
+meta-data
+user-data
diff --git a/contrib/cirrus/packer/Makefile b/contrib/cirrus/packer/Makefile
index d3a34877f..9bf27373e 100644
--- a/contrib/cirrus/packer/Makefile
+++ b/contrib/cirrus/packer/Makefile
@@ -54,3 +54,55 @@ endif
 	@echo "Finished.  The images mentioned above, and in packer-manifest.json"
 	@echo "can be used in .cirrus.yml as values for the 'image_name' keys"
 	@echo ""
+
+cidata.ssh:
+	ssh-keygen -f $@ -P "" -q
+
+cidata.ssh.pub: cidata.ssh
+	touch $@
+
+meta-data:
+	echo "local-hostname: localhost.localdomain" > $@
+
+user-data: cidata.ssh.pub
+	bash make-user-data.sh
+
+cidata.iso: user-data meta-data
+	genisoimage -output cidata.iso -volid cidata -input-charset utf-8 -joliet -rock user-data meta-data
+
+# This is intended to be run by a human, with admin access to the libpod GCE project.
+.PHONY: libpod_base_images
+libpod_base_images: libpod_base_images.json cidata.iso cidata.ssh packer
+ifndef GCP_PROJECT_ID
+	$(error GCP_PROJECT_ID is undefined, expected complete GCP project ID string e.g. foobar-12345)
+endif
+ifndef GOOGLE_APPLICATION_CREDENTIALS
+	$(error GOOGLE_APPLICATION_CREDENTIALS is undefined, expected absolute path to JSON file, like $HOME/.config/gcloud/legacy_credentials/*/adc.json)
+endif
+ifndef RHEL_IMAGE_FILE
+	$(error RHEL_IMAGE_FILE is undefined, expected full path to a rhel-server-ec2-*.raw.xz file)
+endif
+ifndef RHEL_CSUM_FILE
+	$(error RHEL_CSUM_FILE is undefined, expected full path to a rhel-server-ec2-*.raw.xz.SHA256SUM file)
+endif
+ifndef RHSM_COMMAND
+	$(error RHSM_COMMAND is undefined, expected string required for temporarily registering VM)
+endif
+	PACKER_CACHE_DIR=/tmp ./packer build \
+		-var TIMESTAMP=$(TIMESTAMP) \
+		-var TTYDEV=$(TTYDEV) \
+		-var GCP_PROJECT_ID=$(GCP_PROJECT_ID) \
+		-var GOOGLE_APPLICATION_CREDENTIALS=$(GOOGLE_APPLICATION_CREDENTIALS) \
+		-var GOSRC=$(GOSRC) \
+		-var PACKER_BASE=$(PACKER_BASE) \
+		-var SCRIPT_BASE=$(SCRIPT_BASE) \
+		-var RHEL_BASE_IMAGE_NAME=$(shell basename $(RHEL_IMAGE_FILE) | tr -d '[[:space:]]' | sed -r -e 's/\.x86_64\.raw\.xz//' | tr '[[:upper:]]' '[[:lower:]]' | tr '[[:punct:]]' '-') \
+		-var RHEL_IMAGE_FILE=$(RHEL_IMAGE_FILE) \
+		-var RHEL_CSUM_FILE=$(RHEL_CSUM_FILE) \
+	    -var 'RHSM_COMMAND=$(RHSM_COMMAND)' \
+		-only $(PACKER_BUILDS) \
+		libpod_base_images.json
+	@echo ""
+	@echo "Finished.  The images mentioned above, and in packer-manifest.json"
+	@echo "can be used in .cirrus.yml as values for the *_BASE_IMAGE keys."
+	@echo ""
diff --git a/contrib/cirrus/packer/README.md b/contrib/cirrus/packer/README.md
index 8ff6947e9..9a07ed960 100644
--- a/contrib/cirrus/packer/README.md
+++ b/contrib/cirrus/packer/README.md
@@ -1,2 +1,3 @@
 These are definitions and scripts consumed by packer to produce the
-various distribution images used for CI testing.
+various distribution images used for CI testing.  For more details
+see the [Cirrus CI documentation](../README.md)
diff --git a/contrib/cirrus/packer/fah_base-setup.sh b/contrib/cirrus/packer/fah_base-setup.sh
new file mode 100644
index 000000000..606c4f336
--- /dev/null
+++ b/contrib/cirrus/packer/fah_base-setup.sh
@@ -0,0 +1,45 @@
+
+# N/B: This script is not intended to be run by humans.  It is used to configure the
+# FAH base image for importing, so that it will boot in GCE.
+
+set -e
+
+# Load in library (copied by packer, before this script was run)
+source $GOSRC/$SCRIPT_BASE/lib.sh
+
+install_ooe
+
+if [[ "$1" == "pre" ]]
+then
+    echo "Upgrading Atomic Host"
+    setenforce 0
+    ooe.sh atomic host upgrade
+
+    echo "Configuring Repositories"
+    ooe.sh sudo tee /etc/yum.repos.d/ngompa-gce-oslogin.repo <<EOF
+[ngompa-gce-oslogin]
+name=Copr repo for gce-oslogin owned by ngompa
+baseurl=https://copr-be.cloud.fedoraproject.org/results/ngompa/gce-oslogin/fedora-\$releasever-\$basearch/
+type=rpm-md
+skip_if_unavailable=True
+gpgcheck=1
+gpgkey=https://copr-be.cloud.fedoraproject.org/results/ngompa/gce-oslogin/pubkey.gpg
+repo_gpgcheck=0
+enabled=1
+enabled_metadata=1
+EOF
+    echo "Installing necessary packages and  google services"
+    # Google services are enabled by default, upon install.
+    ooe.sh rpm-ostree install rng-tools google-compute-engine google-compute-engine-oslogin
+    echo "Rebooting..."
+    systemctl reboot  # Required for upgrade + package installs to be active
+elif [[ "$1" == "post" ]]
+then
+    echo "Enabling necessary services"
+    systemctl enable rngd  # Must reboot before enabling
+    rh_finalize
+    echo "SUCCESS!"
+else
+    echo "Expected to be called with 'pre' or 'post'"
+    exit 6
+fi
diff --git a/contrib/cirrus/packer/fah_setup.sh b/contrib/cirrus/packer/fah_setup.sh
new file mode 100644
index 000000000..2e053b396
--- /dev/null
+++ b/contrib/cirrus/packer/fah_setup.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# This script is called by packer on the subject fah VM, to setup the podman
+# build/test environment.  It's not intended to be used outside of this context.
+
+set -e
+
+# Load in library (copied by packer, before this script was run)
+source /tmp/libpod/$SCRIPT_BASE/lib.sh
+
+req_env_var "
+SCRIPT_BASE $SCRIPT_BASE
+"
+
+install_ooe
+
+ooe.sh sudo atomic host upgrade
+
+ooe.sh sudo rpm-ostree uninstall cloud-init
+
+rh_finalize
+
+echo "SUCCESS!"
diff --git a/contrib/cirrus/packer/fedora_base-setup.sh b/contrib/cirrus/packer/fedora_base-setup.sh
new file mode 100644
index 000000000..c0a1e422c
--- /dev/null
+++ b/contrib/cirrus/packer/fedora_base-setup.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# N/B: This script is not intended to be run by humans.  It is used to configure the
+# fedora base image for importing, so that it will boot in GCE
+
+set -e
+
+# Load in library (copied by packer, before this script was run)
+source $GOSRC/$SCRIPT_BASE/lib.sh
+
+[[ "$1" == "post" ]] || exit 0  # nothing to do
+
+install_ooe
+
+echo "Updating packages"
+ooe.sh dnf -y update
+
+echo "Installing necessary packages and  google services"
+ooe.sh dnf -y copr enable ngompa/gce-oslogin
+ooe.sh dnf -y install rng-tools google-compute-engine google-compute-engine-oslogin
+
+echo "Enabling services"
+ooe.sh systemctl enable rngd
+
+rh_finalize
+
+echo "SUCCESS!"
diff --git a/contrib/cirrus/packer/fedora_setup.sh b/contrib/cirrus/packer/fedora_setup.sh
index f9fea04a7..4e4391e59 100644
--- a/contrib/cirrus/packer/fedora_setup.sh
+++ b/contrib/cirrus/packer/fedora_setup.sh
@@ -10,6 +10,7 @@ source /tmp/libpod/$SCRIPT_BASE/lib.sh
 
 req_env_var "
 SCRIPT_BASE $SCRIPT_BASE
+FEDORA_CNI_COMMIT $FEDORA_CNI_COMMIT
 CNI_COMMIT $CNI_COMMIT
 CRIO_COMMIT $CRIO_COMMIT
 CRIU_COMMIT $CRIU_COMMIT
@@ -65,11 +66,13 @@ ooe.sh sudo dnf install -y \
     runc \
     skopeo-containers \
     slirp4netns \
+    unzip \
     which \
     xz
 
 install_varlink
 
+CNI_COMMIT=$FEDORA_CNI_COMMIT
 install_cni_plugins
 
 install_buildah
diff --git a/contrib/cirrus/packer/image-builder-image_base-setup.sh b/contrib/cirrus/packer/image-builder-image_base-setup.sh
new file mode 100644
index 000000000..b8e2824a7
--- /dev/null
+++ b/contrib/cirrus/packer/image-builder-image_base-setup.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+
+# This script is called by packer on a vanilla CentOS VM, to setup the image
+# used for building images FROM base images. It's not intended to be used
+# outside of this context.
+
+set -e
+
+[[ "$1" == "post" ]] || exit 0  # pre stage not needed
+
+# Load in library (copied by packer, before this script was run)
+source $GOSRC/$SCRIPT_BASE/lib.sh
+
+req_env_var "
+    TIMESTAMP $TIMESTAMP
+    GOSRC $GOSRC
+    SCRIPT_BASE $SCRIPT_BASE
+    PACKER_BASE $PACKER_BASE
+"
+
+install_ooe
+
+echo "Updating packages"
+ooe.sh sudo yum -y update
+
+echo "Configuring repositories"
+ooe.sh sudo yum -y install centos-release-scl epel-release
+
+echo "Installing packages"
+ooe.sh sudo yum -y install \
+    genisoimage \
+    golang \
+    google-cloud-sdk \
+    libvirt \
+    libvirt-admin \
+    libvirt-client \
+    libvirt-daemon \
+    make \
+    python34 \
+    python34 \
+    python34-PyYAML \
+    python34-PyYAML \
+    qemu-img \
+    qemu-kvm \
+    qemu-kvm-tools \
+    qemu-user \
+    rsync \
+    unzip \
+    util-linux \
+    vim
+
+sudo ln -s /usr/libexec/qemu-kvm /usr/bin/
+
+sudo tee /etc/modprobe.d/kvm-nested.conf <<EOF
+options kvm-intel nested=1
+options kvm-intel enable_shadow_vmcs=1
+options kvm-intel enable_apicv=1
+options kvm-intel ept=1
+EOF
+
+echo "Installing packer"
+sudo mkdir -p /root/$(basename $PACKER_BASE)
+sudo cp $GOSRC/$PACKER_BASE/*packer* /root/$(basename $PACKER_BASE)
+sudo mkdir -p /root/$(basename $SCRIPT_BASE)
+sudo cp $GOSRC/$SCRIPT_BASE/*.sh /root/$(basename $SCRIPT_BASE)
+
+install_scl_git
+
+echo "Cleaning up"
+cd /
+rm -rf $GOSRC
+
+rh_finalize
+
+echo "SUCCESS!"
diff --git a/contrib/cirrus/packer/libpod_base_images.yml b/contrib/cirrus/packer/libpod_base_images.yml
new file mode 100644
index 000000000..4ae44e0d9
--- /dev/null
+++ b/contrib/cirrus/packer/libpod_base_images.yml
@@ -0,0 +1,179 @@
+---
+
+variables:
+    # Complete local path to this repository (Required)
+    GOSRC:
+    # Relative path to this (packer) subdirectory (Required)
+    PACKER_BASE:
+    # Relative path to cirrus scripts subdirectory (Required)
+    SCRIPT_BASE:
+    # Unique ID for naming new base-images (required)
+    TIMESTAMP:
+    # Required for output from qemu builders
+    TTYDEV:
+    # RHEL images require click-through agreements to obtain (required)
+    RHEL_BASE_IMAGE_NAME:
+    RHEL_IMAGE_FILE:
+    RHEL_CSUM_FILE:
+    # RHEL requires a subscription to install/update packages
+    RHSM_COMMAND:
+
+    # Fedora images are obtainable by direct download
+    FEDORA_IMAGE_URL: "https://dl.fedoraproject.org/pub/fedora/linux/releases/29/Cloud/x86_64/images/Fedora-Cloud-Base-29-1.2.x86_64.qcow2"
+    FEDORA_CSUM_URL: "https://dl.fedoraproject.org/pub/fedora/linux/releases/29/Cloud/x86_64/images/Fedora-Cloud-29-1.2-x86_64-CHECKSUM"
+    FEDORA_BASE_IMAGE_NAME: 'fedora-cloud-base-29-1-2'  # Name to use in GCE
+    FAH_IMAGE_URL: "https://dl.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-29-20181025.1/AtomicHost/x86_64/images/Fedora-AtomicHost-29-20181025.1.x86_64.qcow2"
+    FAH_CSUM_URL: "https://dl.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-29-20181025.1/AtomicHost/x86_64/images/Fedora-AtomicHost-29-20181025.1-x86_64-CHECKSUM"
+    FAH_BASE_IMAGE_NAME: 'fedora-atomichost-29-20181025-1'  # Name to use in GCE
+
+    # The name of the image in GCE used for packer build libpod_images.yml
+    IBI_BASE_NAME: 'image-builder-image'
+    CIDATA_ISO: 'cidata.iso'  # produced by Makefile
+
+    # Path to json file (required, likely ~/.config/gcloud/legacy_credentials/*/adc.json)
+    GOOGLE_APPLICATION_CREDENTIALS:
+    # The complete project ID (required, not the short name)
+    GCP_PROJECT_ID:
+    # Pre-existing storage bucket w/ lifecycle-enabled
+    XFERBUCKET: "packer-import"  # pre-created, globally unique, lifecycle-enabled
+
+# Don't leak sensitive values in error messages / output
+sensitive-variables:
+    - 'GOOGLE_APPLICATION_CREDENTIALS'
+    - 'GCP_PROJECT_ID'
+    - 'RHSM_COMMAND'
+
+# What images to produce in which cloud
+builders:
+    - name: '{{user `IBI_BASE_NAME`}}'
+      type: 'googlecompute'
+      image_name: '{{user `IBI_BASE_NAME`}}-{{user `TIMESTAMP`}}'
+      image_family: '{{user `IBI_BASE_NAME`}}'
+      source_image_project_id: 'centos-cloud'
+      source_image_family: 'centos-7'
+      project_id: '{{user `GCP_PROJECT_ID`}}'
+      account_file: '{{user `GOOGLE_APPLICATION_CREDENTIALS`}}'
+      communicator: 'ssh'
+      ssh_username: 'centos'
+      ssh_pty: 'true'
+      # The only supported zone in Cirrus-CI, as of addition of this comment
+      zone: 'us-central1-a'
+      # Enable nested virtualization in case it's ever needed
+      image_licenses:
+        - 'https://www.googleapis.com/compute/v1/projects/vm-options/global/licenses/enable-vmx'
+      min_cpu_platform: "Intel Broadwell"  # nested-virt requirement
+
+    - &nested_virt
+      name: 'fedora'
+      type: 'qemu'
+      accelerator: "kvm"
+      iso_url: '{{user `FEDORA_IMAGE_URL`}}'
+      disk_image: true
+      format: "raw"
+      disk_size: 5120
+      iso_checksum_url: '{{user `FEDORA_CSUM_URL`}}'
+      iso_checksum_type: "sha256"
+      output_directory: '/tmp/{{build_name}}'
+      vm_name: "disk.raw"  # actually qcow2, name required for post-processing
+      boot_wait: '5s'
+      shutdown_command: 'shutdown -h now'
+      headless: true
+      qemu_binary: "/usr/libexec/qemu-kvm"
+      qemuargs:  # List-of-list format required to override packer-generated args
+        - - "-m"
+          - "1024"
+        - - "-cpu"
+          - "host"
+        - - "-device"
+          - "virtio-rng-pci"
+        - - "-chardev"
+          - "tty,id=pts,path={{user `TTYDEV`}}"
+        - - "-device"
+          - "isa-serial,chardev=pts"
+        - - "-cdrom"
+          - "{{user `CIDATA_ISO`}}"
+        - - "-netdev"
+          - "user,id=net0,hostfwd=tcp::{{ .SSHHostPort }}-:22"
+        - - "-device"
+          - "virtio-net,netdev=net0"
+      communicator: 'ssh'
