Merge pull request #1788 from cevich/cirrus_base_images

Codify and document base-image production + Enable testing with Fedora

15 files changed, 637 insertions, 167 deletions

diff --git a/contrib/cirrus/packer/.gitignore b/contrib/cirrus/packer/.gitignore
new file mode 100644
index 000000000..8f7bdeaf7
--- /dev/null
+++ b/contrib/cirrus/packer/.gitignore
@@ -0,0 +1,7 @@
+*json
+packer
+packer*zip
+packer_cache
+cidata*
+meta-data
+user-data
diff --git a/contrib/cirrus/packer/Makefile b/contrib/cirrus/packer/Makefile
new file mode 100644
index 000000000..9bf27373e
--- /dev/null
+++ b/contrib/cirrus/packer/Makefile
@@ -0,0 +1,108 @@
+
+# N/B: PACKER_BUILDS variable is required.  Should contain CSV of
+# builder name(s) from applicable YAML file,
+# e.g for names see libpod_images.yml
+
+PACKER_VER ?= 1.3.1
+PACKER_DIST_FILENAME := packer_${PACKER_VER}_linux_amd64.zip
+
+# Only needed for libpod_base_images target
+TIMESTAMP := $(shell date +%s)
+GOSRC ?= $(shell realpath "./../../../")
+PACKER_BASE ?= contrib/cirrus/packer
+SCRIPT_BASE ?= contrib/cirrus
+
+# For debugging nested-virt, use
+#TTYDEV := $(shell tty)
+TTYDEV := /dev/null
+
+.PHONY: all
+all: libpod_images
+
+%.json: %.yml
+	@python3 -c 'import json,yaml; json.dump( yaml.load(open("$<").read()), open("$@","w"), indent=2);'
+
+${PACKER_DIST_FILENAME}:
+	@curl -L --silent --show-error \
+		-O https://releases.hashicorp.com/packer/${PACKER_VER}/${PACKER_DIST_FILENAME}
+
+packer: ${PACKER_DIST_FILENAME}
+	@curl -L --silent --show-error \
+		https://releases.hashicorp.com/packer/${PACKER_VER}/packer_${PACKER_VER}_SHA256SUMS \
+		| grep 'linux_amd64' > /tmp/packer_sha256sums
+	@sha256sum --check /tmp/packer_sha256sums
+	@unzip -o ${PACKER_DIST_FILENAME}
+	@touch --reference=Makefile ${PACKER_DIST_FILENAME}
+
+.PHONY: test
+test: libpod_base_images.json libpod_images.json packer
+	./packer inspect libpod_base_images.json > /dev/null
+	./packer inspect libpod_images.json > /dev/null
+	@echo "All good"
+
+.PHONY: libpod_images
+libpod_images: libpod_images.json packer
+ifndef PACKER_BUILDS
+	$(error PACKER_BUILDS is undefined, expected builder-names CSV)
+endif
+	./packer build -only=${PACKER_BUILDS} \
+		-var GOSRC=$(GOSRC) \
+		-var PACKER_BASE=$(PACKER_BASE) \
+		-var SCRIPT_BASE=$(SCRIPT_BASE) \
+		libpod_images.json
+	@echo ""
+	@echo "Finished.  The images mentioned above, and in packer-manifest.json"
+	@echo "can be used in .cirrus.yml as values for the 'image_name' keys"
+	@echo ""
+
+cidata.ssh:
+	ssh-keygen -f $@ -P "" -q
+
+cidata.ssh.pub: cidata.ssh
+	touch $@
+
+meta-data:
+	echo "local-hostname: localhost.localdomain" > $@
+
+user-data: cidata.ssh.pub
+	bash make-user-data.sh
+
+cidata.iso: user-data meta-data
+	genisoimage -output cidata.iso -volid cidata -input-charset utf-8 -joliet -rock user-data meta-data
+
+# This is intended to be run by a human, with admin access to the libpod GCE project.
+.PHONY: libpod_base_images
+libpod_base_images: libpod_base_images.json cidata.iso cidata.ssh packer
+ifndef GCP_PROJECT_ID
+	$(error GCP_PROJECT_ID is undefined, expected complete GCP project ID string e.g. foobar-12345)
+endif
+ifndef GOOGLE_APPLICATION_CREDENTIALS
+	$(error GOOGLE_APPLICATION_CREDENTIALS is undefined, expected absolute path to JSON file, like $HOME/.config/gcloud/legacy_credentials/*/adc.json)
+endif
+ifndef RHEL_IMAGE_FILE
+	$(error RHEL_IMAGE_FILE is undefined, expected full path to a rhel-server-ec2-*.raw.xz file)
+endif
+ifndef RHEL_CSUM_FILE
+	$(error RHEL_CSUM_FILE is undefined, expected full path to a rhel-server-ec2-*.raw.xz.SHA256SUM file)
+endif
+ifndef RHSM_COMMAND
+	$(error RHSM_COMMAND is undefined, expected string required for temporarily registering VM)
+endif
+	PACKER_CACHE_DIR=/tmp ./packer build \
+		-var TIMESTAMP=$(TIMESTAMP) \
+		-var TTYDEV=$(TTYDEV) \
+		-var GCP_PROJECT_ID=$(GCP_PROJECT_ID) \
+		-var GOOGLE_APPLICATION_CREDENTIALS=$(GOOGLE_APPLICATION_CREDENTIALS) \
+		-var GOSRC=$(GOSRC) \
+		-var PACKER_BASE=$(PACKER_BASE) \
+		-var SCRIPT_BASE=$(SCRIPT_BASE) \
+		-var RHEL_BASE_IMAGE_NAME=$(shell basename $(RHEL_IMAGE_FILE) | tr -d '[[:space:]]' | sed -r -e 's/\.x86_64\.raw\.xz//' | tr '[[:upper:]]' '[[:lower:]]' | tr '[[:punct:]]' '-') \
+		-var RHEL_IMAGE_FILE=$(RHEL_IMAGE_FILE) \
