12 files changed, 160 insertions, 20 deletions
diff --git a/contrib/cirrus/build_vm_images.sh b/contrib/cirrus/build_vm_images.sh
index ee45b1ead..6b86aa4d4 100755
--- a/contrib/cirrus/build_vm_images.sh
+++ b/contrib/cirrus/build_vm_images.sh
@@ -42,15 +42,33 @@ then
     fi
 fi
 
-set -x
-
 cd "$GOSRC/$PACKER_BASE"
+
+# Separate PR-produced images from those produced on master.
+if [[ "${CIRRUS_BRANCH:-}" == "master" ]]
+then
+    POST_MERGE_BUCKET_SUFFIX="-master"
+else
+    POST_MERGE_BUCKET_SUFFIX=""
+fi
+
 make libpod_images \
     PACKER_BUILDS=$PACKER_BUILDS \
     PACKER_VER=$PACKER_VER \
     GOSRC=$GOSRC \
     SCRIPT_BASE=$SCRIPT_BASE \
     PACKER_BASE=$PACKER_BASE \
+    POST_MERGE_BUCKET_SUFFIX=$POST_MERGE_BUCKET_SUFFIX \
     BUILT_IMAGE_SUFFIX=$BUILT_IMAGE_SUFFIX
 
 record_timestamp "cache-image build end"
+
+# When successful, upload manifest of produced images using a filename unique
+# to this build.
+URI="gs://packer-import${POST_MERGE_BUCKET_SUFFIX}/manifest${BUILT_IMAGE_SUFFIX}.json"
+gsutil cp packer-manifest.json "$URI"
+
+echo "Finished."
+echo "Any tarball URI's referenced above at at $URI"
+echo "may be used to create VM images suitable for use in"
+echo ".cirrus.yml as values for the 'image_name' keys."
diff --git a/contrib/cirrus/packer/Makefile b/contrib/cirrus/packer/Makefile
index 9bf27373e..0a783e979 100644
--- a/contrib/cirrus/packer/Makefile
+++ b/contrib/cirrus/packer/Makefile
@@ -3,7 +3,7 @@
 # builder name(s) from applicable YAML file,
 # e.g for names see libpod_images.yml
 
-PACKER_VER ?= 1.3.1
+PACKER_VER ?= 1.3.2
 PACKER_DIST_FILENAME := packer_${PACKER_VER}_linux_amd64.zip
 
 # Only needed for libpod_base_images target
@@ -11,6 +11,7 @@ TIMESTAMP := $(shell date +%s)
 GOSRC ?= $(shell realpath "./../../../")
 PACKER_BASE ?= contrib/cirrus/packer
 SCRIPT_BASE ?= contrib/cirrus
+POST_MERGE_BUCKET_SUFFIX ?=
 
 # For debugging nested-virt, use
 #TTYDEV := $(shell tty)
@@ -50,10 +51,6 @@ endif
 		-var PACKER_BASE=$(PACKER_BASE) \
 		-var SCRIPT_BASE=$(SCRIPT_BASE) \
 		libpod_images.json
-	@echo ""
-	@echo "Finished.  The images mentioned above, and in packer-manifest.json"
-	@echo "can be used in .cirrus.yml as values for the 'image_name' keys"
-	@echo ""
 
 cidata.ssh:
 	ssh-keygen -f $@ -P "" -q
@@ -100,9 +97,6 @@ endif
 		-var RHEL_IMAGE_FILE=$(RHEL_IMAGE_FILE) \
 		-var RHEL_CSUM_FILE=$(RHEL_CSUM_FILE) \
 	    -var 'RHSM_COMMAND=$(RHSM_COMMAND)' \
+		-var POST_MERGE_BUCKET_SUFFIX=$(POST_MERGE_BUCKET_SUFFIX) \
 		-only $(PACKER_BUILDS) \
 		libpod_base_images.json
-	@echo ""
-	@echo "Finished.  The images mentioned above, and in packer-manifest.json"
-	@echo "can be used in .cirrus.yml as values for the *_BASE_IMAGE keys."
-	@echo ""
diff --git a/contrib/cirrus/packer/centos_setup.sh b/contrib/cirrus/packer/centos_setup.sh
index a13050569..923f2563b 100644
--- a/contrib/cirrus/packer/centos_setup.sh
+++ b/contrib/cirrus/packer/centos_setup.sh
@@ -25,6 +25,7 @@ ooe.sh sudo yum -y update
 ooe.sh sudo yum -y install centos-release-scl epel-release
 
 ooe.sh sudo yum -y install \
+    PyYAML \
     atomic-registries \
     btrfs-progs-devel \
     bzip2 \
diff --git a/contrib/cirrus/packer/image-builder-image_base-setup.sh b/contrib/cirrus/packer/image-builder-image_base-setup.sh
index b8e2824a7..8cf9fd8ab 100644
--- a/contrib/cirrus/packer/image-builder-image_base-setup.sh
+++ b/contrib/cirrus/packer/image-builder-image_base-setup.sh
@@ -45,10 +45,13 @@ ooe.sh sudo yum -y install \
     qemu-kvm-tools \
     qemu-user \
     rsync \
+    rng-tools \
     unzip \
     util-linux \
     vim
 
