Merge ~orndorffgrant/ubuntu/+source/ubuntu-advantage-tools:upload-27.3-impish into ubuntu/+source/ubuntu-advantage-tools:ubuntu/devel

[Grant Orndorff]

New release 27.3.

Sync upstream commits (and retain rich git commit history) with the following:

git rebase --onto pkg/ubuntu/devel 27.2.2 27.3 # 27.2.2 and 27.3 are upstream annotated tags in the upstream/release-27 branch at https://github.com/canonical/ubuntu-advantage-client/tree/release-27

Please see https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1942929 for details of what is included in this release.

304f2dd... by Renan Rodrigo on 2021-09-30

timer: set the frequency to 6h

Signed-off-by: Renan Rodrigo <email address hidden>

627d068... by Lucas Albuquerque Medeiros de Moura on 2021-09-30

postinst: make check for gce instance more robust

Currently, we have a check on postinst to verify
if we are on a gce cloud. We only verify if the gce
string is in the cloud-id of the instance. Therefore,
we are open to matching non-gce clouds that have the gce string
on their cloud-id. We are now updating this part of the code
to make the match more robust by verifying if the cloud-id starts
if the gce string.

38ae43f... by Grant Orndorff on 2021-09-30

license-check: add explanation to systemd units

446e0db... by Grant Orndorff on 2021-09-30

changelog: add missing LP bug refs for 27.3

1ae5f45... by Grant Orndorff on 2021-09-30

changelog: update ua-timer.timer frequency

0d23326... by Chad Smith on 2021-09-30

logs: update logrotate to glob capture all /var/log/ubuntu-advantage*log

Provide `su root root` to avoid messaging about parent directory perms
being insecure and allowing syslog group to write this file.

0c86d04... by Lucas Albuquerque Medeiros de Moura on 2021-10-01

postinst: mask ua-timer if ua-messaging disabled

If the user manually disabled ua-messaging we are now assuming
that the user want the same behavior for ua-timer as well. We are
now masking the ua-timer service if we detect that ua-messaging was
manually disabled by the user

c60f80a... by Chad Smith on 2021-10-04

logrotate: fix perms as root:root add ubuntu-advantage-timer.log

005567c... by Chad Smith on 2021-10-04

changelog

ea2cd37... by Lucas Albuquerque Medeiros de Moura on 2021-10-05

postrm: Remove extra ubuntu-advantage log on purge

69dbb6d... by Lucas Albuquerque Medeiros de Moura on 2021-10-05

logrotate: move su command inside log entry

05e8510... by Lucas Albuquerque Medeiros de Moura on 2021-10-05

postinst: properly configure extra logs

b8c3cbd... by Lucas Albuquerque Medeiros de Moura on 2021-10-06

postinst: check for systemd before using systemctl

0ac54c3... by Lucas Albuquerque Medeiros de Moura on 2021-10-06

changelog: fix lintian warning for long line

[Athos Ribeiro (athos-ribeiro)]

LGTM

review: Approve

[Sergio Durigan Junior (sergiodj)]

Thank you for the hard work, guys.

Uploaded:

$ dput ubuntu-advantage-tools_27.3~21.10.1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/ubuntu-advantage-tools/ubuntu-advantage-tools_27.3~21.10.1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/ubuntu-advantage-tools/ubuntu-advantage-tools_27.3~21.10.1.dsc: Valid signature from 106DA1C8C3CBBF14
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading ubuntu-advantage-tools_27.3~21.10.1.dsc: done.
  Uploading ubuntu-advantage-tools_27.3~21.10.1.tar.xz: done.
  Uploading ubuntu-advantage-tools_27.3~21.10.1_source.buildinfo: done.
  Uploading ubuntu-advantage-tools_27.3~21.10.1_source.changes: done.
Successfully uploaded packages.

f93544a... by Grant Orndorff on 2021-10-19

postinst: simplify disable_new_timer_if_old_timer_already_disabled

Unmerged commits

f93544a... by Grant Orndorff on 2021-10-19

postinst: simplify disable_new_timer_if_old_timer_already_disabled

0ac54c3... by Lucas Albuquerque Medeiros de Moura on 2021-10-06

changelog: fix lintian warning for long line

b8c3cbd... by Lucas Albuquerque Medeiros de Moura on 2021-10-06

postinst: check for systemd before using systemctl

05e8510... by Lucas Albuquerque Medeiros de Moura on 2021-10-05

postinst: properly configure extra logs

69dbb6d... by Lucas Albuquerque Medeiros de Moura on 2021-10-05

logrotate: move su command inside log entry

ea2cd37... by Lucas Albuquerque Medeiros de Moura on 2021-10-05

postrm: Remove extra ubuntu-advantage log on purge

0c86d04... by Lucas Albuquerque Medeiros de Moura on 2021-10-01

postinst: mask ua-timer if ua-messaging disabled

If the user manually disabled ua-messaging we are now assuming
that the user want the same behavior for ua-timer as well. We are
now masking the ua-timer service if we detect that ua-messaging was
manually disabled by the user

627d068... by Lucas Albuquerque Medeiros de Moura on 2021-09-30

postinst: make check for gce instance more robust

Currently, we have a check on postinst to verify
if we are on a gce cloud. We only verify if the gce
string is in the cloud-id of the instance. Therefore,
we are open to matching non-gce clouds that have the gce string
on their cloud-id. We are now updating this part of the code
to make the match more robust by verifying if the cloud-id starts
if the gce string.

005567c... by Chad Smith on 2021-10-04

changelog

c60f80a... by Chad Smith on 2021-10-04

logrotate: fix perms as root:root add ubuntu-advantage-timer.log

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..97ab34b
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,42 @@
+artifacts/*
+*debhelper*
+debian/ubuntu-advantage-tools/
+debian/ubuntu-advantage-tools.substvars
+dev/entitlement-creds.json.*
+*.pyc
+*.pyo
+__pycache__
+.tox
+.pybuild
+.coverage
+.cache
+*.egg-info/
+.mypy_cache/
+
+# Ignore artifacts generated by bddeb
+*-1~bddeb*
+ubuntu-advantage-tools_*.orig.tar.gz
+ubuntu-advantage-tools_all.deb
+ubuntu_advantage_tools.dsc
+
+# test/jenkins artifacts
+pytest_results.xml
+reports/
+
+# integration test artifacts
+azure-priv-*.pem
+azure-pub-*.txt
+ec2-*.pem
+gcp-pub-*
+gcp-priv-*
+lxd-*-uaclient-ci-*
+build-from-source.sh
+test-results*
+
+# credentials - don't commit credentials
+tools/ua-test-credentials.yaml
+
+# apt-hook build artifacts
+apt-hook/hook
+apt-hook/ubuntu-advantage.pot
+apt-hook/json-hook-src/json-hook
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 0c6ffae..8bffa3e 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -3,3 +3,7 @@ repos:
     rev: 19.3b0  # Also stored in dev-requirements.txt; update both together!
     hooks:
     - id: black
+  - repo: https://github.com/pycqa/isort
+    rev: 5.8.0  # Also stored in dev-requirements.txt; update both together!
+    hooks:
+    - id: isort
diff --git a/Jenkinsfile b/Jenkinsfile
index 8723fde..17dfc00 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -53,7 +53,7 @@ pipeline {
             steps {
                 sh '''
                 set +x
-                tox -e black
+                tox -e black -e isort
                 '''
             }
         }
@@ -149,6 +149,8 @@ pipeline {
                     environment {
                         UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}xenial/"
                         UACLIENT_BEHAVE_ARTIFACT_DIR = "artifacts/behave-lxd-16.04"
+                        UACLIENT_BEHAVE_EPHEMERAL_INSTANCE = 1
+                        UACLIENT_BEHAVE_SNAPSHOT_STRATEGY = 1
                     }
                     steps {
                         sh '''
@@ -162,6 +164,8 @@ pipeline {
                     environment {
                         UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}bionic/"
                         UACLIENT_BEHAVE_ARTIFACT_DIR = "artifacts/behave-lxd-18.04"
+                        UACLIENT_BEHAVE_EPHEMERAL_INSTANCE = 1
+                        UACLIENT_BEHAVE_SNAPSHOT_STRATEGY = 1
                     }
                     steps {
                         sh '''
@@ -175,6 +179,8 @@ pipeline {
                     environment {
                         UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}focal/"
                         UACLIENT_BEHAVE_ARTIFACT_DIR = "artifacts/behave-lxd-20.04"
+                        UACLIENT_BEHAVE_EPHEMERAL_INSTANCE = 1
+                        UACLIENT_BEHAVE_SNAPSHOT_STRATEGY = 1
                     }
                     steps {
                         sh '''
@@ -188,6 +194,7 @@ pipeline {
                     environment {
                         UACLIENT_BEHAVE_DEBS_PATH = "${TMPDIR}focal/"
                         UACLIENT_BEHAVE_ARTIFACT_DIR = "artifacts/behave-vm-20.04"
+                        UACLIENT_BEHAVE_EPHEMERAL_INSTANCE = 1
                     }
                     steps {
                         sh '''
diff --git a/README.md b/README.md
index caac630..c2c236b 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,7 @@ following entitlements are supported:
 - [Common Criteria EAL2 certification artifacts provisioning](https://ubuntu.com/cc-eal)
 - [Canonical CIS Benchmark Audit Tool](https://ubuntu.com/cis-audit)
 - [Ubuntu Extended Security Maintenance](https://ubuntu.com/esm)
+- [Robot Operating System Extended Security Maintenance](https://ubuntu.com/robotics/ros-esm)
 - [FIPS 140-2 Certified Modules](https://ubuntu.com/fips)
 - [FIPS 140-2 Non-Certified Module Updates](https://ubuntu.com/fips)
 - [Livepatch Service](https://www.ubuntu.com/livepatch)
@@ -141,6 +142,49 @@ by a string formatted as:
 