+		-var RHEL_CSUM_FILE=$(RHEL_CSUM_FILE) \
+	    -var 'RHSM_COMMAND=$(RHSM_COMMAND)' \
+		-only $(PACKER_BUILDS) \
+		libpod_base_images.json
+	@echo ""
+	@echo "Finished.  The images mentioned above, and in packer-manifest.json"
+	@echo "can be used in .cirrus.yml as values for the *_BASE_IMAGE keys."
+	@echo ""
diff --git a/contrib/cirrus/packer/README.md b/contrib/cirrus/packer/README.md
index 8ff6947e9..9a07ed960 100644
--- a/contrib/cirrus/packer/README.md
+++ b/contrib/cirrus/packer/README.md
@@ -1,2 +1,3 @@
 These are definitions and scripts consumed by packer to produce the
-various distribution images used for CI testing.
+various distribution images used for CI testing.  For more details
+see the [Cirrus CI documentation](../README.md)
diff --git a/contrib/cirrus/packer/fah_base-setup.sh b/contrib/cirrus/packer/fah_base-setup.sh
new file mode 100644
index 000000000..606c4f336
--- /dev/null
+++ b/contrib/cirrus/packer/fah_base-setup.sh
@@ -0,0 +1,45 @@
+
+# N/B: This script is not intended to be run by humans.  It is used to configure the
+# FAH base image for importing, so that it will boot in GCE.
+
+set -e
+
+# Load in library (copied by packer, before this script was run)
+source $GOSRC/$SCRIPT_BASE/lib.sh
+
+install_ooe
+
+if [[ "$1" == "pre" ]]
+then
+    echo "Upgrading Atomic Host"
+    setenforce 0
+    ooe.sh atomic host upgrade
+
+    echo "Configuring Repositories"
+    ooe.sh sudo tee /etc/yum.repos.d/ngompa-gce-oslogin.repo <<EOF
+[ngompa-gce-oslogin]
+name=Copr repo for gce-oslogin owned by ngompa
+baseurl=https://copr-be.cloud.fedoraproject.org/results/ngompa/gce-oslogin/fedora-\$releasever-\$basearch/
+type=rpm-md
+skip_if_unavailable=True
+gpgcheck=1
+gpgkey=https://copr-be.cloud.fedoraproject.org/results/ngompa/gce-oslogin/pubkey.gpg
+repo_gpgcheck=0
+enabled=1
+enabled_metadata=1
+EOF
+    echo "Installing necessary packages and  google services"
+    # Google services are enabled by default, upon install.
+    ooe.sh rpm-ostree install rng-tools google-compute-engine google-compute-engine-oslogin
+    echo "Rebooting..."
+    systemctl reboot  # Required for upgrade + package installs to be active
+elif [[ "$1" == "post" ]]
+then
+    echo "Enabling necessary services"
+    systemctl enable rngd  # Must reboot before enabling
+    rh_finalize
+    echo "SUCCESS!"
+else
+    echo "Expected to be called with 'pre' or 'post'"
+    exit 6
+fi
diff --git a/contrib/cirrus/packer/fah_setup.sh b/contrib/cirrus/packer/fah_setup.sh
new file mode 100644
index 000000000..2e053b396
--- /dev/null
+++ b/contrib/cirrus/packer/fah_setup.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# This script is called by packer on the subject fah VM, to setup the podman
+# build/test environment.  It's not intended to be used outside of this context.
+
+set -e
+
+# Load in library (copied by packer, before this script was run)
+source /tmp/libpod/$SCRIPT_BASE/lib.sh
+
+req_env_var "
+SCRIPT_BASE $SCRIPT_BASE
+"
+
+install_ooe
+
+ooe.sh sudo atomic host upgrade
+
+ooe.sh sudo rpm-ostree uninstall cloud-init
+
+rh_finalize
+
+echo "SUCCESS!"
diff --git a/contrib/cirrus/packer/fedora_base-setup.sh b/contrib/cirrus/packer/fedora_base-setup.sh
new file mode 100644
index 000000000..c0a1e422c
--- /dev/null
+++ b/contrib/cirrus/packer/fedora_base-setup.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+# N/B: This script is not intended to be run by humans.  It is used to configure the
+# fedora base image for importing, so that it will boot in GCE
+
+set -e
+
+# Load in library (copied by packer, before this script was run)
+source $GOSRC/$SCRIPT_BASE/lib.sh
+
+[[ "$1" == "post" ]] || exit 0  # nothing to do
+
+install_ooe
+
+echo "Updating packages"
+ooe.sh dnf -y update
+
+echo "Installing necessary packages and  google services"
+ooe.sh dnf -y copr enable ngompa/gce-oslogin
+ooe.sh dnf -y install rng-tools google-compute-engine google-compute-engine-oslogin
+
+echo "Enabling services"
+ooe.sh systemctl enable rngd
+
+rh_finalize
+
+echo "SUCCESS!"
diff --git a/contrib/cirrus/packer/fedora_setup.sh b/contrib/cirrus/packer/fedora_setup.sh
index f9fea04a7..4e4391e59 100644
--- a/contrib/cirrus/packer/fedora_setup.sh
+++ b/contrib/cirrus/packer/fedora_setup.sh
@@ -10,6 +10,7 @@ source /tmp/libpod/$SCRIPT_BASE/lib.sh
 
