Add files and services to initialize secex-data volume

Add a script to initialize secex-data volume during installation.
This is achieved by having the tarball stored on a second disk.

Also run a podman container that mounts the volume to keep it from beeing
pruned. See: containers/podman#17051

Signed-off-by: Jan Schintag <[email protected]>

multi-arch-builders/coreos-s390x-rhcos-builder.bu

@@ -24,9 +24,100 @@ kernel_arguments:
     # enables Secure Execution Host
     - prot_virt=1
 storage:
+  directories:
+    - path: /home/builder/.config/systemd/user/default.target.wants
+      user:
+        name: builder
+      group:
+        name: builder
   files:
     - path: /etc/hostname
       mode: 0644
       overwrite: true
       contents:
         inline: rdu-z15-l21
+    - path: /home/core/create-secex-data.sh
+      mode: 0744
+      user:
+        name: core
+      group:
+        name: core
+      contents:
+        inline: |
+            #!/bin/bash
+
+            set -e
+
+            DISK_PART="/dev/disk/by-partuuid/80442b5f-01"
+            DISK_FCP="0.0.a800"
+            DISK_WWWN="0x5005076810154e60"
+            DISK_LUN="0x0000000000000000"
+            MNTP="/mnt/secex-data"
+            TARBALL="secex.tar"
+
+            if ! $(whoami | grep -q "root"); then
+                echo "This script must be run as root"
+                exit 1
+            fi
+
+            if ! $(lszdev | grep -q "${DISK_LUN}"); then
+                echo "Adding LUN to system"
+                echo "${DISK_LUN}" > /sys/bus/ccw/drivers/zfcp/${DISK_FCP}/${DISK_WWWN}/unit_add
+            fi
+
+            if ! $(mountpoint -q "${MNTP}"); then
+                echo "Mounting disk"
+                mkdir -p "${MNTP}"
+                mount "${DISK_PART}" "${MNTP}"
+            fi
+
+            echo "Copying tarball from disk to builder"
+            cp "${MNTP}/${TARBALL}" "/var/home/builder/${TARBALL}"
+            chown builder:builder "/var/home/builder/${TARBALL}"
+
+            if ! $(sudo -u builder -H /bin/bash -c "cd /var/home/builder; podman volume list" | grep -q secex-data); then
+                echo "Creating volume secex-data"
+                sudo -u builder -H /bin/bash -c "cd /var/home/builder; podman volume create --label=persistent secex-data"
+            fi
+
+            echo "Importing tarball into volume"
+            sudo -u builder -H /bin/bash -c "cd /var/home/builder; podman volume import secex-data /var/home/builder/${TARBALL}"
+    - path: /etc/systemd/secex-data-volume.service
+      mode: 0644
+      user:
+        name: root
+      group:
+        name: root
+      contents:
+        inline: |
+            [Unit]
+            Description=Create secex-data volume
+            [Service]
+            Type=oneshot
+            ExecStart=/home/core/create-secex-data.sh
+    - path: /home/builder/.config/systemd/user/secex-data-keepalive.service
+      mode: 0644
+      user:
+        name: builder
+      group:
+        name: builder
+      contents:
+        inline: |
+            [Unit]
+            Description=Run keepalive container for secex-data volume. See: https://github.com/containers/podman/issues/17051
+            [Service]
+            Type=oneshot
+            ExecStart=podman run -d --replace --name secex-data-keepalive -v secex-data:/data.secex:ro registry.fedoraproject.org/fedora:36 sleep infinity
+  links:
+    - path: /etc/systemd/default.target.wants/secex-data-volume.service
+      target: /etc/systemd/secex-data-volume.service
+      user:
+        name: root
+      group:
+        name: root
+    - path: /home/builder/.config/systemd/user/default.target.wants/secex-data-keepalive.service
+      target: /home/builder/.config/systemd/user/secex-data-keepalive.service
+      user:
+        name: builder
+      group:
+        name: builder