+      ssh_private_key_file: 'cidata.ssh'
+      ssh_username: 'root'
+
+    - <<: *nested_virt
+      name: 'fah'
+      iso_url: '{{user `FAH_IMAGE_URL`}}'
+      iso_checksum_url: '{{user `FAH_CSUM_URL`}}'
+      disk_size: 10240
+
+    - <<: *nested_virt
+      name: 'rhel'
+      iso_url: 'file://{{user `RHEL_IMAGE_FILE`}}'
+      iso_checksum_url: 'file://{{user `RHEL_CSUM_FILE`}}'
+      disk_size: 10240
+
+provisioners:
+    - type: 'shell'
+      inline:
+        - 'mkdir -p /tmp/libpod/{{user `SCRIPT_BASE`}}'
+        - 'mkdir -p /tmp/libpod/{{user `PACKER_BASE`}}'
+
+    - type: 'file'
+      source: '{{user `GOSRC`}}/.cirrus.yml'
+      destination: '/tmp/libpod/.cirrus.yml'
+
+    - type: 'file'
+      source: '{{user `GOSRC`}}/{{user `SCRIPT_BASE`}}/'
+      destination: '/tmp/libpod/{{user `SCRIPT_BASE`}}/'
+
+    - type: 'file'
+      source: '{{user `GOSRC`}}/{{user `PACKER_BASE`}}/'
+      destination: '/tmp/libpod/{{user `PACKER_BASE`}}/'
+
+    - &shell_script
+      type: 'shell'
+      inline:
+        - 'chmod +x /tmp/libpod/{{user `PACKER_BASE`}}/{{build_name}}_base-setup.sh'
+        - '/tmp/libpod/{{user `PACKER_BASE`}}/{{build_name}}_base-setup.sh pre'
+      expect_disconnect: true  # Allow this to reboot the VM
+      environment_vars:
+          - 'TIMESTAMP={{user `TIMESTAMP`}}'
+          - 'GOSRC=/tmp/libpod'
+          - 'SCRIPT_BASE={{user `SCRIPT_BASE`}}'
+          - 'PACKER_BASE={{user `PACKER_BASE`}}'
+          - 'RHSM_COMMAND={{user `RHSM_COMMAND`}}'
+
+    - <<: *shell_script
+      inline: ['{{user `GOSRC`}}/{{user `PACKER_BASE`}}/{{build_name}}_base-setup.sh']
+      expect_disconnect: false
+      pause_before: '10s'
+      inline:
+        - '/tmp/libpod/{{user `PACKER_BASE`}}/{{build_name}}_base-setup.sh post'
+
+post-processors:
+    - - type: "compress"
+        only: ['fedora', 'fah', 'rhel']
+        output: '/tmp/{{build_name}}/disk.raw.tar.gz'
+        format: '.tar.gz'
+        compression_level: 9
+      - &gcp_import
+        only: ['fedora']
+        type: "googlecompute-import"
+        project_id: '{{user `GCP_PROJECT_ID`}}'
+        account_file: '{{user `GOOGLE_APPLICATION_CREDENTIALS`}}'
+        bucket: '{{user `XFERBUCKET`}}'
+        gcs_object_name: '{{build_name}}-{{user `TIMESTAMP`}}-{{uuid}}.tar.gz'
+        image_name: "{{user `FEDORA_BASE_IMAGE_NAME`}}-{{user `TIMESTAMP`}}"
+        image_description: 'Based on {{user `FEDORA_IMAGE_URL`}}'
+        image_family: '{{user `FEDORA_BASE_IMAGE_NAME`}}'
+      - <<: *gcp_import
+        only: ['fah']
+        image_name: "{{user `FAH_BASE_IMAGE_NAME`}}-{{user `TIMESTAMP`}}"
+        image_description: 'Based on {{user `FAH_IMAGE_URL`}}'
+        image_family: '{{user `FAH_BASE_IMAGE_NAME`}}'
+      - <<: *gcp_import
+        only: ['rhel']
+        image_name: "{{user `RHEL_BASE_IMAGE_NAME`}}-{{user `TIMESTAMP`}}"
+        image_description: 'Based on {{user `RHEL_IMAGE_FILE`}}'
+        image_family: '{{user `RHEL_BASE_IMAGE_NAME`}}'
+      - type: 'manifest'
diff --git a/contrib/cirrus/packer/libpod_images.yml b/contrib/cirrus/packer/libpod_images.yml
index 1e85e8522..7b95b08cc 100644
--- a/contrib/cirrus/packer/libpod_images.yml
+++ b/contrib/cirrus/packer/libpod_images.yml
@@ -16,7 +16,7 @@ variables:
     CRIU_COMMIT: "{{env `CRIU_COMMIT`}}"
     RUNC_COMMIT: "{{env `RUNC_COMMIT`}}"
 