 `<protocol>://[<username>:<password>@]<fqdn>:<port>`
 
+### Timer jobs
+UA client sets up a systemd timer to run jobs that need to be executed recurrently.
+The timer itself ticks every 5 minutes on average, and decides which jobs need
+to be executed based on their _intervals_.
+
+Jobs are executed by the timer script if:
+- The script has not yet run successfully, or
+- Their interval since last successful run is already exceeded.
+
+There is a random delay applied to the timer, to desynchronize job execution time
+on machines spinned at the same time, avoiding multiple synchronized calls to the
+same service.
+
+Current jobs being checked and executed are:
+
+| Job | Description | Interval |
+| --- | ----------- | -------- |
+| update_messaging | Update MOTD and APT messages | 6 hours |
+| update_status | Update UA status | 12 hours |
+| gcp_auto_attach | Try to auto-attach on a GCP instance | 5 minutes |
+
+- The `update_messaging` job makes sure that the MOTD and APT messages match the
+available/enabled services on the system, showing information about available
+packages or security updates. See [MOTD messages](#motd-messages).
+- The `update_status` job makes sure the `ua status` command will have the latest
+information even when executed by a non-root user, updating the
+`/var/lib/ubuntu-advantage/status.json` file.
+- The `gcp_auto_attach` job is only operable on Google Cloud Platform (GCP) generic
+Ubuntu VMs without an active Ubuntu Advantage license. It polls GCP metadata every 5
+minutes to discover if a license has been attached to the VM through Google Cloud and
+will perform `ua auto-attach` in that case.
+
+The timer intervals can be changed using the `ua config set` command.
+```bash
+# Make the update_status job run hourly
+$ sudo ua config set update_status_timer=3600
+```
+Setting an interval to zero disables the job.
+```bash
+# Disable the update_status job
+$ sudo ua config set update_status_timer=0
+```
+
 ## Directory layout
 The following describes the intent of UA client related directories:
 
@@ -162,6 +206,20 @@ The following describes the intent of UA client related directories:
 | /var/log/ubuntu-advantage.log | `root` read-only log of ubuntu-advantage operations |
 
 
+## Collecting logs
+The `ua collect-logs` command creates a tarball with all relevant data for debugging possible problems with UA. It puts together:
+- The UA Client configuration file (the default is `/etc/ubuntu-advantage/uaclient.conf`)
+- The UA Client log files (the default is `/var/log/ubuntu-advantage*`)
+- The files in `/etc/apt/sources.list.d/*` related to UA
+- Output of `systemctl status` for the UA Client related services
+- Status of the timer jobs, `canonical-livepatch`, and the systemd timers
+- Output of `cloud-id`, `dmesg` and `journalctl`
+
+Files with sensitive data are not included in the tarball. As of now, the command must be run as root.
+
+Running the command creates a `ua_logs.tar.gz` file in the current directory.
+The output file path/name can be changed using the `-o` option.
+
 ## Testing
 
 All unit and lint tests are run using `tox`. We also use `tox-pip-version` to specify an older pip version as a workaround: we have some required dependencies that can't meet the strict compatibility checks of current pip versions.
@@ -288,6 +346,25 @@ you need to add `-D reuse_container=container_name`:
 tox -e behave -D reuse_container=container_name
 ```
 
+#### Optimizing total run time of integration tests with snapshots
+When `UACLIENT_BEHAVE_SNAPSHOT_STRATEGY=1` we create a snapshot of an instance
+with ubuntu-advantage-tools installed and restore from that snapshot for all tests.
+This adds an upfront cost that is amortized across several test scenarios.
+
+Based on some rough testing in July 2021, these are the situations
+when you should set UACLIENT_BEHAVE_SNAPSHOT_STRATEGY=1
+
+> At time of writing, starting a lxd.vm instance from a local snapshot takes
+> longer than starting a fresh lxd.vm instance and installing ua.
+
+| machine_type  | condition          |
+| ------------- | ------------------ |
+| lxd.container | num_scenarios > 7  |
+| lxd.vm        | never              |
+| gcp*          | num_scenarios > 5  |
+| azure*        | num_scenarios > 14 |
+| aws*          | num_scenarios > 11 |
+
 #### Integration testing on EC2
 The following tox environments allow for testing focal on EC2:
 
@@ -394,11 +471,12 @@ ua version
 # Make apt aware of the ESM source files
 sudo apt update
 # Generates ubuntu-advantage-tools messages that should be delivered to MOTD
-# This script is trigged by a systemd timer once a day. To test it, we need to
-# enforce that it was already executed.
-sudo systemctl start ua-messaging.service
+# This script is triggered by the systemd timer 4 times a day. To test it, we need
+# to enforce that it was already executed.
+sudo systemctl start ua-timer.service
 # Force updating MOTD messages related to update-notifier
-/usr/lib/update-notifier/update-motd-updates-available --force
+sudo rm /var/lib/ubuntu-advantage/jobs-status.json
+sudo python3 /usr/lib/ubuntu-advantage/timer.py
 # Update MOTD and display the message
 run-parts /etc/update-motd.d/
 ```
@@ -449,12 +527,15 @@ multipass connect dev-f
 ## Code Formatting
 
 The `ubuntu-advantage-client` code base is formatted using
-[black](https://github.com/psf/black).  When making changes, you should
-ensure that your code is blackened, or it will be rejected by CI.
+[black](https://github.com/psf/black), and imports are sorted with
+[isort](https://github.com/PyCQA/isort).  When making changes, you
+should ensure that your code is blackened and isorted, or it will
+be rejected by CI.
 Formatting the whole codebase is as simple as running:
 
 ```shell
 black uaclient/
+isort uaclient/
 ```
 
 To make it easier to avoid committing incorrectly formatted code, this
diff --git a/RELEASES.md b/RELEASES.md
index 261ec7a..a48b607 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -1,6 +1,10 @@
 # Ubuntu Advantage Client Releases
 
-## Release versioning schemes:
+## Supported Ubuntu Releases
+
+See the table under "Support Matrix for the client" in the [readme](./README.md).
+
+## Release versioning schemes
 
 Below are the versioning schemes used for publishing debs:
 
@@ -22,148 +26,251 @@ Below are the versioning schemes used for publishing debs:
 | Ubuntu PRO to latest <series>-updates | `20.3+202004011202~ubuntu1~14.04.1` -> `20.4~ubuntu1~14.04.1` |
 | Ubuntu PRO to Daily PPA | `20.3+202004011202~ubuntu1~14.04.1` -> `20.4+202004021202~ubuntu1~14.04.1` |
 