+sudo systemctl enable rngd
+
 sudo ln -s /usr/libexec/qemu-kvm /usr/bin/
 
 sudo tee /etc/modprobe.d/kvm-nested.conf <<EOF
diff --git a/contrib/cirrus/packer/libpod_base_images.yml b/contrib/cirrus/packer/libpod_base_images.yml
index 109b9b8d5..bf568b40e 100644
--- a/contrib/cirrus/packer/libpod_base_images.yml
+++ b/contrib/cirrus/packer/libpod_base_images.yml
@@ -105,7 +105,7 @@ builders:
       ssh_username: 'root'
 
     - <<: *nested_virt
-      name: 'prior_fedora'
+      name: 'prior-fedora'
       iso_url: '{{user `PRIOR_FEDORA_IMAGE_URL`}}'
       iso_checksum_url: '{{user `PRIOR_FEDORA_CSUM_URL`}}'
 
@@ -161,7 +161,7 @@ provisioners:
 
 post-processors:
     - - type: "compress"
-        only: ['fedora', 'prior_fedora', 'fah', 'rhel']
+        only: ['fedora', 'prior-fedora', 'fah', 'rhel']
         output: '/tmp/{{build_name}}/disk.raw.tar.gz'
         format: '.tar.gz'
         compression_level: 9
@@ -171,12 +171,12 @@ post-processors:
         project_id: '{{user `GCP_PROJECT_ID`}}'
         account_file: '{{user `GOOGLE_APPLICATION_CREDENTIALS`}}'
         bucket: '{{user `XFERBUCKET`}}'
-        gcs_object_name: '{{build_name}}-{{user `TIMESTAMP`}}-{{uuid}}.tar.gz'
+        gcs_object_name: '{{build_name}}-{{user `TIMESTAMP`}}.tar.gz'
         image_name: "{{user `FEDORA_BASE_IMAGE_NAME`}}-{{user `TIMESTAMP`}}"
         image_description: 'Based on {{user `FEDORA_IMAGE_URL`}}'
         image_family: '{{user `FEDORA_BASE_IMAGE_NAME`}}'
       - <<: *gcp_import
-        only: ['prior_fedora']
+        only: ['prior-fedora']
         image_name: "{{user `PRIOR_FEDORA_BASE_IMAGE_NAME`}}-{{user `TIMESTAMP`}}"
         image_description: 'Based on {{user `PRIOR_FEDORA_IMAGE_URL`}}'
         image_family: '{{user `PRIOR_FEDORA_BASE_IMAGE_NAME`}}'
diff --git a/contrib/cirrus/packer/libpod_images.yml b/contrib/cirrus/packer/libpod_images.yml
index d31c11a8d..30ad0723a 100644
--- a/contrib/cirrus/packer/libpod_images.yml
+++ b/contrib/cirrus/packer/libpod_images.yml
@@ -29,6 +29,10 @@ variables:
     SERVICE_ACCOUNT: '{{env `SERVICE_ACCOUNT`}}'
     GOOGLE_APPLICATION_CREDENTIALS: '{{env `GOOGLE_APPLICATION_CREDENTIALS`}}'
 
+    # Used to separate images produced during PR testing from those
+    # produced from post-merge testing.  Must be empty for PR testing.
+    POST_MERGE_BUCKET_SUFFIX: ''
+
 # Don't leak sensitive values in error messages / output
 sensitive-variables:
     - 'GCE_SSH_USERNAME'
@@ -84,13 +88,18 @@ provisioners:
     - type: 'shell'
       script: '{{user `GOSRC`}}/{{user `PACKER_BASE`}}/{{split build_name "-" 0}}_setup.sh'
       environment_vars:
-          - 'SCRIPT_BASE={{user `SCRIPT_BASE`}}'
+          - 'GOSRC=/tmp/libpod'
           - 'CNI_COMMIT={{user `CNI_COMMIT`}}'
           - 'FEDORA_CNI_COMMIT={{user `FEDORA_CNI_COMMIT`}}'
           - 'CRIO_COMMIT={{user `CRIO_COMMIT`}}'
           - 'CRIU_COMMIT={{user `CRIU_COMMIT`}}'
           - 'RUNC_COMMIT={{user `RUNC_COMMIT`}}'
+          - 'SCRIPT_BASE={{user `SCRIPT_BASE`}}'
           - 'RHSM_COMMAND={{user `RHSM_COMMAND`}}'
 