-    CIRRUS_BUILD_ID: '{{env `CIRRUS_BUILD_ID`}}'
+    BUILT_IMAGE_SUFFIX: '{{env `BUILT_IMAGE_SUFFIX`}}'
     GOSRC: '{{env `GOSRC`}}'
     PACKER_BASE: '{{env `PACKER_BASE`}}'
     SCRIPT_BASE: '{{env `SCRIPT_BASE`}}'
@@ -41,9 +41,10 @@ builders:
     - &gce_hosted_image
       name: 'ubuntu-18'
       type: 'googlecompute'
-      image_name: '{{user `UBUNTU_BASE_IMAGE`}}-libpod-{{user `CIRRUS_BUILD_ID`}}'
-      image_family: '{{user `UBUNTU_BASE_IMAGE`}}-libpod'
+      image_name: '{{build_name}}{{user `BUILT_IMAGE_SUFFIX`}}'
+      image_family: '{{build_name}}-libpod'
       source_image: '{{user `UBUNTU_BASE_IMAGE`}}'
+      disk_size: 20
       project_id: '{{user `GCP_PROJECT_ID`}}'
       service_account_email: '{{user `SERVICE_ACCOUNT`}}'
       communicator: 'ssh'
@@ -55,17 +56,19 @@ builders:
     #      v----- is a YAML alias, allows partial re-use of the anchor object
     - <<: *gce_hosted_image
       name: 'rhel-7'
-      image_name: '{{user `RHEL_BASE_IMAGE`}}-libpod-{{user `CIRRUS_BUILD_ID`}}'
-      image_family: '{{user `RHEL_BASE_IMAGE`}}-libpod'
       source_image: '{{user `RHEL_BASE_IMAGE`}}'
-      ssh_username: 'ec2-user'
 