-## Devel Release Process
-
-Below is the procedure used to release ubuntu-advantage-client to an Ubuntu series. It makes the following assumptions:
-* The current ubuntu devel release is impish
-* We are releasing version 27.1
-* The previous release was 27.0.2
-* The commits for 27.0.2 and 27.1 on https://github.com/canonical/ubuntu-advantage-client are tagged with `27.0.2` and `27.1` respectively.
-  * These tags should be on the correct commits on the `release-27` branch
-  * `27.1`, which is the tag of the release we are making, has not yet been uploaded to `pkg/ubuntu/devel`
-
- 1. git-ubuntu clone ubuntu-advantage-tools; cd ubuntu-advantage-tools
- 2. git remote add upstream [e-mail]:canonical/ubuntu-advantage-client.git
- 3. git fetch upstream
- 4. git rebase --onto pkg/ubuntu/devel 27.0.2 27.1
- 5. git checkout -B upload-27.1-impish # to create a new local branch name based on your detached branch in step 4
- 6. Make sure the changelog version contains the release version on the name (For example, 27.1~21.10.1)
- 7. git push `<your_launchpad_user>` upload-27.1-impish
- 8. Create a PPA for upload reviewers at `https://launchpad.net/~<YOUR_LP_USER>/+activate-ppa`
- 9. Push to your test PPA so upload reviewers can easily install and test packages during review
- ```bash
-    debuild -S
-    dput  ppa:<YOUR_LAUNCHPAD_USER>/ua-client-uploads ./ubuntu-advantage-tools_*_source.changes
-```
- 10. Create a merge proposal for 27.1 which targets `ubuntu/devel`
-     * For an example, see the [27.0.2 merge proposal](https://code.launchpad.net/~chad.smith/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/402459)
- 11. Add 2 review slots for `canonical-server` and `canonical-server-core-reviewers`
-
-## SRU Release Process
-Below is the procedure used to SRU ubuntu-advantage-client to a stable Ubuntu series. It makes the following assumptions:
-* The procedure for the Devel Release Process has just completed
-* A local git branch representing the MP most recently released to the Ubuntu devel release is `upload-27.1-impish`
-
- 1. Create an "upload a new version bug" in https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bugs
-   * Describe the need, provide testing PPA and describe test instructions
-   * For examples, see [27.0](https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1926361) or [20.3](https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/1869980)
- 2. Create a PR for each target series based off your local `release-${UA_VERSION}-impish` branch:
- ```bash
- UA_VERSION=<UA-VERSION>
- SRU_BUG=<SRU-BUG>
- LP_USER=<LAUNCHPAD-USERNAME>
-
- for release in xenial bionic focal groovy hirsute
- do
-  rm -rf ../out
-  rm ubuntu-advantage-*
-  git checkout upload-${UA_VERSION}-impish -B upload-${UA_VERSION}-$release
-  case "${release}" in
-      xenial) version=${UA_VERSION}~16.04.1;;
-      bionic) version=${UA_VERSION}~18.04.1;;
-      focal) version=${UA_VERSION}~20.04.1;;
-      groovy) version=${UA_VERSION}~20.10.1;;
-      hirsute) version=${UA_VERSION}~21.04.1;;
-  esac
-  dch -v ${version} -D ${release} -b  "Backport new upstream release: (LP: #${SRU_BUG}) to $release"
-  git commit -m "changelog backport to ${release}" debian/changelog
-  build-package # to create release-specific dsc files used to upload in step 16
-  sbuild-it ../out/ubuntu-*.dsc
-  git push $LP_USER upload-${UA_VERSION}-$release
- done
- ```
- 3. Create merge proposals for each SRU target release @ `https://code.launchpad.net/~<YOUR_LP_USER></YOUR_LAUNCHPAD_USER>/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/`. Make sure each PR targets your `upload-${UA_VERSION}-impish` branch.
- 4. Add both `canonical-server` and `canonical-server-core-reviewers` as review slots on the MP.
- 5. Upload each release (including impish) to `ppa:ua-client/staging`
- ```bash
- for changes_file in ../out/*changes; do
-   dput ppa:ua-client/staging $changes_file
- done
- ```
- 6. Ping ~Server channel member with upload rights for a review of your MR
- 7. Address MR review comments or file issues for future until MR accepted and uploaded to the [proper upload release queue](https://launchpad.net/ubuntu/hirsute/+queue?queue_state=1&queue_text=ubuntu-advantage-tools)
- 8. Ping [appropriate daily SRU vanguard for acceptance of ua-tools into -proposed](https://wiki.ubuntu.com/StableReleaseUpdates#Publishing)FreeNode #ubuntu-release
- 9. Once [ubuntu-advantage-tools shows up in the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html), perform the [Ubuntu-advantage-client SRU verification steps](https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates)
-10. When SRU verification is complete, mark any SRU-related bugs with 'verification-done' tags as each bug, task, or release verified and completes successfully
-11. Once all SRU bugs are tagged as `verification*-done`, all SRU-bugs should be listed as green in [the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html). It is now time to ping the [current SRU vanguard](https://wiki.ubuntu.com/StableReleaseUpdates#Publishing) for acceptance of ubuntu-advantage-tools into -updates
+## Process
 
-## Ubuntu PRO Release Process
 
-Below is the procedure used to release ubuntu-advantage-tools to Ubuntu PRO images:
+### Background
 
- 1. [Open Daily PPA copy-package operation](https://code.launchpad.net/~ua-client/+archive/ubuntu/daily/+copy-packages)
- 2. Check Trusty, Xenial, Bionic package
- 3. Select Destination PPA: UA Client Premium [~ua-client/ubuntu/staging]
- 4. Select Destination series: The same series
- 5. Copy options: "Copy existing binaries"
- 6. Click Copy packages
- 7. Notify Pro Image creators about expected Premium PPA version (patviafore/rcj/powersj)
+The release process for ubuntu-advantage-tools has three overarching steps/goals.
+
+1. Release to our team infrastructure. This includes Github and the `ua-client` PPAs.
+2. Release to the latest ubuntu devel release.
+3. Release to the supported ubuntu past releases via [SRU](https://wiki.ubuntu.com/StableReleaseUpdates) using the [ubuntu-advantage-tools specific SRU process](https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates).
 
+Generally speaking, these steps happen in order, but there is some overlap. Also we may backtrack if issues are found part way through the process.
 
-## Release to PPA
+An average release should take somewhere between 10 and 14 calendar days if things go smoothly, starting at the decision to release and ending at the new version being available in all supported ubuntu releases. Note that it is not 2 weeks of full time work. Most of the time is spent waiting for review or sitting in proposed.
 
-We manually upload the packages to our staging/stable PPAs. If you want to cut a new release and
-upload to one of these PPAs, follow these steps:
+### Prerequisites
+
+If this is your first time releasing ubuntu-advantage-tools, you'll need to do the following before getting started:
+
+* Add the team helper scripts to your PATH: [uss-tableflip](https://github.com/canonical/uss-tableflip).
+* If you don't yet have a gpg key set up, follow the instructions
+  [here](https://help.launchpad.net/YourAccount/ImportingYourPGPKey) to create a key,
+  publish it to `hkp://keyserver.ubuntu.com`, and import it into Launchpad.
+* Before you run `sbuild-it` for the first time, you'll need to set up a chroot for each Ubuntu release.
+  Follow [these instructions](https://gist.github.com/smoser/14df5f0cd621e10d2282d7c90345e322#new-sbuild-creation)
+  to create a chroot for each supported release.
+* You must have launchpad already properly configured in your system in order to upload packages to the PPAs. Follow [this guide](https://help.launchpad.net/Packaging/PPA/Uploading) to get set up.
+
+### I. Preliminary/staging release to team infrastructure
+1. Create a release PR
+
+    a. Move the desired commits from our `main` branch onto the desired release branch
+
+      * This step is currently not well defined. We currently are using `release-27` for all `27.X` releases and have been cherry-picking/rebasing all commits from `main` into this branch for a release.
+
+    b Create a new entry in the `debian/changelog` file:
 
- 1. Do a `git cherry-pick` on the commits that should be included in the release
- 2. Update the debian/changelog file:
-    * Create a new entry in the `debian/changelog` file:
       * You can do that by running ` dch --newversion <version-name>`
-      * Remember to update the release from `UNRELEASED` to the most recently supported
-        ubuntu release
-    * Populate `debian/changelog` with the commits you have cherry-picked
+      * Remember to update the release from `UNRELEASED` to the ubuntu/devel release. Edit the version to look like: `27.2~21.10.1`, with the appropriate ua and ubuntu/devel version numbers.
+      * Populate `debian/changelog` with the commits you have cherry-picked
       * You can do that by running `git log <first-cherry-pick-commit>..<last-cherry-pick-commit> | log2dch`
-      * This will generate a list of commits that could be included in the changelog. If you don't
-        have `log2dch`, you can get it from the [uss-tableflip](https://github.com/canonical/uss-tableflip)
+        * This will generate a list of commits that could be included in the changelog.
       * You don't need to include all of the commits generated. Remember that the changelog should
         be read by the user to understand the new features/modifications in the package. If you
         think a commit will not add that much to the user experience, you can drop it from the
         changelog
-      * To structure the changelog you can use the other entries as example. But we basically try
-        keep this order: debian changes, new features/modifications, testing
- 3. Start building the package:
-    * *WARNING* Build the package in a clean environment. The reason for that is because the package
-      will contain everything that it is present in the folder. If you are storing credentials or
-      other sensible development information in your folder, they will be uploaded too when we send
-      the package to the ppa. A clean environment is the safest way to perform this.
-    * Build the necessary artifacts that allow building the package
-      * Guarantee that you have a gpg key in the system. You will use that gpg key to sign the
-        package.
-        * If you don't yet have a gpg key set up, follow the instructions
-          [here](https://help.launchpad.net/YourAccount/ImportingYourPGPKey) to create a key,
-          publish it to `hkp://keyserver.ubuntu.com`, and import it into Launchpad.
-      * We can achieve that by running the `build-package` command when your current folder is the