 post-processors:
-    - - type: 'manifest'
+    # Store VM disk in GCP storage, where it will expire based on a defined
+    # lifecycle. This prevents GCE from filling with disused images.
+    - - type: 'googlecompute-export'
+        paths: ['gs://packer-import{{user `POST_MERGE_BUCKET_SUFFIX`}}/{{build_name}}{{user `BUILT_IMAGE_SUFFIX`}}.tar.gz']
+      - type: 'manifest'  # writes packer-manifest.json
diff --git a/contrib/cirrus/packer/rhel_base-setup.sh b/contrib/cirrus/packer/rhel_base-setup.sh
index 8b2073d4f..fbf9f61af 100644
--- a/contrib/cirrus/packer/rhel_base-setup.sh
+++ b/contrib/cirrus/packer/rhel_base-setup.sh
@@ -16,6 +16,8 @@ req_env_var "
 
 install_ooe
 
+rhsm_enable
+
 echo "Setting up repos"
 # Frequently needed
 ooe.sh sudo yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
@@ -32,12 +34,15 @@ gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
        https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
 EOM
 
-rhsm_enable
+echo "Updating all packages"
+ooe.sh sudo yum -y update
 
 echo "Installing/removing packages"
-ooe.sh sudo yum -y install google-compute-engine google-compute-engine-oslogin
-ooe.sh sudo yum -y erase "cloud-init" "rh-amazon-rhui-client*" || true
+ooe.sh sudo yum -y install rng-tools google-compute-engine google-compute-engine-oslogin
+
+echo "Enabling critical services"
 ooe.sh sudo systemctl enable \
+    rngd \
     google-accounts-daemon \
     google-clock-skew-daemon \
     google-instance-setup \
@@ -47,6 +52,29 @@ ooe.sh sudo systemctl enable \
 
 rhel_exit_handler  # release subscription!
 
+echo "Configuring boot"
+cat << "EOF" | sudo tee /etc/default/grub
+GRUB_TIMEOUT=0
+GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
+GRUB_DEFAULT=saved
+GRUB_DISABLE_SUBMENU=true
+GRUB_TERMINAL="serial console"
+GRUB_SERIAL_COMMAND="serial --speed=38400"
+GRUB_CMDLINE_LINUX="crashkernel=auto console=ttyS0,38400n8"
+GRUB_DISABLE_RECOVERY="true"
+EOF
+sudo grub2-mkconfig -o /boot/grub2/grub.cfg
+
+echo "Configuring networking"
+ooe.sh sudo nmcli connection modify 'System eth0' 802-3-ethernet.mtu 1460
+ooe.sh sudo nmcli connection modify 'System eth0' connection.autoconnect yes
+ooe.sh sudo nmcli connection modify 'System eth0' connection.autoconnect-priority
+ooe.sh sudo nmcli connection modify 'System eth0' ipv4.method auto
+ooe.sh sudo nmcli connection modify 'System eth0' ipv4.dhcp-send-hostname yes
+ooe.sh sudo nmcli connection modify 'System eth0' ipv4.dhcp-timeout 0
+ooe.sh sudo nmcli connection modify 'System eth0' ipv4.never-default no
+ooe.sh /usr/bin/google_instance_setup
+
 rh_finalize
 
 echo "SUCCESS!"
diff --git a/contrib/cirrus/packer/rhel_setup.sh b/contrib/cirrus/packer/rhel_setup.sh
index 99376fd65..ac6866a57 100644
--- a/contrib/cirrus/packer/rhel_setup.sh
+++ b/contrib/cirrus/packer/rhel_setup.sh
@@ -31,6 +31,7 @@ ooe.sh sudo subscription-manager repos \
 ooe.sh sudo yum -y update
 