 req_env_var "
 SCRIPT_BASE $SCRIPT_BASE
+FEDORA_CNI_COMMIT $FEDORA_CNI_COMMIT
 CNI_COMMIT $CNI_COMMIT
 CRIO_COMMIT $CRIO_COMMIT
 CRIU_COMMIT $CRIU_COMMIT
@@ -65,11 +66,13 @@ ooe.sh sudo dnf install -y \
     runc \
     skopeo-containers \
     slirp4netns \
+    unzip \
     which \
     xz
 
 install_varlink
 
+CNI_COMMIT=$FEDORA_CNI_COMMIT
 install_cni_plugins
 
 install_buildah
diff --git a/contrib/cirrus/packer/image-builder-image_base-setup.sh b/contrib/cirrus/packer/image-builder-image_base-setup.sh
new file mode 100644
index 000000000..b8e2824a7
--- /dev/null
+++ b/contrib/cirrus/packer/image-builder-image_base-setup.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+
+# This script is called by packer on a vanilla CentOS VM, to setup the image
+# used for building images FROM base images. It's not intended to be used
+# outside of this context.
+
+set -e
+
+[[ "$1" == "post" ]] || exit 0  # pre stage not needed
+
+# Load in library (copied by packer, before this script was run)
+source $GOSRC/$SCRIPT_BASE/lib.sh
+
+req_env_var "
+    TIMESTAMP $TIMESTAMP
+    GOSRC $GOSRC
+    SCRIPT_BASE $SCRIPT_BASE
+    PACKER_BASE $PACKER_BASE
+"
+
+install_ooe
+
+echo "Updating packages"
+ooe.sh sudo yum -y update
+
+echo "Configuring repositories"
+ooe.sh sudo yum -y install centos-release-scl epel-release
+
+echo "Installing packages"
+ooe.sh sudo yum -y install \
+    genisoimage \
+    golang \
+    google-cloud-sdk \
+    libvirt \
+    libvirt-admin \
+    libvirt-client \
+    libvirt-daemon \
+    make \
+    python34 \
+    python34 \
+    python34-PyYAML \
+    python34-PyYAML \
+    qemu-img \
+    qemu-kvm \
+    qemu-kvm-tools \
+    qemu-user \
+    rsync \
+    unzip \
+    util-linux \
+    vim
+
+sudo ln -s /usr/libexec/qemu-kvm /usr/bin/
+
+sudo tee /etc/modprobe.d/kvm-nested.conf <<EOF
+options kvm-intel nested=1
+options kvm-intel enable_shadow_vmcs=1
+options kvm-intel enable_apicv=1
+options kvm-intel ept=1
+EOF
+
+echo "Installing packer"
+sudo mkdir -p /root/$(basename $PACKER_BASE)
+sudo cp $GOSRC/$PACKER_BASE/*packer* /root/$(basename $PACKER_BASE)
+sudo mkdir -p /root/$(basename $SCRIPT_BASE)
+sudo cp $GOSRC/$SCRIPT_BASE/*.sh /root/$(basename $SCRIPT_BASE)
+
+install_scl_git
+
+echo "Cleaning up"
+cd /
+rm -rf $GOSRC
+
+rh_finalize
+
+echo "SUCCESS!"
diff --git a/contrib/cirrus/packer/libpod_base_images.yml b/contrib/cirrus/packer/libpod_base_images.yml
new file mode 100644
index 000000000..4ae44e0d9
--- /dev/null
+++ b/contrib/cirrus/packer/libpod_base_images.yml
@@ -0,0 +1,179 @@
+---
+
+variables:
+    # Complete local path to this repository (Required)
+    GOSRC:
+    # Relative path to this (packer) subdirectory (Required)
+    PACKER_BASE:
+    # Relative path to cirrus scripts subdirectory (Required)
+    SCRIPT_BASE:
+    # Unique ID for naming new base-images (required)
+    TIMESTAMP:
+    # Required for output from qemu builders
+    TTYDEV:
+    # RHEL images require click-through agreements to obtain (required)
+    RHEL_BASE_IMAGE_NAME:
+    RHEL_IMAGE_FILE:
+    RHEL_CSUM_FILE:
+    # RHEL requires a subscription to install/update packages
+    RHSM_COMMAND:
+
+    # Fedora images are obtainable by direct download
+    FEDORA_IMAGE_URL: "https://dl.fedoraproject.org/pub/fedora/linux/releases/29/Cloud/x86_64/images/Fedora-Cloud-Base-29-1.2.x86_64.qcow2"
+    FEDORA_CSUM_URL: "https://dl.fedoraproject.org/pub/fedora/linux/releases/29/Cloud/x86_64/images/Fedora-Cloud-29-1.2-x86_64-CHECKSUM"
+    FEDORA_BASE_IMAGE_NAME: 'fedora-cloud-base-29-1-2'  # Name to use in GCE
+    FAH_IMAGE_URL: "https://dl.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-29-20181025.1/AtomicHost/x86_64/images/Fedora-AtomicHost-29-20181025.1.x86_64.qcow2"
+    FAH_CSUM_URL: "https://dl.fedoraproject.org/pub/alt/atomic/stable/Fedora-Atomic-29-20181025.1/AtomicHost/x86_64/images/Fedora-AtomicHost-29-20181025.1-x86_64-CHECKSUM"
+    FAH_BASE_IMAGE_NAME: 'fedora-atomichost-29-20181025-1'  # Name to use in GCE
+
+    # The name of the image in GCE used for packer build libpod_images.yml
+    IBI_BASE_NAME: 'image-builder-image'
+    CIDATA_ISO: 'cidata.iso'  # produced by Makefile