-        top of source tree. This script is also found on the [uss-tableflip](https://github.com/canonical/uss-tableflip) repo.
+      * To structure the changelog you can use the other entries as example. But we basically try to
+        keep this order: debian changes, new features/modifications, testing. Within each section, bullet points should be alphabetized.
+        
+    c. Create a PR on github into the release branch. Ask in the UA channel on mattermost for review.
+
+    d. When reviewing the release PR, please use the following guidelines when reviewing the new changelog entry:
+
+       * Is the version correctly updated ? We must ensure that the new version on the changelog is
+         correct and it also targets the latest Ubuntu release at the moment.
+       * Is the entry useful for the user ? The changelog entries should be user focused, meaning
+         that we should only add entries that we think users will care about (i.e. we don't need
+         entries when fixing a test, as this doesn't provide meaningful information to the user)
+       * Is this entry redundant ? Sometimes we may have changes that affect separate modules of the
+         code. We should have an entry only for the module that was most affected by it
+       * Is the changelog entry unique ? We need to verify that the changelog entry is not already
+         reflected in an earlier version of the changelog. If it is, we need not only to remove but double
+         check the process we are using to cherry-pick the commits
+       * Is this entry actually reflected on the code ? Sometimes, we can have changelog entries
+         that are not reflected in the code anymore. This can happen during development when we are
+         still unsure about the behavior of a feature or when we fix a bug that removes the code
+         that was added. We must verify each changelog entry that is added to be sure of their
+         presence in the product.
+
+2. After the release PR is merged, tag the head of the release branch with the version number, e.g. `27.1`. Push this tag to Github.
+
+3. Build the package for all Ubuntu releases and upload to `ppa:ua-client/staging`
+
+    a. Clone the repository in a clean directory and switch to the release branch
+      * *WARNING* Build the package in a clean environment. The reason for that is because the package
+        will contain everything that it is present in the folder. If you are storing credentials or
+        other sensible development information in your folder, they will be uploaded too when we send
+        the package to the ppa. A clean environment is the safest way to perform this.
+
+    b. Edit the changelog:
+      * List yourself as the author of this release.
+      * Edit the version number to look like: `27.2~20.04.1-rc1` (`<version>~<ubuntu-release-number>.<revno>-rc<release-candidate-number>`)
+      * Edit the ubuntu release name. Start with the ubuntu/devel release (e.g. `impish`).
+      * `git commit -m "throwaway"` Do **not** push this commit!
+
+    c. `build-package`
       * This script will generate all the package artifacts in the parent directory as `../out`.
-    * Verify if we can build the package:
-      * We can achieve that by running the `sbuild-it` command. This script is also found on the
-        [uss-tableflip](https://github.com/canonical/uss-tableflip) repo.
-      * Before you run `sbuild-it` for the first time, you'll need to set up a chroot for each Ubuntu release.
-        Follow [these instructions](https://gist.github.com/smoser/14df5f0cd621e10d2282d7c90345e322#new-sbuild-creation)
-        to create a chroot for each supported release.
-      * To use it, you can just run `sbuild-it ../out/<package_name>.dsc
-      * If the package was built sucessfully, you can move to the next step.
- 4. Repeat that for older ubuntu releases:
-    * Currently, we test this build process for `Trusty(14.04)`, `Xenial(16.04)`, `Bionic(18.04)`,
-      `Focal(20.10)`, `Groovy(20.10)` and `Hirsute(21.04)`
-    * To test this other releases, just change the changelog to target those releases.
-      PS: remember to also change the version number on the changelog. For example, suppose
-      the new version is `1.1~20.04.1`. If you want to test Bionic now, change it to
-      `1.1~18.04.1`.
-    * Commit those changes and perform the `build-package` and `sbuild-it` steps for the release.
-      * These commits are just local commits for this build process - do not push them to remote repository.
- 5. After all of the releases are tested, we can start uploading to the ppa. For each release, run
-    the command `dput ppa:ua-client/stable ../out/<package_name>_source.changes`
-    * Run this command for each release you are going to upload
-    * Remember to have launchpad already properly configured in your system to allow you uploading
-      packages to the ppa.
+
+    d. `sbuild-it ../out/<package_name>.dsc`
+      * If this succeeds move on. If this fails, debug and fix before continuing.
+
+    e. Repeat 3.b through 3.d for all supported Ubuntu Releases
+      * PS: remember to also change the version number on the changelog. For example, suppose
+        the new version is `1.1~20.04.1-rc1`. If you want to test Bionic now, change it to
+        `1.1~18.04.1-rc1`.
+
+    f. For each release, dput to the staging PPA:
+      * `dput ppa:ua-client/staging ../out/<package_name>_source.changes`
+      * After each `dput` wait for the "Accepted" email from Launchpad before moving on.
+
+### II. Release to Ubuntu (devel and SRU)
+
+> Note: `impish` is used throughout as a reference to the current devel release. This will change.
+
+1. Prepare SRU Launchpad bugs.
+
+    a. We do this even before a succesful merge into ubuntu/devel because the context added to these bugs is useful for the Server Team reviewer.
+
+    b. Create a new bug on Launchpad for ubuntu-advantage-tools and use the format defined [here](https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates#SRU_Template) for the description.
+      * The title should be in the format `[SRU] ubuntu-advantage-tools (27.1 -> 27.2) Xenial, Bionic, Focal, Hirsute`, substituting version numbers and release names as necessary.
+    
+    c. For each Launchpad bug fixed by this release (which should all be referenced in our changelog), add the SRU template to the description and fill out each section.
+      * Leave the original description in the bug at the bottom under the header `[Original Description]`.
+      * For the testing steps, include steps to reproduce the bug. Then include instructions for adding `ppa:ua-client/staging`, and steps to verify the bug is no longer present.
+
+2. Set up the Merge Proposal (MP) for ubuntu/devel
+
+    a. `git-ubuntu clone ubuntu-advantage-tools; cd ubuntu-advantage-tools`
+
+    b. `git remote add upstream [e-mail]:canonical/ubuntu-advantage-client.git`
+
+    c. `git fetch upstream`
+
+    d. `git rebase --onto pkg/ubuntu/devel <last-version-tag> <this-version-tag>`
+      * e.g. `git rebase --onto pkg/ubuntu/devel 27.0.2 27.1`
+      * You may need to resolve conflicts, but hopefully these will be minimal.
+      * You'll end up in a detached state
+
+    e. `git checkout -B upload-<this-version>-impish`
+      * This creates a new local branch name based on your detached branch
+
+    f. Make sure the changelog version contains the release version in the name (For example, `27.1~21.10.1`)
+
+    g. `git push <your_launchpad_user> upload-<this-version>-impish`
+
+    h. On Launchpad, create a merge proposal for this version which targets `ubuntu/devel`
+      * For an example, see the [27.0.2 merge proposal](https://code.launchpad.net/~chad.smith/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/+merge/402459)
+      * Add 2 review slots for `canonical-server` and `canonical-server-core-reviewers`
+3. Set up the MP for past Ubuntu releases based on the ubuntu/devel PR
+
+    a. Create a PR for each target series based off your local `release-${UA_VERSION}-impish` branch:
+    ```bash
+    UA_VERSION=<UA-VERSION>
+    SRU_BUG=<SRU-BUG>
+    LP_USER=<LAUNCHPAD-USERNAME>
+
+    for release in xenial bionic focal groovy hirsute
+    do
+      rm ubuntu-advantage-*
+      git checkout upload-${UA_VERSION}-impish -B upload-${UA_VERSION}-$release
+      case "${release}" in
+          xenial) version=${UA_VERSION}~16.04.1;;
+          bionic) version=${UA_VERSION}~18.04.1;;
+          focal) version=${UA_VERSION}~20.04.1;;
+          groovy) version=${UA_VERSION}~20.10.1;;
+          hirsute) version=${UA_VERSION}~21.04.1;;
+      esac
+      dch -v ${version} -D ${release} -b  "Backport new upstream release: (LP: #${SRU_BUG}) to $release"
+      git commit -m "changelog backport to ${release}" debian/changelog
+      git push $LP_USER upload-${UA_VERSION}-$release
+    done
+    ```
+
+    b. Create merge proposals for each SRU target release @ `https://code.launchpad.net/~<YOUR_LP_USER></YOUR_LAUNCHPAD_USER>/ubuntu/+source/ubuntu-advantage-tools/+git/ubuntu-advantage-tools/`. Make sure each MP targets your `upload-${UA_VERSION}-impish` branch (the branch you are MP-ing into ubuntu/devel).
+
+    c. Add both `canonical-server` and `canonical-server-core-reviewers` as review slots on each MP.
+
+4. Server Team Review
+
+    a. Ask in ~Server for a review of your MPs. Include a link to the primary MP into ubuntu/devel and mention the other MPs are only changelog MPs for the SRUs into past releases.
+    
+    b. If they request changes, create a PR into `main` on github and ask UAClient team for review. After a merge, open another PR on github, cherry-picking the change into the release branch. After that is merged, cherry-pick the commit into your `upload-<this-version>-impish` branch and push to launchpad. Then notify the Server Team member that you have addressed their requests. (This can probably be simplified).
+      * Some issues may just be filed for addressing in the future if they are not urgent or pertinent to this release.
+      * Unless the changes are very minor, or only testing related, you should upload a new release candidate version to `ppa:ua-client/staging` as descibed in I.3.
+
+    c. Once review is complete and approved, confirm that Ubuntu Server approver will be tagging the PR with the appropriate `upload/<version>` tag so git-ubuntu will import rich commit history.
+
+    d. Check `rmadison ubuntu-advantage-tools` for updated version in devel release
+
+    e. Confirm availability in <devel>-updates pocket via `lxc launch ubuntu-daily:impish dev-i; lxc exec dev-i -- apt update; lxc exec dev-i -- apt-cache policy ubuntu-advantage-tools`