 ooe.sh sudo yum -y install \
+    PyYAML \
     atomic-registries \
     btrfs-progs-devel \
     bzip2 \
@@ -64,9 +65,11 @@ ooe.sh sudo yum -y install \
     protobuf-python \
     python \
     python2-future \
+    python2-pyyaml \
     python34-dateutil \
     python34-psutil \
     python34-pytoml \
+    python34-PyYAML \
     runc \
     skopeo-containers \
     unzip \
diff --git a/contrib/imgts/Dockerfile b/contrib/imgts/Dockerfile
new file mode 100644
index 000000000..0746eca4c
--- /dev/null
+++ b/contrib/imgts/Dockerfile
@@ -0,0 +1,20 @@
+FROM centos:7
+
+# Only needed for installing build-time dependencies
+COPY /contrib/imgts/google-cloud-sdk.repo /etc/yum.repos.d/google-cloud-sdk.repo
+RUN yum -y update && \
+    yum -y install epel-release && \
+    yum -y install google-cloud-sdk && \
+    yum clean all
+
+COPY /contrib/imgts/entrypoint.sh /usr/local/bin/entrypoint.sh
+ENV GCPJSON="__unknown__" \
+    GCPNAME="__unknown__" \
+    GCPPROJECT="__unknown__" \
+    IMGNAMES="__unknown__" \
+    TIMESTAMP="__unknown__" \
+    BUILDID="__unknown__" \
+    REPOREF="__unknown__"
+RUN chmod 755 /usr/local/bin/entrypoint.sh
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
diff --git a/contrib/imgts/README.md b/contrib/imgts/README.md
new file mode 100644
index 000000000..ad5ed4172
--- /dev/null
+++ b/contrib/imgts/README.md
@@ -0,0 +1,11 @@
+![PODMAN logo](../../logo/podman-logo-source.svg)
+
+A container image for tracking automation metadata.
+Currently this is used to update last-used timestamps on
+VM images.
+
+Example build (from repository root):
+
+```bash
+sudo podman build -t $IMAGE_NAME -f contrib/imgts/Dockerfile .
+```
diff --git a/contrib/imgts/entrypoint.sh b/contrib/imgts/entrypoint.sh
new file mode 100755
index 000000000..65a76d8e4
--- /dev/null
+++ b/contrib/imgts/entrypoint.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+set -e
+
+RED="\e[1;36;41m"
+YEL="\e[1;33;44m"
+NOR="\e[0m"
+
+die() {
+    echo -e "$2" >&2
+    exit "$1"
+}
+
+SENTINEL="__unknown__"  # default set in dockerfile
+
+[[ "$GCPJSON" != "$SENTINEL" ]] || \
+    die 1 "Must specify service account JSON in \$GCPJSON"
+[[ "$GCPNAME" != "$SENTINEL" ]] || \
+    die 2 "Must specify service account name in \$GCPNAME"
+[[ "$GCPPROJECT" != "$SENTINEL" ]] || \
+    die 4 "Must specify GCP Project ID in \$GCPPROJECT"
+[[ -n "$GCPPROJECT" ]] || \
+    die 5 "Must specify non-empty GCP Project ID in \$GCPPROJECT"
+[[ "$IMGNAMES" != "$SENTINEL" ]] || \
+    die 6 "Must specify space separated list of GCE image names in \$IMGNAMES"
+[[ "$BUILDID" != "$SENTINEL" ]] || \
+    die 7 "Must specify the number of current build in \$BUILDID"
+[[ "$REPOREF" != "$SENTINEL" ]] || \
+    die 8 "Must specify a PR number or Branch name in \$REPOREF"
+
+ARGS="--update-labels=last-used=$(date +%s)"
+# optional
+[[ -z "$BUILDID" ]] || ARGS="$ARGS --update-labels=build-id=$BUILDID"
+[[ -z "$REPOREF" ]] || ARGS="$ARGS --update-labels=repo-ref=$REPOREF"
+
+gcloud config set account "$GCPNAME"
+gcloud config set project "$GCPPROJECT"
+echo "$GCPJSON" > /tmp/gcp.json
+gcloud auth activate-service-account --key-file=/tmp/gcp.json || rm /tmp/gcp.json
+for image in $IMGNAMES
+do
+    gcloud compute images update "$image" $ARGS &
+done
+set +e  # Actual update failures are only warnings
+wait || die 0 "${RED}WARNING:$NOR ${YEL}Failed to update labels on one or more images:$NOR '$IMGNAMES'"
diff --git a/contrib/imgts/google-cloud-sdk.repo b/contrib/imgts/google-cloud-sdk.repo
new file mode 100644
index 000000000..45b1e43bb
--- /dev/null
+++ b/contrib/imgts/google-cloud-sdk.repo
@@ -0,0 +1,8 @@
+[google-cloud-sdk]
+name=Google Cloud SDK
+baseurl=https://packages.cloud.google.com/yum/repos/cloud-sdk-el7-x86_64
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg
+       https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg