Add oslogin_ssh_key_expire_after parameter for OS Login SSH key expiration

- Add OSLoginSSHKeyExpireAfter field to Config struct
- Update ImportOSLoginSSHKey to accept expiration time parameter
- Set ExpirationTimeUsec in oslogin.SshPublicKey when provided
- Parameter is positioned next to other OS Login configs (oslogin_ssh_username)
- Regenerate config.hcl2spec.go with make generate

Author: y1hao

.web-docs/components/builder/googlecompute/README.md

@@ -372,6 +372,11 @@ builder.
 
   Note: Invalid or unsupported values will result in an error during provisioning.
 
+- `oslogin_ssh_key_expire_after` (duration string | ex: "1h5m2s") - The duration after which an SSH key imported into OS Login will expire.
+  This parameter is used when an SSH key is imported into the OS Login profile.
+  The expiration time is calculated from the current time plus this duration.
+  Example value: `1h`, `30m`, `24h`.
+
 - `wait_to_add_ssh_keys` (duration string | ex: "1h5m2s") - The time to wait between the creation of the instance used to create the image,
   and the addition of SSH configuration, including SSH keys, to that instance.
   The delay is intended to protect packer from anything in the instance boot

builder/googlecompute/config.go

@@ -369,6 +369,11 @@ type Config struct {
 	//
 	// Note: Invalid or unsupported values will result in an error during provisioning.
 	OSLoginSSHUsername string `mapstructure:"oslogin_ssh_username" required:"false"`
+	// The duration after which an SSH key imported into OS Login will expire.
+	// This parameter is used when an SSH key is imported into the OS Login profile.
+	// The expiration time is calculated from the current time plus this duration.
+	// Example value: `1h`, `30m`, `24h`.
+	OSLoginSSHKeyExpireAfter time.Duration `mapstructure:"oslogin_ssh_key_expire_after" required:"false"`
 	// The time to wait between the creation of the instance used to create the image,
 	// and the addition of SSH configuration, including SSH keys, to that instance.
 	// The delay is intended to protect packer from anything in the instance boot

builder/googlecompute/config.hcl2spec.go

@@ -102,7 +102,16 @@ func (s *StepImportOSLoginSSHKey) Run(ctx context.Context, state multistep.State
 		return multistep.ActionHalt
 	}
 
-	loginProfile, err := driver.ImportOSLoginSSHKey(s.accountEmail, string(config.Comm.SSHPublicKey))
+	// Calculate expiration time if oslogin_ssh_key_expire_after is set
+	// This is used when an SSH key is imported into the OS Login profile
+	var expirationTimeUsec *int64
+	if config.OSLoginSSHKeyExpireAfter > 0 {
+		expirationTime := time.Now().Add(config.OSLoginSSHKeyExpireAfter)
+		expirationTimeUsecVal := expirationTime.UnixMicro()
+		expirationTimeUsec = &expirationTimeUsecVal
+	}
+
+	loginProfile, err := driver.ImportOSLoginSSHKey(s.accountEmail, string(config.Comm.SSHPublicKey), expirationTimeUsec)
 	if err != nil {
 		err := fmt.Errorf("Error importing SSH public key for OSLogin: %s", err)
 		state.Put("error", err)

builder/googlecompute/step_import_os_login_ssh_key.go

@@ -318,6 +318,11 @@
 
   Note: Invalid or unsupported values will result in an error during provisioning.
 
+- `oslogin_ssh_key_expire_after` (duration string | ex: "1h5m2s") - The duration after which an SSH key imported into OS Login will expire.
+  This parameter is used when an SSH key is imported into the OS Login profile.
+  The expiration time is calculated from the current time plus this duration.
+  Example value: `1h`, `30m`, `24h`.
+
 - `wait_to_add_ssh_keys` (duration string | ex: "1h5m2s") - The time to wait between the creation of the instance used to create the image,
   and the addition of SSH configuration, including SSH keys, to that instance.
   The delay is intended to protect packer from anything in the instance boot

docs-partials/builder/googlecompute/Config-not-required.mdx

@@ -86,7 +86,9 @@ type Driver interface {
 	CreateOrResetWindowsPassword(zone, name string, config *WindowsPasswordConfig) (<-chan error, error)
 
 	// ImportOSLoginSSHKey imports SSH public key for OSLogin.
-	ImportOSLoginSSHKey(user, sshPublicKey string) (*oslogin.LoginProfile, error)
+	// expirationTimeUsec is an optional expiration time in microseconds since Unix epoch.
+	// If nil, no expiration time will be set.
+	ImportOSLoginSSHKey(user, sshPublicKey string, expirationTimeUsec *int64) (*oslogin.LoginProfile, error)
 
 	// DeleteOSLoginSSHKey deletes the SSH public key for OSLogin with the given key.
 	DeleteOSLoginSSHKey(user, fingerprint string) error

lib/common/driver.go

@@ -898,12 +898,17 @@ func (d *driverGCE) getPasswordResponses(zone, instance string) ([]windowsPasswo
 	return passwordResponses, nil
 }
 
-func (d *driverGCE) ImportOSLoginSSHKey(user, sshPublicKey string) (*oslogin.LoginProfile, error) {
+func (d *driverGCE) ImportOSLoginSSHKey(user, sshPublicKey string, expirationTimeUsec *int64) (*oslogin.LoginProfile, error) {
 	parent := fmt.Sprintf("users/%s", user)
 
-	resp, err := d.osLoginService.Users.ImportSshPublicKey(parent, &oslogin.SshPublicKey{
+	sshKey := &oslogin.SshPublicKey{
 		Key: sshPublicKey,
-	}).Do()
+	}
+	if expirationTimeUsec != nil {
+		sshKey.ExpirationTimeUsec = *expirationTimeUsec
+	}
+
+	resp, err := d.osLoginService.Users.ImportSshPublicKey(parent, sshKey).Do()
 	if err != nil {
 		return nil, err
 	}

lib/common/driver_gce.go

@@ -379,7 +379,7 @@ func (d *DriverMock) CreateOrResetWindowsPassword(instance, zone string, c *Wind
 	return resultCh, d.CreateOrResetWindowsPasswordErr
 }
 
-func (d *DriverMock) ImportOSLoginSSHKey(user, key string) (*oslogin.LoginProfile, error) {
+func (d *DriverMock) ImportOSLoginSSHKey(user, key string, expirationTimeUsec *int64) (*oslogin.LoginProfile, error) {
 	account := oslogin.PosixAccount{Primary: true, Username: "testing_packer_io"}
 	profile := oslogin.LoginProfile{
 		PosixAccounts: []*oslogin.PosixAccount{&account},