+
+    # Path to json file (required, likely ~/.config/gcloud/legacy_credentials/*/adc.json)
+    GOOGLE_APPLICATION_CREDENTIALS:
+    # The complete project ID (required, not the short name)
+    GCP_PROJECT_ID:
+    # Pre-existing storage bucket w/ lifecycle-enabled
+    XFERBUCKET: "packer-import"  # pre-created, globally unique, lifecycle-enabled
+
+# Don't leak sensitive values in error messages / output
+sensitive-variables:
+    - 'GOOGLE_APPLICATION_CREDENTIALS'
+    - 'GCP_PROJECT_ID'
+    - 'RHSM_COMMAND'
+
+# What images to produce in which cloud
+builders:
+    - name: '{{user `IBI_BASE_NAME`}}'
+      type: 'googlecompute'
+      image_name: '{{user `IBI_BASE_NAME`}}-{{user `TIMESTAMP`}}'
+      image_family: '{{user `IBI_BASE_NAME`}}'
+      source_image_project_id: 'centos-cloud'
+      source_image_family: 'centos-7'
+      project_id: '{{user `GCP_PROJECT_ID`}}'
+      account_file: '{{user `GOOGLE_APPLICATION_CREDENTIALS`}}'
+      communicator: 'ssh'
+      ssh_username: 'centos'
+      ssh_pty: 'true'
+      # The only supported zone in Cirrus-CI, as of addition of this comment
+      zone: 'us-central1-a'
+      # Enable nested virtualization in case it's ever needed
+      image_licenses:
+        - 'https://www.googleapis.com/compute/v1/projects/vm-options/global/licenses/enable-vmx'
+      min_cpu_platform: "Intel Broadwell"  # nested-virt requirement
+
+    - &nested_virt
+      name: 'fedora'
+      type: 'qemu'
+      accelerator: "kvm"
+      iso_url: '{{user `FEDORA_IMAGE_URL`}}'
+      disk_image: true
+      format: "raw"
+      disk_size: 5120
+      iso_checksum_url: '{{user `FEDORA_CSUM_URL`}}'
+      iso_checksum_type: "sha256"
+      output_directory: '/tmp/{{build_name}}'
+      vm_name: "disk.raw"  # actually qcow2, name required for post-processing
+      boot_wait: '5s'
+      shutdown_command: 'shutdown -h now'
+      headless: true
+      qemu_binary: "/usr/libexec/qemu-kvm"
+      qemuargs:  # List-of-list format required to override packer-generated args
+        - - "-m"
+          - "1024"
+        - - "-cpu"
+          - "host"
+        - - "-device"
+          - "virtio-rng-pci"
+        - - "-chardev"
+          - "tty,id=pts,path={{user `TTYDEV`}}"
+        - - "-device"
+          - "isa-serial,chardev=pts"
+        - - "-cdrom"
+          - "{{user `CIDATA_ISO`}}"
+        - - "-netdev"
+          - "user,id=net0,hostfwd=tcp::{{ .SSHHostPort }}-:22"
+        - - "-device"
+          - "virtio-net,netdev=net0"
+      communicator: 'ssh'
+      ssh_private_key_file: 'cidata.ssh'
+      ssh_username: 'root'
+
+    - <<: *nested_virt
+      name: 'fah'
+      iso_url: '{{user `FAH_IMAGE_URL`}}'
+      iso_checksum_url: '{{user `FAH_CSUM_URL`}}'
+      disk_size: 10240
+
+    - <<: *nested_virt
+      name: 'rhel'
+      iso_url: 'file://{{user `RHEL_IMAGE_FILE`}}'
+      iso_checksum_url: 'file://{{user `RHEL_CSUM_FILE`}}'
+      disk_size: 10240
+
+provisioners:
+    - type: 'shell'
+      inline:
+        - 'mkdir -p /tmp/libpod/{{user `SCRIPT_BASE`}}'
+        - 'mkdir -p /tmp/libpod/{{user `PACKER_BASE`}}'
+
+    - type: 'file'
+      source: '{{user `GOSRC`}}/.cirrus.yml'
+      destination: '/tmp/libpod/.cirrus.yml'
+
+    - type: 'file'
+      source: '{{user `GOSRC`}}/{{user `SCRIPT_BASE`}}/'
+      destination: '/tmp/libpod/{{user `SCRIPT_BASE`}}/'
+
+    - type: 'file'
+      source: '{{user `GOSRC`}}/{{user `PACKER_BASE`}}/'
+      destination: '/tmp/libpod/{{user `PACKER_BASE`}}/'
+
+    - &shell_script
+      type: 'shell'
+      inline:
+        - 'chmod +x /tmp/libpod/{{user `PACKER_BASE`}}/{{build_name}}_base-setup.sh'
+        - '/tmp/libpod/{{user `PACKER_BASE`}}/{{build_name}}_base-setup.sh pre'
+      expect_disconnect: true  # Allow this to reboot the VM
+      environment_vars:
+          - 'TIMESTAMP={{user `TIMESTAMP`}}'
+          - 'GOSRC=/tmp/libpod'
+          - 'SCRIPT_BASE={{user `SCRIPT_BASE`}}'
+          - 'PACKER_BASE={{user `PACKER_BASE`}}'
+          - 'RHSM_COMMAND={{user `RHSM_COMMAND`}}'
+
+    - <<: *shell_script
+      inline: ['{{user `GOSRC`}}/{{user `PACKER_BASE`}}/{{build_name}}_base-setup.sh']