+      * Note that any changes to the code after this point will likely require a bump in the patch version of the release.
+
+    f. Ask Ubuntu Server approver if they also have upload rights to the proposed queue. If they do, request that they upload ubuntu-advantage-tools for all releases. If they do not, ask in ~Server channel for a Ubuntu Server team member with upload rights for an upload review of the MP for the proposed queue.
+
+    g. Once upload review is complete and approved, confirm that Ubuntu Server approver will upload ua-tools via dput to the `-proposed` queue.
+
+    h. Check the [-proposed release queue](https://launchpad.net/ubuntu/xenial/+queue?queue_state=1&queue_text=ubuntu-advantage-tools) for presence of ua-tools in unapproved state for each supported release. Note: libera chat #ubuntu-release IRC channel has a bot that reports queued uploads of any package in a message like "Unapproved: ubuntu-advantage-tools .. version".
+
+5. SRU Review
+
+    a. Once unapproved ua-tools package is listed in the pending queue for each target release, [ping appropriate daily SRU vanguard for review of ua-tools into -proposed](https://wiki.ubuntu.com/StableReleaseUpdates#Publishing)via the libera.chat #ubuntu-release channel
+
+    b. As soon as the SRU vanguard approves the packages, a bot in #ubuntu-release will announce that ubuntu-advantage-tools is accepted into the applicable -proposed pockets, or the [Xenial -proposed release rejection queue](https://launchpad.net/ubuntu/xenial/+queue?queue_state=4&queue_text=ubuntu-advantage-tools) will contain a reason for rejections. Double check the SRU process bug for any actionable review feedback.
+
+    c. Once accepted into `-proposed` by an SRU vanguard [ubuntu-advantage-tools shows up in the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html), check `rmadison ubuntu-advantage-tools | grep -proposed` to see if the upload exists in -proposed yet.
+
+    d. Confirm availability in <devel>-proposed pocket via
+    ```bash
+    cat > setup_proposed.sh <<EOF
+    #/bin/bash
+    mirror=http://archive.ubuntu.com/ubuntu
+    echo deb \$mirror \$(lsb_release -sc)-proposed main | tee /etc/apt/sources.list.d/proposed.list
+    apt-get update -q;
+    apt-get install -qy ubuntu-advantage-tools;
+    apt-cache policy ubuntu-advantage-tools;
+    EOF
+
+    lxc launch ubuntu-daily:impish dev-i;
+    lxc file push setup_proposed.sh
+    lxc exec dev-i -- bash /setup_proposed.sh
+    ```
+
+    e. Once [ubuntu-advantage-tools shows up in the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html), perform the [Ubuntu-advantage-client SRU verification steps](https://wiki.ubuntu.com/UbuntuAdvantageToolsUpdates). This typically involves running all behave targets with `UACLIENT_BEHAVE_ENABLE_PROPOSED=1 UACLIENT_BEHAVE_CHECK_VERSION=<this-version>` and saving the output.
+
+    f. After all tests have passed, tarball all of the output files and upload them to the SRU bug with a message that looks like this:
+    ```
+    We have run the full ubuntu-advantage-tools integration test suite against the version in -proposed. The results are attached. All tests passed (or call out specific explained failures).
+    
+    You can verify the correct version was used by checking the output of the first test in each file, which prints the version number.
+
+    I am marking the verification done for this SRU.
+    ```
+    Change the tags on the bug from `verification-needed` to `verification-done` (including the verification tags for each release).
+
+    g. For any other related Launchpad bugs that are fixed in this release. Perform the verification steps necessary for those bugs and mark them `verification-done` as needed. This will likely involve following the test steps, but instead of adding the staging PPA, enabling -proposed.
+
+    h. Once all SRU bugs are tagged as `verification*-done`, all SRU-bugs should be listed as green in [the pending_sru page](https://people.canonical.com/~ubuntu-archive/pending-sru.html).
+    
+    i. After the pending_sru page says that ubuntu-advantage-tools has been in proposed for 7 days, it is now time to ping the [current SRU vanguard](https://wiki.ubuntu.com/StableReleaseUpdates#Publishing) for acceptance of ubuntu-advantage-tools into -updates.
+
+### III. Final release to team infrastructure
+
+1. Ensure the version tag is correct on github. The `version` git tag should point to the commit that was released as that version to ubuntu -updates. If changes were made in response to feedback during the release process, the tag may have to be moved.
+2. Perform the steps from `I.3` above but don't include a `-rcX` in the version name, and upload to `ppa:ua-client/stable` instead of staging.
+3. Bring in any changes that were made to the release branch into `main` via PR (e.g. Changelog edits).
+
+## Ubuntu PRO Release Process
+
+Below is the procedure used to release ubuntu-advantage-tools to Ubuntu PRO images:
+
+ 1. [Open Daily PPA copy-package operation](https://code.launchpad.net/~ua-client/+archive/ubuntu/daily/+copy-packages)
+ 2. Check Xenial, Bionic, Focal, Hirsute, Impish packages
+ 3. Select Destination PPA: UA Client Premium [~ua-client/ubuntu/staging]
+ 4. Select Destination series: The same series
+ 5. Copy options: "Copy existing binaries"
+ 6. Click Copy packages
+ 7. Notify Pro Image creators about expected Premium PPA version (patviafore/powersj)
+ 8. Once new PRO AMIs are publicly available run `./tools/refresh-aws-pro-ids` to update AMIs we test during CI runs
diff --git a/debian/changelog b/debian/changelog
index 266050a..470a90c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,77 @@
+ubuntu-advantage-tools (27.3~21.10.1) impish; urgency=medium
+
+  * d/tools.postinst:
+    - consider cloud to be "none" on any cloud-id error
+    - purge old ua-messaging.timer/service files
+    - keep ua-timer.timer disabled if ua-messaging.timer was disabled by
+      the user
+    - properly configure both ubuntu-advantage-timer and
+      ubuntu-advantage-licence-check logs
+  * d/tools.postrm:
+    - remove ubuntu-advantage-timer and ubuntu-advantage-license-check logs
+      during purge
+  * systemd:
+    - remove ua-messaging.timer/service
+    - add new ua-timer.timer that runs every 6 hours
+    - add new ua-license_check.timer that runs every 5 minutes only if
+      activated by ua-license-check.path
+  * New upstream release 27.3 (LP: #1942929)
+    - ros:
+      + add beta support to enable ros and ros-updates
+      + add support for "required services" so that esm-infra and esm-apps
+        get auto-enabled when enabling ros or ros-updates
+      + add support for "dependent services" so that user gets prompted to
+        disable ros/ros-updates if they disable esm-infra/esm-apps
+    - fips:
+      + allow fips on GCP bionic now that optimized kernel is ready
+      + disallow enabling fips on focal on clouds until cloud-optimized focal
+        fips-certified kernel is ready (LP: #1939449, LP: #1939932)
+      + print warning about generic fips kernel if cloud-id fails
+    - cloud:
+      + rely only on cloud-id to determine cloud type (LP: #1940131)
+      + catch errors when determining cloud type
+        (LP: #1938207, LP: #1944676) (GH: #1541)
+    - azure:
+      + bump IMDS API version to support Azure published images
+    - cli:
+      + collect-logs command that creates a tar file with debug-relevant logs
+        and status info (GH: #463)
+      + clean locks on exceptions more thoroughly to avoid false "Operation in
+        progress" status messages
+      + retain past service state after detach
+      + shows better error message when a port value in a proxy is invalid
+    - non-unicode locale support:
+      + remove unicode-only characters from help file
+      + don't print unicode-only characters in ua fix if non-utf8 locale
+        (GH: #1463)
+    - logrotate:
+      + add logrotate functionality for ubuntu-advantage-timer.log.
+      + Fix root:root logrotate permissions.
+    - ua-timer.timer:
+      + introduce a single systemd timer to handle ua recurring jobs
+      + timer runs every 2 hours to support most frequent timer job
+      + recurring job intervals are configurable in uaclient.conf
+      + individual jobs are disabled if their interval is set to 0
+      - status job:
+        + update ua status every 12 hours
+      - messaging job:
+        + update APT/MOTD ESM messaging every 6 hours
+      - metering job:
+        + disabled until infrastructure is ready
+        + for attached machines only, periodically update contract server with
+          status information for proper contract metering
+    - ua-license-check.timer:
+      + only runs on LTS GCP instances that are not attached
+      + runs every 5 minutes to check if gcp instance has license required to
+        auto-attach
+    - logs:
+      + fixes duplicate logging (GH: #553)
+    - tests and support:
+      + remove groovy integration tests
+      + various improvements to integration tests
+
+ -- Grant Orndorff <[e-mail]>  Tue, 21 Sep 2021 09:02:06 -0400
+
 ubuntu-advantage-tools (27.2.2~21.10.1) impish; urgency=medium
 
   * d/tools.postinst:
diff --git a/debian/rules b/debian/rules
index 0b8c7e6..83680bb 100755
--- a/debian/rules
+++ b/debian/rules
@@ -54,11 +54,15 @@ override_dh_gencontrol:
 override_dh_systemd_enable:
 	dh_systemd_enable -pubuntu-advantage-pro ua-auto-attach.service
 	dh_systemd_enable -pubuntu-advantage-tools ua-reboot-cmds.service
-	dh_systemd_enable -pubuntu-advantage-tools ua-messaging.timer
-	dh_systemd_enable -pubuntu-advantage-tools ua-messaging.service
+	dh_systemd_enable -pubuntu-advantage-tools ua-timer.timer
+	dh_systemd_enable -pubuntu-advantage-tools ua-timer.service
+	dh_systemd_enable -pubuntu-advantage-tools ua-license-check.timer
+	dh_systemd_enable -pubuntu-advantage-tools ua-license-check.service
+	dh_systemd_enable -pubuntu-advantage-tools ua-license-check.path
 
 override_dh_systemd_start:
-	dh_systemd_start -pubuntu-advantage-tools ua-messaging.timer
+	dh_systemd_start -pubuntu-advantage-tools ua-timer.timer
+	dh_systemd_start -pubuntu-advantage-tools ua-license-check.path
 
 override_dh_auto_install:
 	dh_auto_install --destdir=debian/ubuntu-advantage-tools
diff --git a/debian/ubuntu-advantage-tools.logrotate b/debian/ubuntu-advantage-tools.logrotate
index 1dede3f..76e6b47 100644
--- a/debian/ubuntu-advantage-tools.logrotate
+++ b/debian/ubuntu-advantage-tools.logrotate
@@ -1,4 +1,7 @@
-/var/log/ubuntu-advantage.log {
+# use the root group by default, since this is the owning group
+# of /var/log/ubuntu-advantage*.log files.