     - <<: *gce_hosted_image
       name: 'centos-7'
-      image_family: '{{user `CENTOS_BASE_IMAGE`}}-libpod'
-      image_name: '{{user `CENTOS_BASE_IMAGE`}}-libpod-{{user `CIRRUS_BUILD_ID`}}'
       source_image: '{{user `CENTOS_BASE_IMAGE`}}'
 
+    - <<: *gce_hosted_image
+      name: 'fedora-29'
+      source_image: '{{user `FEDORA_BASE_IMAGE`}}'
+
+    - <<: *gce_hosted_image
+      name: 'fah-29'
+      source_image: '{{user `FAH_BASE_IMAGE`}}'
 
 # The brains of the operation, making actual modifications to the base-image.
 provisioners:
@@ -86,4 +89,3 @@ provisioners:
 
 post-processors:
     - - type: 'manifest'
-        output: '/tmp/packer-manifest.json'
diff --git a/contrib/cirrus/packer/make-user-data.sh b/contrib/cirrus/packer/make-user-data.sh
new file mode 100644
index 000000000..7f7fa1c1a
--- /dev/null
+++ b/contrib/cirrus/packer/make-user-data.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# This script is utilized by Makefile, it's not intended to be run by humans
+
+cat <<EOF > user-data
+#cloud-config
+timezone: US/Eastern
+growpart:
+    mode: auto
+disable_root: false
+ssh_pwauth: True
+ssh_import_id: [root]
+ssh_authorized_keys:
+    - $(cat cidata.ssh.pub)
+users:
+   - name: root
+     primary-group: root
+     homedir: /root
+     system: true
+EOF
diff --git a/contrib/cirrus/packer/rhel_base-setup.sh b/contrib/cirrus/packer/rhel_base-setup.sh
new file mode 100644
index 000000000..8b2073d4f
--- /dev/null
+++ b/contrib/cirrus/packer/rhel_base-setup.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+# N/B: This script is not intended to be run by humans.  It is used to configure the
+# rhel base image for importing, so that it will boot in GCE
+
+set -e
+
+[[ "$1" == "post" ]] || exit 0  # pre stage is not needed
+
+# Load in library (copied by packer, before this script was run)
+source $GOSRC/$SCRIPT_BASE/lib.sh
+
+req_env_var "
+    RHSM_COMMAND $RHSM_COMMAND
+"
+
+install_ooe
+
+echo "Setting up repos"
+# Frequently needed
+ooe.sh sudo yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
+
+# Required for google to manage ssh keys
+ooe.sh sudo tee /etc/yum.repos.d/google-cloud-sdk.repo << EOM
+[google-cloud-compute]
+name=google-cloud-compute
+baseurl=https://packages.cloud.google.com/yum/repos/google-cloud-compute-el7-x86_64
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
+       https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
+EOM
+
+rhsm_enable
+
+echo "Installing/removing packages"
+ooe.sh sudo yum -y install google-compute-engine google-compute-engine-oslogin
+ooe.sh sudo yum -y erase "cloud-init" "rh-amazon-rhui-client*" || true
+ooe.sh sudo systemctl enable \
+    google-accounts-daemon \
+    google-clock-skew-daemon \
+    google-instance-setup \
+    google-network-daemon \
+    google-shutdown-scripts \
+    google-startup-scripts
+
+rhel_exit_handler  # release subscription!
+
+rh_finalize
+
+echo "SUCCESS!"
diff --git a/contrib/cirrus/packer/rhel_setup.sh b/contrib/cirrus/packer/rhel_setup.sh
index d296713fc..7f0d4e589 100644
--- a/contrib/cirrus/packer/rhel_setup.sh
+++ b/contrib/cirrus/packer/rhel_setup.sh
@@ -18,24 +18,7 @@ RHSM_COMMAND $RHSM_COMMAND
 