+      expect_disconnect: false
+      pause_before: '10s'
+      inline:
+        - '/tmp/libpod/{{user `PACKER_BASE`}}/{{build_name}}_base-setup.sh post'
+
+post-processors:
+    - - type: "compress"
+        only: ['fedora', 'fah', 'rhel']
+        output: '/tmp/{{build_name}}/disk.raw.tar.gz'
+        format: '.tar.gz'
+        compression_level: 9
+      - &gcp_import
+        only: ['fedora']
+        type: "googlecompute-import"
+        project_id: '{{user `GCP_PROJECT_ID`}}'
+        account_file: '{{user `GOOGLE_APPLICATION_CREDENTIALS`}}'
+        bucket: '{{user `XFERBUCKET`}}'
+        gcs_object_name: '{{build_name}}-{{user `TIMESTAMP`}}-{{uuid}}.tar.gz'
+        image_name: "{{user `FEDORA_BASE_IMAGE_NAME`}}-{{user `TIMESTAMP`}}"
+        image_description: 'Based on {{user `FEDORA_IMAGE_URL`}}'
+        image_family: '{{user `FEDORA_BASE_IMAGE_NAME`}}'
+      - <<: *gcp_import
+        only: ['fah']
+        image_name: "{{user `FAH_BASE_IMAGE_NAME`}}-{{user `TIMESTAMP`}}"
+        image_description: 'Based on {{user `FAH_IMAGE_URL`}}'
+        image_family: '{{user `FAH_BASE_IMAGE_NAME`}}'
+      - <<: *gcp_import
+        only: ['rhel']
+        image_name: "{{user `RHEL_BASE_IMAGE_NAME`}}-{{user `TIMESTAMP`}}"
+        image_description: 'Based on {{user `RHEL_IMAGE_FILE`}}'
+        image_family: '{{user `RHEL_BASE_IMAGE_NAME`}}'
+      - type: 'manifest'
diff --git a/contrib/cirrus/packer/libpod_images.json b/contrib/cirrus/packer/libpod_images.json
deleted file mode 100644
index 9dac3e8ea..000000000
--- a/contrib/cirrus/packer/libpod_images.json
+++ /dev/null
@@ -1,130 +0,0 @@
-{
-  "variables": {
-    "FEDORA_CNI_COMMIT": "{{env `FEDORA_CNI_COMMIT`}}",
-    "CNI_COMMIT": "{{env `CNI_COMMIT`}}",
-    "CRIO_COMMIT": "{{env `CRIO_COMMIT`}}",
-    "CRIU_COMMIT": "{{env `CRIU_COMMIT`}}",
-    "RUNC_COMMIT": "{{env `RUNC_COMMIT`}}",
-
-    "CENTOS_BASE_IMAGE": "{{env `CENTOS_BASE_IMAGE`}}" ,
-    "UBUNTU_BASE_IMAGE": "{{env `UBUNTU_BASE_IMAGE`}}",
-    "FEDORA_BASE_IMAGE": "{{env `FEDORA_BASE_IMAGE`}}",
-    "RHEL_BASE_IMAGE": "{{env `RHEL_BASE_IMAGE`}}",
-
-    "GOSRC": "{{env `GOSRC`}}",
-    "PACKER_BASE": "{{env `PACKER_BASE`}}",
-    "SCRIPT_BASE": "{{env `SCRIPT_BASE`}}",
-
-    "SERVICE_ACCOUNT": "{{env `SERVICE_ACCOUNT`}}",
-    "GCP_PROJECT_ID": "{{env `GCP_PROJECT_ID`}}",
-    "BUILT_IMAGE_SUFFIX": "{{env `BUILT_IMAGE_SUFFIX`}}",
-    "GCE_SSH_USERNAME": "{{env `GCE_SSH_USERNAME`}}",
-    "RHSM_COMMAND": "{{env `RHSM_COMMAND`}}"
-  },
-  "sensitive-variables": [
-    "GCP_PROJECT_ID", "SERVICE_ACCOUNT", "GCE_SSH_USERNAME", "RHSM_COMMAND"
-  ],
-  "builders": [
-    {
-      "name": "rhel-7",
-      "type": "googlecompute",
-      "project_id": "{{user `GCP_PROJECT_ID`}}",
-      "zone": "us-central1-a",
-      "source_image": "{{user `RHEL_BASE_IMAGE`}}",
-      "image_name": "{{user `RHEL_BASE_IMAGE`}}{{user `BUILT_IMAGE_SUFFIX`}}",
-      "image_family": "{{user `RHEL_BASE_IMAGE`}}-libpod",
-      "service_account_email": "{{user `SERVICE_ACCOUNT`}}",
-      "communicator": "ssh",
-      "ssh_username": "ec2-user",
-      "ssh_pty": "true"
-    },{
-      "name": "centos-7",
-      "type": "googlecompute",
-      "project_id": "{{user `GCP_PROJECT_ID`}}",
-      "zone": "us-central1-a",
-      "source_image": "{{user `CENTOS_BASE_IMAGE`}}",
-      "image_name": "{{user `CENTOS_BASE_IMAGE`}}{{user `BUILT_IMAGE_SUFFIX`}}",
-      "image_family": "{{user `CENTOS_BASE_IMAGE`}}-libpod",
-      "service_account_email": "{{user `SERVICE_ACCOUNT`}}",
-      "communicator": "ssh",
-      "ssh_username": "{{user `GCE_SSH_USERNAME`}}",
-      "ssh_pty": "true"
-    },{
-      "name": "fedora-28",
-      "type": "googlecompute",
-      "project_id": "{{user `GCP_PROJECT_ID`}}",
-      "zone": "us-central1-a",
-      "source_image": "{{user `FEDORA_BASE_IMAGE`}}",
-      "image_name": "{{user `FEDORA_BASE_IMAGE`}}{{user `BUILT_IMAGE_SUFFIX`}}",
-      "image_family": "{{user `FEDORA_BASE_IMAGE`}}-libpod",
-      "service_account_email": "{{user `SERVICE_ACCOUNT`}}",
-      "communicator": "ssh",
-      "ssh_username": "fedora",
-      "ssh_pty": "true"
-    },{
-      "name": "ubuntu-18",