+/var/log/ubuntu-advantage*.log {
+    su root root
     rotate 6
     monthly
     compress
diff --git a/debian/ubuntu-advantage-tools.postinst b/debian/ubuntu-advantage-tools.postinst
index f99c02e..ab9eddb 100644
--- a/debian/ubuntu-advantage-tools.postinst
+++ b/debian/ubuntu-advantage-tools.postinst
@@ -32,6 +32,9 @@ ESM_APPS_APT_SOURCE_FILE="$APT_SRC_DIR/ubuntu-esm-apps.list"
 FIPS_APT_SOURCE_FILE="$APT_SRC_DIR/ubuntu-fips.list"
 
 OLD_CLIENT_FIPS_PPA="private-ppa.launchpad.net/ubuntu-advantage/fips/ubuntu"
+UA_TIMER_NAME="ua-timer.timer"
+OLD_MESSAGING_TIMER="ua-messaging.timer"
+OLD_MESSAGING_TIMER_MASKED_LOCATION="/etc/systemd/system/timers.target.wants/$OLD_MESSAGING_TIMER"
 
 ESM_APT_PREF_FILE_TRUSTY="$APT_PREFERENCES_DIR/ubuntu-esm-trusty"
 ESM_INFRA_OLD_APT_PREF_FILE_TRUSTY="$APT_PREFERENCES_DIR/ubuntu-esm-infra-trusty"
@@ -46,6 +49,9 @@ SYSTEMD_HELPER_ENABLED_AUTO_ATTACH_DSH="/var/lib/systemd/deb-systemd-helper-enab
 SYSTEMD_HELPER_ENABLED_WANTS_LINK="/var/lib/systemd/deb-systemd-helper-enabled/multi-user.target.wants/ua-auto-attach.service"
 
 REBOOT_CMD_MARKER_FILE="/var/lib/ubuntu-advantage/marker-reboot-cmds-required"
+LICENSE_CHECK_MARKER_FILE="/var/lib/ubuntu-advantage/marker-license-check"
+
+MACHINE_TOKEN_FILE="/var/lib/ubuntu-advantage/private/machine-token.json"
 
 # Rename apt config files for ua services removing ubuntu release names
 redact_ubuntu_release_from_ua_apt_filenames() {
@@ -290,10 +296,7 @@ notify_wrong_fips_metapackage_on_cloud() {
 
     fips_metapkg="ubuntu-fips"
 
-    cloud_id=""
-    if command -v "cloud-id" > /dev/null && [ -f /run/cloud-init/instance-data.json ] ; then
-      cloud_id=$(cloud-id)
-    fi
+    cloud_id=$(cloud-id 2>/dev/null) || cloud_id=""
 
     # If the package is not installed, we don't want the postinst script to fail
     fips_installed=$(dpkg-query -W --showformat='${db:Status-Status}\n' $fips_metapkg 2>/dev/null || true)
@@ -305,6 +308,69 @@ notify_wrong_fips_metapackage_on_cloud() {
     fi
 }
 
+enable_periodic_license_check() {
+    cloud_id=$(cloud-id 2>/dev/null) || cloud_id=""
+    if echo "$cloud_id" | grep -q "^gce"; then
+        if check_is_lts "${UBUNTU_CODENAME}"; then
+            if [ ! -f $MACHINE_TOKEN_FILE ]; then
+                touch $LICENSE_CHECK_MARKER_FILE
+            fi
+        fi
+    fi
+}
+
+disable_new_timer_if_old_timer_already_disabled() {
+    # If the user has disabled the ua-messaging
+    # then we will assume that the user would want the
+    # ua-timer to be disabled as well. In that case, we will
+    # disable the ua-timer here.
+    PREVIOUS_PKG_VER=$1
+
+    # We should only perform this check on UA version that have the
+    # ua-messaging.timer: 27.0 until 27.2. This will also guarantee
+    # that on 27.3 and forward, we will not run this logic.
+    if dpkg --compare-versions "$PREVIOUS_PKG_VER" lt "27.0~" \
+       || dpkg --compare-versions "$PREVIOUS_PKG_VER" ge "27.3~"; then
+        return
+    fi
+    if ! deb-systemd-helper --quiet was-enabled $OLD_MESSAGING_TIMER; then
+        # We have the following entry on our rules file:
+        #    dh_systemd_enable -pubuntu-advantage-tools ua-timer.timer
+        # This rule will append some code at the end of the postinst script
+        # that checks if the ua-timer.timer was already enabled on the system.
+        # This means that if we manually disable the service here, that logic will
+        # still enable it in the end of the postinst script.
+        # Because of this logic we are now manually enabling ua-timer.timer here
+        # and then we manually disable it. This will guarantee that the was-enabled
+        # logic introduced by the rules file will not be triggered and we will not
+        # re-enable the ua-timer.timer service after calling this function.
+        echo "$OLD_MESSAGING_TIMER was disabled. Disabling $UA_TIMER_NAME." >&2
+        deb-systemd-helper enable $UA_TIMER_NAME > /dev/null 2>&1 || true
+        deb-systemd-helper disable $UA_TIMER_NAME > /dev/null 2>&1 || true
+    fi
+}
+
+remove_old_systemd_timers() {
+    # These are the commands that are run when the package is purged.
+    # Since we actually want to remove this service from now on
+    # we have replicated that behavior here
+    if [ -L $OLD_MESSAGING_TIMER_MASKED_LOCATION ]; then
+        if [ -x "/usr/bin/deb-systemd-helper" ]; then
+            deb-systemd-helper purge ua-messaging.timer > /dev/null || true
+            deb-systemd-helper unmask ua-messaging.timer > /dev/null || true
+        fi
+    fi
+}
+
+configure_log_file() {
+    log_path=$1
+    if [ ! -f $log_path ]; then
+        touch $log_path
+    fi
+    chmod 0600 $log_path
+    chown root:root $log_path
+}
+
 case "$1" in
     configure)
       PREVIOUS_PKG_VER=$2
@@ -362,11 +428,10 @@ case "$1" in
         fi
       fi
 
-      if [ ! -f /var/log/ubuntu-advantage.log ]; then
-          touch /var/log/ubuntu-advantage.log
-      fi
-      chmod 0600 /var/log/ubuntu-advantage.log
-      chown root:root /var/log/ubuntu-advantage.log
+      configure_log_file /var/log/ubuntu-advantage.log
+      configure_log_file /var/log/ubuntu-advantage-timer.log
+      configure_log_file /var/log/ubuntu-advantage-license-check.log
+
       private_dir="/var/lib/ubuntu-advantage/private"
       if [ -d "$private_dir" ]; then
           chmod 0700 "$private_dir"
@@ -378,6 +443,9 @@ case "$1" in
         fi
       fi
       mark_reboot_for_fips_pro
+      enable_periodic_license_check
+      disable_new_timer_if_old_timer_already_disabled $PREVIOUS_PKG_VER
+      remove_old_systemd_timers
       ;;
 esac
 
diff --git a/debian/ubuntu-advantage-tools.postrm b/debian/ubuntu-advantage-tools.postrm
index fb84664..978b492 100644
--- a/debian/ubuntu-advantage-tools.postrm
+++ b/debian/ubuntu-advantage-tools.postrm
@@ -14,6 +14,8 @@ remove_cache_dir(){
 
 remove_logs(){
     rm -f /var/log/ubuntu-advantage.log*
+    rm -f /var/log/ubuntu-advantage-timer.log*
+    rm -f /var/log/ubuntu-advantage-license-check.log*
 }
 
 remove_gpg_files(){
diff --git a/dev-requirements.txt b/dev-requirements.txt
index 13c99e2..c373b55 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -1,4 +1,5 @@
-# The black version is also in .pre-commit-config.yaml; make sure to update
-# both together
+# The black and isort versions are also in .pre-commit-config.yaml; make sure
+# to update both together
 black==19.3b0
+isort==5.8.0
 pre-commit
diff --git a/features/_version.feature b/features/_version.feature
index e39601c..655f915 100644
--- a/features/_version.feature
+++ b/features/_version.feature
@@ -22,11 +22,11 @@ Feature: UA is expected version
             | xenial  |
             | bionic  |
             | focal   |
-            | groovy  |
             | hirsute |
 
     @series.all
     @uses.config.check_version
+    @uses.config.machine_type.lxd.container
     @upgrade
     Scenario Outline: Check ua version
         Given a `<release>` machine with ubuntu-advantage-tools installed
@@ -40,5 +40,4 @@ Feature: UA is expected version
             | xenial  |
             | bionic  |
             | focal   |
-            | groovy  |
             | hirsute |
diff --git a/features/attach_invalidtoken.feature b/features/attach_invalidtoken.feature
index 722ae82..faee67e 100644
--- a/features/attach_invalidtoken.feature
+++ b/features/attach_invalidtoken.feature
@@ -2,8 +2,9 @@ Feature: Command behaviour when trying to attach a machine to an Ubuntu
          Advantage subscription using an invalid token
 
     @series.all
-    Scenario Outline: Attach command in a machine
-       Given a `<release>` machine with ubuntu-advantage-tools installed
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Attach command failure on invalid token
+        Given a `<release>` machine with ubuntu-advantage-tools installed
         When I verify that running `ua attach INVALID_TOKEN` `with sudo` exits `1`
         Then stderr matches regexp:
             """
@@ -19,11 +20,11 @@ Feature: Command behaviour when trying to attach a machine to an Ubuntu
            | xenial  |
            | bionic  |
            | focal   |
-           | groovy  |
            | hirsute |
 
     @uses.config.contract_token_staging_expired
     @series.all
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attach command failure on expired token
        Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attempt to attach `contract_token_staging_expired` with sudo
@@ -38,5 +39,4 @@ Feature: Command behaviour when trying to attach a machine to an Ubuntu
            | xenial  |
            | bionic  |
            | focal   |
-           | groovy  |
            | hirsute |
diff --git a/features/attach_validtoken.feature b/features/attach_validtoken.feature
index a164633..84e4f30 100644
--- a/features/attach_validtoken.feature
+++ b/features/attach_validtoken.feature
@@ -2,9 +2,29 @@
 Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
         subscription using a valid token
 
-    @series.xenial
-    @series.bionic
-    @series.focal
+    @series.hirsute
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Attached command in a non-lts ubuntu machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua status --all` as non-root
+        Then stdout matches regexp:
+            """
+            SERVICE       ENTITLED  STATUS    DESCRIPTION
+            cc-eal        +yes      +n/a      +Common Criteria EAL2 Provisioning Packages
+            cis           +yes      +n/a      +Center for Internet Security Audit Tools
+            esm-apps      +yes      +n/a      +UA Apps: Extended Security Maintenance \(ESM\)
+            esm-infra     +yes      +n/a      +UA Infra: Extended Security Maintenance \(ESM\)
+            fips          +yes      +n/a      +NIST-certified core packages
+            fips-updates  +yes      +n/a      +NIST-certified core packages with priority security updates
+            livepatch     +yes      +n/a      +Canonical Livepatch service
+            """
+
+        Examples: ubuntu release
+            | release |
+            | hirsute |
+
+    @series.lts
     @uses.config.machine_type.lxd.container
     Scenario Outline: Attach command in a ubuntu lxd container
        Given a `<release>` machine with ubuntu-advantage-tools installed
@@ -38,6 +58,7 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
         """
         SERVICE       ENTITLED  STATUS    DESCRIPTION
         cis          +yes      +disabled        +Center for Internet Security Audit Tools
+        esm-apps     +yes      +enabled  +UA Apps: Extended Security Maintenance \(ESM\)
         esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance \(ESM\)