 install_ooe
 
-export GOPATH="$(mktemp -d)"
-export RHSMCMD="$(mktemp)"
-
-exit_handler() {
-    set +ex
-    cd /
-    sudo rm -rf "$RHSMCMD"
-    sudo rm -rf "$GOPATH"
-    sudo subscription-manager remove --all
-    sudo subscription-manager unregister
-    sudo subscription-manager clean
-}
-trap "exit_handler" EXIT
-
-# Avoid logging sensitive details
-echo "$RHSM_COMMAND" > "$RHSMCMD"
-ooe.sh sudo bash "$RHSMCMD"
-sudo rm -rf "$RHSMCMD"
+rhsm_enable
 
 ooe.sh sudo yum -y erase "rh-amazon-rhui-client*"
 ooe.sh sudo subscription-manager repos "--disable=*"
@@ -47,21 +30,6 @@ ooe.sh sudo subscription-manager repos \
 
 ooe.sh sudo yum -y update
 
-# Frequently needed
-ooe.sh sudo yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
-
-# Required for google to manage ssh keys
-sudo tee -a /etc/yum.repos.d/google-cloud-sdk.repo << EOM
-[google-cloud-compute]
-name=google-cloud-compute
-baseurl=https://packages.cloud.google.com/yum/repos/google-cloud-compute-el7-x86_64
-enabled=1
-gpgcheck=1
-repo_gpgcheck=1
-gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
-       https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
-EOM
-
 ooe.sh sudo yum -y install \
     atomic-registries \
     btrfs-progs-devel \
@@ -74,8 +42,6 @@ ooe.sh sudo yum -y install \
     golang \
     golang-github-cpuguy83-go-md2man \
     golang-github-cpuguy83-go-md2man \
-    google-compute-engine \
-    google-compute-engine-oslogin \
     gpgme-devel \
     iptables \
     libassuan-devel \
@@ -118,7 +84,7 @@ install_criu
 
 install_packer_copied_files
 
-exit_handler  # release subscription!
+rhel_exit_handler  # release subscription!
 
 rh_finalize
 
diff --git a/contrib/cirrus/packer/ubuntu_setup.sh b/contrib/cirrus/packer/ubuntu_setup.sh
index ef209a4a4..6e3613462 100644
--- a/contrib/cirrus/packer/ubuntu_setup.sh
+++ b/contrib/cirrus/packer/ubuntu_setup.sh
@@ -21,6 +21,7 @@ install_ooe
 export GOPATH="$(mktemp -d)"
 trap "sudo rm -rf $GOPATH" EXIT
 
+# Avoid getting stuck waiting for user input
 export DEBIAN_FRONTEND=noninteractive
 
 # Try twice as workaround for minor networking problems
@@ -56,6 +57,8 @@ ooe.sh sudo -E apt-get -qq install --no-install-recommends \
     libostree-dev \
     libprotobuf-c0-dev \
     libprotobuf-dev \
+    libseccomp-dev \
+    libseccomp2 \
     libtool \
     libudev-dev \
     lsof \