-      "type": "googlecompute",
-      "project_id": "{{user `GCP_PROJECT_ID`}}",
-      "zone": "us-central1-a",
-      "source_image": "{{user `UBUNTU_BASE_IMAGE`}}",
-      "image_name": "{{user `UBUNTU_BASE_IMAGE`}}{{user `BUILT_IMAGE_SUFFIX`}}",
-      "image_family": "{{user `UBUNTU_BASE_IMAGE`}}-libpod",
-      "service_account_email": "{{user `SERVICE_ACCOUNT`}}",
-      "communicator": "ssh",
-      "ssh_username": "{{user `GCE_SSH_USERNAME`}}",
-      "ssh_pty": "true"
-    }
-  ],
-  "provisioners": [
-    {
-      "type": "file",
-      "source": "{{user `GOSRC`}}",
-      "destination": "/tmp/libpod"
-    },{
-      "type": "shell",
-      "only": ["rhel-7"],
-      "script": "{{user `GOSRC`}}/{{user `PACKER_BASE`}}/rhel_setup.sh",
-      "environment_vars": [
-        "SCRIPT_BASE={{user `SCRIPT_BASE`}}",
-        "CNI_COMMIT={{user `CNI_COMMIT`}}",
-        "CRIO_COMMIT={{user `CRIO_COMMIT`}}",
-        "CRIU_COMMIT={{user `CRIU_COMMIT`}}",
-        "RUNC_COMMIT={{user `RUNC_COMMIT`}}",
-        "RHSM_COMMAND={{user `RHSM_COMMAND`}}"
-      ]
-    },{
-      "type": "shell",
-      "only": ["centos-7"],
-      "script": "{{user `GOSRC`}}/{{user `PACKER_BASE`}}/centos_setup.sh",
-      "environment_vars": [
-        "SCRIPT_BASE={{user `SCRIPT_BASE`}}",
-        "CNI_COMMIT={{user `CNI_COMMIT`}}",
-        "CRIO_COMMIT={{user `CRIO_COMMIT`}}",
-        "CRIU_COMMIT={{user `CRIU_COMMIT`}}",
-        "RUNC_COMMIT={{user `RUNC_COMMIT`}}"
-      ]
-    },{
-      "type": "shell",
-      "only": ["fedora-28"],
-      "script": "{{user `GOSRC`}}/{{user `PACKER_BASE`}}/fedora_setup.sh",
-      "environment_vars": [
-        "SCRIPT_BASE={{user `SCRIPT_BASE`}}",
-        "CNI_COMMIT={{user `FEDORA_CNI_COMMIT`}}",
-        "CRIO_COMMIT={{user `CRIO_COMMIT`}}",
-        "CRIU_COMMIT={{user `CRIU_COMMIT`}}",
-        "RUNC_COMMIT={{user `RUNC_COMMIT`}}"
-      ]
-    },{
-      "type": "shell",
-      "only": ["ubuntu-18"],
-      "script": "{{user `GOSRC`}}/{{user `PACKER_BASE`}}/ubuntu_setup.sh",
-      "environment_vars": [
-        "SCRIPT_BASE={{user `SCRIPT_BASE`}}",
-        "CNI_COMMIT={{user `CNI_COMMIT`}}",
-        "CRIO_COMMIT={{user `CRIO_COMMIT`}}",
-        "CRIU_COMMIT={{user `CRIU_COMMIT`}}",
-        "RUNC_COMMIT={{user `RUNC_COMMIT`}}"
-      ]
-    }
-  ]
-}
diff --git a/contrib/cirrus/packer/libpod_images.yml b/contrib/cirrus/packer/libpod_images.yml
new file mode 100644
index 000000000..7b95b08cc
--- /dev/null
+++ b/contrib/cirrus/packer/libpod_images.yml
@@ -0,0 +1,91 @@
+---
+
+# All of these are required
+variables:
+    # Names of GCE Base images to start from, in .cirrus.yml
+    RHEL_BASE_IMAGE: '{{env `RHEL_BASE_IMAGE`}}'
+    CENTOS_BASE_IMAGE: '{{env `CENTOS_BASE_IMAGE`}}'
+    UBUNTU_BASE_IMAGE: '{{env `UBUNTU_BASE_IMAGE`}}'
+    FEDORA_BASE_IMAGE: '{{env `FEDORA_BASE_IMAGE`}}'
+    FAH_BASE_IMAGE: '{{env `FAH_BASE_IMAGE`}}'
+
+    # libpod dependencies to build and install into images
+    FEDORA_CNI_COMMIT: "{{env `FEDORA_CNI_COMMIT`}}"
+    CNI_COMMIT: "{{env `CNI_COMMIT`}}"
+    CRIO_COMMIT: "{{env `CRIO_COMMIT`}}"
+    CRIU_COMMIT: "{{env `CRIU_COMMIT`}}"
+    RUNC_COMMIT: "{{env `RUNC_COMMIT`}}"
+
+    BUILT_IMAGE_SUFFIX: '{{env `BUILT_IMAGE_SUFFIX`}}'
+    GOSRC: '{{env `GOSRC`}}'
+    PACKER_BASE: '{{env `PACKER_BASE`}}'
+    SCRIPT_BASE: '{{env `SCRIPT_BASE`}}'
+
+    # Protected credentials, decrypted by Cirrus at runtime
+    GCE_SSH_USERNAME: '{{env `GCE_SSH_USERNAME`}}'
+    GCP_PROJECT_ID: '{{env `GCP_PROJECT_ID`}}'
+    RHSM_COMMAND: '{{env `RHSM_COMMAND`}}'
+    SERVICE_ACCOUNT: '{{env `SERVICE_ACCOUNT`}}'
+    GOOGLE_APPLICATION_CREDENTIALS: '{{env `GOOGLE_APPLICATION_CREDENTIALS`}}'
+
+# Don't leak sensitive values in error messages / output
+sensitive-variables:
+    - 'GCE_SSH_USERNAME'
+    - 'GCP_PROJECT_ID'
+    - 'RHSM_COMMAND'
+    - 'SERVICE_ACCOUNT'
+
+# What images to produce in which cloud
+builders:
+    #  v----- is a YAML anchor, allows referencing this object by name (below)
+    - &gce_hosted_image
+      name: 'ubuntu-18'
+      type: 'googlecompute'
+      image_name: '{{build_name}}{{user `BUILT_IMAGE_SUFFIX`}}'