         fips         +yes      +n/a      +NIST-certified core packages
         fips-updates +yes      +n/a      +NIST-certified core packages with priority security updates
@@ -47,13 +68,15 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
         """
         Enabling default service esm-infra
         """
+        When I run `ua disable esm-apps --assume-yes` with sudo
         When I append the following on uaclient config:
             """
             features:
               allow_beta: true
             """
         And I run `apt update` with sudo
-        And I run `python3 /usr/lib/ubuntu-advantage/ua_update_messaging.py` with sudo
+        And I delete the file `/var/lib/ubuntu-advantage/jobs-status.json`
+        And I run `python3 /usr/lib/ubuntu-advantage/timer.py` with sudo
         And I run `apt install update-motd` with sudo, retrying exit [100]
         And I run `update-motd` with sudo
         Then if `<release>` in `focal` and stdout matches regexp:
@@ -97,7 +120,8 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
         To see these additional updates run: apt list --upgradable
         """
         When I update contract to use `effectiveTo` as `days=-20`
-        And I run `python3 /usr/lib/ubuntu-advantage/ua_update_messaging.py` with sudo
+        And I delete the file `/var/lib/ubuntu-advantage/jobs-status.json`
+        And I run `python3 /usr/lib/ubuntu-advantage/timer.py` with sudo
         And I run `update-motd` with sudo
         Then if `<release>` in `xenial` and stdout matches regexp:
         """
@@ -136,7 +160,27 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
     @uses.config.machine_type.aws.generic
     Scenario Outline: Attach command in an generic AWS Ubuntu VM
        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token` with sudo
+        When I create the file `/tmp/machine-token-overlay.json` with the following:
+        """
+        {
+            "machineTokenInfo": {
+                "contractInfo": {
+                    "resourceEntitlements": [
+                        {
+                            "type": "esm-apps",
+                            "entitled": false
+                        }
+                    ]
+                }
+            }
+        }
+        """
+        And I append the following on uaclient config:
+        """
+        features:
+          machine_token_overlay: "/tmp/machine-token-overlay.json"
+        """
+        And I attach `contract_token` with sudo
         Then stdout matches regexp:
         """
         UA Infra: ESM enabled
@@ -167,9 +211,29 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
 
     @series.all
     @uses.config.machine_type.azure.generic
-    Scenario Outline: Attach command in a ubuntu lxd container
+    Scenario Outline: Attach command in an generic Azure Ubuntu VM
        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token` with sudo
+        When I create the file `/tmp/machine-token-overlay.json` with the following:
+        """
+        {
+            "machineTokenInfo": {
+                "contractInfo": {
+                    "resourceEntitlements": [
+                        {
+                            "type": "esm-apps",
+                            "entitled": false
+                        }
+                    ]
+                }
+            }
+        }
+        """
+        And I append the following on uaclient config:
+        """
+        features:
+          machine_token_overlay: "/tmp/machine-token-overlay.json"
+        """
+        And I attach `contract_token` with sudo
         Then stdout matches regexp:
         """
         UA Infra: ESM enabled
@@ -200,9 +264,29 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
 
     @series.all
     @uses.config.machine_type.gcp.generic
-    Scenario Outline: Attach command in a ubuntu lxd container
+    Scenario Outline: Attach command in an generic GCP Ubuntu VM
        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token` with sudo
+        When I create the file `/tmp/machine-token-overlay.json` with the following:
+        """
+        {
+            "machineTokenInfo": {
+                "contractInfo": {
+                    "resourceEntitlements": [
+                        {
+                            "type": "esm-apps",
+                            "entitled": false
+                        }
+                    ]
+                }
+            }
+        }
+        """
+        And I append the following on uaclient config:
+        """
+        features:
+          machine_token_overlay: "/tmp/machine-token-overlay.json"
+        """
+        And I attach `contract_token` with sudo
         Then stdout matches regexp:
         """
         UA Infra: ESM enabled
@@ -228,197 +312,5 @@ Feature: Command behaviour when attaching a machine to an Ubuntu Advantage
         Examples: ubuntu release livepatch status
            | release | lp_status | fips_status |
            | xenial  | n/a       | n/a         |
-           | bionic  | n/a       | n/a         |
-           | focal   | n/a       | n/a         |
-
-    @series.bionic
-    @uses.config.machine_type.azure.generic
-    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo
-        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
-        And I run `ua enable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            Installing <fips-name> packages
-            <fips-name> enabled
-            A reboot is required to complete install
-            """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                enabled
-            """
-        And I verify that running `apt update` `with sudo` exits `0`
-        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
-        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
-        When I run `apt-cache policy ubuntu-azure-fips` as non-root
-        Then stdout does not match regexp:
-        """
-        .*Installed: \(none\)
-        """
-        When I reboot the `<release>` machine
-        And  I run `uname -r` as non-root
-        Then stdout matches regexp:
-            """
-            azure-fips
-            """
-        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
-        Then I will see the following on stdout:
-        """
-        1
-        """
-        When I run `ua disable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-        """
-        Updating package lists
-        """
-        When I run `apt-cache policy ubuntu-azure-fips` as non-root
-        Then stdout matches regexp:
-        """
-        .*Installed: \(none\)
-        """
-        When I reboot the `<release>` machine
-        Then I verify that `openssh-server` installed version matches regexp `fips`
-        And I verify that `openssh-client` installed version matches regexp `fips`
-        And I verify that `strongswan` installed version matches regexp `fips`
-        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
-        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
-        And I verify that `strongswan-hmac` installed version matches regexp `fips`
-        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
-        Then I will see the following on stdout:
-        """
-        openssh-client was already not hold.
-        openssh-server was already not hold.
-        strongswan was already not hold.
-        """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                disabled
-            """
-
-        Examples: ubuntu release
-           | release | fips-name    | fips-service |fips-apt-source                                        |
-           | bionic  | FIPS         | fips         |https://esm.staging.ubuntu.com/fips/ubuntu bionic/main |
-
-    @series.bionic
-    @uses.config.machine_type.aws.generic
-    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        And I run `ua disable livepatch` with sudo
-        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo
-        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
-        And I run `ua enable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            Installing <fips-name> packages
-            <fips-name> enabled
-            A reboot is required to complete install
-            """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                enabled
-            """
-        And I verify that running `apt update` `with sudo` exits `0`
-        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
-        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
-        When I run `apt-cache policy ubuntu-aws-fips` as non-root
-        Then stdout does not match regexp:
-        """
-        .*Installed: \(none\)
-        """
-        When I reboot the `<release>` machine
-        And  I run `uname -r` as non-root
-        Then stdout matches regexp:
-            """
-            aws-fips
-            """
-        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
-        Then I will see the following on stdout:
-        """
-        1
-        """
-        When I run `ua disable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-        """
-        Updating package lists
-        """
-        When I run `apt-cache policy ubuntu-aws-fips` as non-root
-        Then stdout matches regexp:
-        """
-        .*Installed: \(none\)
-        """
-        When I reboot the `<release>` machine
-        Then I verify that `openssh-server` installed version matches regexp `fips`
-        And I verify that `openssh-client` installed version matches regexp `fips`
-        And I verify that `strongswan` installed version matches regexp `fips`
-        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
-        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
-        And I verify that `strongswan-hmac` installed version matches regexp `fips`
-        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
-        Then I will see the following on stdout:
-        """
-        openssh-client was already not hold.
-        openssh-server was already not hold.
-        strongswan was already not hold.
-        """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                disabled
-            """
-
-        Examples: ubuntu release
-           | release | fips-name    | fips-service |fips-apt-source                                        |
-           | bionic  | FIPS         | fips         |https://esm.staging.ubuntu.com/fips/ubuntu bionic/main |
-
-    @series.xenial
-    @uses.config.machine_type.azure.generic
-    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