+      image_family: '{{build_name}}-libpod'
+      source_image: '{{user `UBUNTU_BASE_IMAGE`}}'
+      disk_size: 20
+      project_id: '{{user `GCP_PROJECT_ID`}}'
+      service_account_email: '{{user `SERVICE_ACCOUNT`}}'
+      communicator: 'ssh'
+      ssh_username: '{{user `GCE_SSH_USERNAME`}}'
+      ssh_pty: 'true'
+      # The only supported zone in Cirrus-CI, as of addition of this comment
+      zone: 'us-central1-a'
+
+    #      v----- is a YAML alias, allows partial re-use of the anchor object
+    - <<: *gce_hosted_image
+      name: 'rhel-7'
+      source_image: '{{user `RHEL_BASE_IMAGE`}}'
+
+    - <<: *gce_hosted_image
+      name: 'centos-7'
+      source_image: '{{user `CENTOS_BASE_IMAGE`}}'
+
+    - <<: *gce_hosted_image
+      name: 'fedora-29'
+      source_image: '{{user `FEDORA_BASE_IMAGE`}}'
+
+    - <<: *gce_hosted_image
+      name: 'fah-29'
+      source_image: '{{user `FAH_BASE_IMAGE`}}'
+
+# The brains of the operation, making actual modifications to the base-image.
+provisioners:
+    - type: 'file'
+      source: '{{user `GOSRC`}}'
+      destination: '/tmp/libpod'
+
+    - type: 'shell'
+      script: '{{user `GOSRC`}}/{{user `PACKER_BASE`}}/{{split build_name "-" 0}}_setup.sh'
+      environment_vars:
+          - 'SCRIPT_BASE={{user `SCRIPT_BASE`}}'
+          - 'CNI_COMMIT={{user `CNI_COMMIT`}}'
+          - 'FEDORA_CNI_COMMIT={{user `FEDORA_CNI_COMMIT`}}'
+          - 'CRIO_COMMIT={{user `CRIO_COMMIT`}}'
+          - 'CRIU_COMMIT={{user `CRIU_COMMIT`}}'
+          - 'RUNC_COMMIT={{user `RUNC_COMMIT`}}'
+          - 'RHSM_COMMAND={{user `RHSM_COMMAND`}}'
+
+post-processors:
+    - - type: 'manifest'
diff --git a/contrib/cirrus/packer/make-user-data.sh b/contrib/cirrus/packer/make-user-data.sh
new file mode 100644
index 000000000..7f7fa1c1a
--- /dev/null
+++ b/contrib/cirrus/packer/make-user-data.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# This script is utilized by Makefile, it's not intended to be run by humans
+
+cat <<EOF > user-data
+#cloud-config
+timezone: US/Eastern
+growpart:
+    mode: auto
+disable_root: false
+ssh_pwauth: True
+ssh_import_id: [root]
+ssh_authorized_keys:
+    - $(cat cidata.ssh.pub)
+users:
+   - name: root
+     primary-group: root
+     homedir: /root
+     system: true
+EOF
diff --git a/contrib/cirrus/packer/rhel_base-setup.sh b/contrib/cirrus/packer/rhel_base-setup.sh
new file mode 100644
index 000000000..8b2073d4f
--- /dev/null
+++ b/contrib/cirrus/packer/rhel_base-setup.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+# N/B: This script is not intended to be run by humans.  It is used to configure the
+# rhel base image for importing, so that it will boot in GCE
+
+set -e
+
+[[ "$1" == "post" ]] || exit 0  # pre stage is not needed
+
+# Load in library (copied by packer, before this script was run)
+source $GOSRC/$SCRIPT_BASE/lib.sh
+
+req_env_var "
+    RHSM_COMMAND $RHSM_COMMAND
+"
+
+install_ooe
+
+echo "Setting up repos"
+# Frequently needed
+ooe.sh sudo yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
+
+# Required for google to manage ssh keys
+ooe.sh sudo tee /etc/yum.repos.d/google-cloud-sdk.repo << EOM
+[google-cloud-compute]
+name=google-cloud-compute
+baseurl=https://packages.cloud.google.com/yum/repos/google-cloud-compute-el7-x86_64
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
+       https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
+EOM
+
+rhsm_enable
+
+echo "Installing/removing packages"
+ooe.sh sudo yum -y install google-compute-engine google-compute-engine-oslogin
+ooe.sh sudo yum -y erase "cloud-init" "rh-amazon-rhui-client*" || true
+ooe.sh sudo systemctl enable \
+    google-accounts-daemon \
+    google-clock-skew-daemon \
+    google-instance-setup \
+    google-network-daemon \
+    google-shutdown-scripts \
+    google-startup-scripts
+
+rhel_exit_handler  # release subscription!
+
+rh_finalize
+
+echo "SUCCESS!"
diff --git a/contrib/cirrus/packer/rhel_setup.sh b/contrib/cirrus/packer/rhel_setup.sh
index d296713fc..7f0d4e589 100644
--- a/contrib/cirrus/packer/rhel_setup.sh
+++ b/contrib/cirrus/packer/rhel_setup.sh
@@ -18,24 +18,7 @@ RHSM_COMMAND $RHSM_COMMAND
 
 install_ooe
 
-export GOPATH="$(mktemp -d)"
-export RHSMCMD="$(mktemp)"
-
-exit_handler() {
-    set +ex
-    cd /
-    sudo rm -rf "$RHSMCMD"
-    sudo rm -rf "$GOPATH"
-    sudo subscription-manager remove --all
-    sudo subscription-manager unregister
-    sudo subscription-manager clean
-}
-trap "exit_handler" EXIT
-
-# Avoid logging sensitive details
-echo "$RHSM_COMMAND" > "$RHSMCMD"
-ooe.sh sudo bash "$RHSMCMD"
-sudo rm -rf "$RHSMCMD"
+rhsm_enable
 
 ooe.sh sudo yum -y erase "rh-amazon-rhui-client*"
 ooe.sh sudo subscription-manager repos "--disable=*"
@@ -47,21 +30,6 @@ ooe.sh sudo subscription-manager repos \
 
 ooe.sh sudo yum -y update
 
-# Frequently needed
-ooe.sh sudo yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
-
-# Required for google to manage ssh keys
-sudo tee -a /etc/yum.repos.d/google-cloud-sdk.repo << EOM
-[google-cloud-compute]
-name=google-cloud-compute
-baseurl=https://packages.cloud.google.com/yum/repos/google-cloud-compute-el7-x86_64
-enabled=1
-gpgcheck=1
-repo_gpgcheck=1
-gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
-       https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
-EOM
-
 ooe.sh sudo yum -y install \
     atomic-registries \
     btrfs-progs-devel \
@@ -74,8 +42,6 @@ ooe.sh sudo yum -y install \
     golang \
     golang-github-cpuguy83-go-md2man \
     golang-github-cpuguy83-go-md2man \
-    google-compute-engine \
-    google-compute-engine-oslogin \
     gpgme-devel \
     iptables \
     libassuan-devel \
@@ -118,7 +84,7 @@ install_criu
 
 install_packer_copied_files
 
-exit_handler  # release subscription!
+rhel_exit_handler  # release subscription!
 
 rh_finalize
 
diff --git a/contrib/cirrus/packer/ubuntu_setup.sh b/contrib/cirrus/packer/ubuntu_setup.sh
index ef209a4a4..6e3613462 100644
--- a/contrib/cirrus/packer/ubuntu_setup.sh
+++ b/contrib/cirrus/packer/ubuntu_setup.sh
@@ -21,6 +21,7 @@ install_ooe
 export GOPATH="$(mktemp -d)"
 trap "sudo rm -rf $GOPATH" EXIT
 
+# Avoid getting stuck waiting for user input
 export DEBIAN_FRONTEND=noninteractive
 
 # Try twice as workaround for minor networking problems
@@ -56,6 +57,8 @@ ooe.sh sudo -E apt-get -qq install --no-install-recommends \
     libostree-dev \
     libprotobuf-c0-dev \
     libprotobuf-dev \
+    libseccomp-dev \
+    libseccomp2 \
     libtool \
     libudev-dev \
     lsof \