-        Given a `xenial` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        Then I verify that running `ua enable <fips_service> --assume-yes` `with sudo` exits `1`
-        And stdout matches regexp:
-        """
-        Ubuntu Xenial does not provide an Azure optimized FIPS kernel
-        """
-
-        Examples: fips
-           | fips_service  |
-           | fips          |
-           | fips-updates  |
-
-    @series.bionic
-    @series.xenial
-    @uses.config.machine_type.gcp.generic
-    Scenario Outline: Attached enable of fips services in an ubuntu gcp vm
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        Then I verify that running `ua enable <fips_service> --assume-yes` `with sudo` exits `1`
-        And stdout matches regexp:
-        """
-        Ubuntu <release_title> does not provide a GCP optimized FIPS kernel
-        """
-
-        Examples: fips
-            | release | release_title | fips_service  |
-            | xenial  | Xenial        | fips          |
-            | xenial  | Xenial        | fips-updates  |
-            | bionic  | Bionic        | fips          |
-            | bionic  | Bionic        | fips-updates  |
+           | bionic  | n/a       | disabled    |
+           | focal   | enabled   | n/a         |
diff --git a/features/attached_commands.feature b/features/attached_commands.feature
index cc4f22a..6ec84d3 100644
--- a/features/attached_commands.feature
+++ b/features/attached_commands.feature
@@ -2,6 +2,7 @@
 Feature: Command behaviour when attached to an UA subscription
 
     @series.all
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached refresh in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -26,6 +27,23 @@ Feature: Command behaviour when attached to an UA subscription
             """
             Successfully refreshed your subscription.
             """
+        When I run `python3 /usr/lib/ubuntu-advantage/timer.py` with sudo
+        And I run `sh -c "ls /var/log/ubuntu-advantage* | sort -d"` as non-root
+        Then stdout matches regexp:
+        """
+        /var/log/ubuntu-advantage-license-check.log
+        /var/log/ubuntu-advantage.log
+        /var/log/ubuntu-advantage-timer.log
+        """
+        When I run `logrotate --force /etc/logrotate.d/ubuntu-advantage-tools` with sudo
+        And I run `sh -c "ls /var/log/ubuntu-advantage* | sort -d"` as non-root
+        # We don't rotate empty log files. That's why the license-check logs are not rotated
+        Then stdout matches regexp:
+        """
+        /var/log/ubuntu-advantage-license-check.log
+        /var/log/ubuntu-advantage.log.1
+        /var/log/ubuntu-advantage-timer.log.1
+        """
 
         Examples: ubuntu release
            | release |
@@ -33,9 +51,9 @@ Feature: Command behaviour when attached to an UA subscription
            | focal   |
            | xenial  |
            | hirsute |
-           | groovy  |
 
     @series.all
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached disable of an already disabled service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -57,9 +75,9 @@ Feature: Command behaviour when attached to an UA subscription
            | focal   |
            | xenial  |
            | hirsute |
-           | groovy  |
 
     @series.lts
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached disable of a service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -72,7 +90,8 @@ Feature: Command behaviour when attached to an UA subscription
         And stderr matches regexp:
             """
             Cannot disable unknown service 'foobar'.
-            Try cc-eal, cis, esm-apps, esm-infra, fips, fips-updates, livepatch.
+            Try cc-eal, cis, esm-apps, esm-infra, fips, fips-updates, livepatch, ros,
+            ros-updates.
             """
         And I verify that running `ua disable esm-infra` `as non-root` exits `1`
         And stderr matches regexp:
@@ -97,30 +116,8 @@ Feature: Command behaviour when attached to an UA subscription
            | focal   |
            | xenial  |
 
-    @series.groovy
-    @series.hirsute
-    Scenario Outline: Attached detach in an ubuntu machine
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token` with sudo
-        And I run `ua status --all` as non-root
-        Then stdout matches regexp:
-            """
-            SERVICE       ENTITLED  STATUS    DESCRIPTION
-            cc-eal        +yes      +n/a      +Common Criteria EAL2 Provisioning Packages
-            cis           +yes      +n/a      +Center for Internet Security Audit Tools
-            esm-apps      +no       +—        +UA Apps: Extended Security Maintenance \(ESM\)
-            esm-infra     +yes      +n/a      +UA Infra: Extended Security Maintenance \(ESM\)
-            fips          +yes      +n/a      +NIST-certified core packages
-            fips-updates  +yes      +n/a      +NIST-certified core packages with priority security updates
-            livepatch     +yes      +n/a      +Canonical Livepatch service
-            """
-
-        Examples: ubuntu release
-            | release |
-            | groovy  |
-            | hirsute |
-
     @series.lts
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached detach in an ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -132,23 +129,27 @@ Feature: Command behaviour when attached to an UA subscription
         When I run `ua detach --assume-yes` with sudo
         Then I will see the following on stdout:
             """
-            Detach will disable the following service:
+            Detach will disable the following services:
+                esm-apps
                 esm-infra
             Updating package lists
+            Updating package lists
             This machine is now detached.
             """
        When I run `ua status --all` as non-root
        Then stdout matches regexp:
-           """
-           SERVICE       AVAILABLE  DESCRIPTION
-           cc-eal        +<cc-eal>   +Common Criteria EAL2 Provisioning Packages
-           cis           +<cis>      +Center for Internet Security Audit Tools
-           esm-apps      +<esm-apps> +UA Apps: Extended Security Maintenance \(ESM\)
-           esm-infra     +yes        +UA Infra: Extended Security Maintenance \(ESM\)
-           fips          +<fips>     +NIST-certified core packages
-           fips-updates  +<fips>     +NIST-certified core packages with priority security updates
-           livepatch     +yes        +Canonical Livepatch service
-           """
+          """
+          SERVICE       AVAILABLE  DESCRIPTION
+          cc-eal        +<cc-eal>   +Common Criteria EAL2 Provisioning Packages
+          cis           +<cis>      +Center for Internet Security Audit Tools
+          esm-apps      +<esm-apps> +UA Apps: Extended Security Maintenance \(ESM\)
+          esm-infra     +yes        +UA Infra: Extended Security Maintenance \(ESM\)
+          fips          +<fips>     +NIST-certified core packages
+          fips-updates  +<fips>     +NIST-certified core packages with priority security updates
+          livepatch     +yes        +Canonical Livepatch service
+          ros           +<ros>      +Security Updates for the Robot Operating System
+          ros-updates   +<ros>      +All Updates for the Robot Operating System
+          """
        And stdout matches regexp:
           """
           This machine is not attached to a UA subscription.
@@ -156,12 +157,13 @@ Feature: Command behaviour when attached to an UA subscription
        And I verify that running `apt update` `with sudo` exits `0`
 
        Examples: ubuntu release
-           | release | esm-apps | cc-eal | cis | fips | fips-update |
-           | bionic  | yes      | no     | yes | yes  | yes         |
-           | focal   | yes      | no     | yes | no   | no          |
-           | xenial  | yes      | yes    | yes | yes  | yes         |
+           | release | esm-apps | cc-eal | cis | fips | fips-update | ros |
+           | bionic  | yes      | no     | yes | yes  | yes         | yes  |
+           | focal   | yes      | no     | yes | yes  | yes         | no  |
+           | xenial  | yes      | yes    | yes | yes  | yes         | yes |
 
     @series.all
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached auto-attach in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -182,9 +184,9 @@ Feature: Command behaviour when attached to an UA subscription
            | focal   |
            | xenial  |
            | hirsute |
-           | groovy  |
 
     @series.all
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached show version in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -203,9 +205,9 @@ Feature: Command behaviour when attached to an UA subscription
            | focal   |
            | xenial  |
            | hirsute |
-           | groovy  |
 
     @series.all
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Unattached status in a ubuntu machine with feature overrides
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I create the file `/tmp/machine-token-overlay.json` with the following:
@@ -253,9 +255,9 @@ Feature: Command behaviour when attached to an UA subscription
            | focal   |
            | xenial  |
            | hirsute |
-           | groovy  |
 
     @series.lts
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached disable of different services in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -274,7 +276,8 @@ Feature: Command behaviour when attached to an UA subscription
         And stderr matches regexp:
             """
             Cannot disable unknown service 'foobar'.
-            Try cc-eal, cis, esm-apps, esm-infra, fips, fips-updates, livepatch.
+            Try cc-eal, cis, esm-apps, esm-infra, fips, fips-updates, livepatch, ros,
+            ros-updates.
             """
         When I run `ua status` with sudo
         Then stdout matches regexp:
@@ -289,6 +292,7 @@ Feature: Command behaviour when attached to an UA subscription
            | xenial  |
 
     @series.all
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Help command on an attached machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -371,6 +375,10 @@ Feature: Command behaviour when attached to an UA subscription
            \(https://ubuntu.com/security/certifications#fips\)
          - livepatch: Canonical Livepatch service
            \(https://ubuntu.com/security/livepatch\)
+         - ros-updates: All Updates for the Robot Operating System
+           \(https://ubuntu.com/robotics/ros-esm\)
+         - ros: Security Updates for the Robot Operating System
+           \(https://ubuntu.com/robotics/ros-esm\)
         """
 
         Examples: ubuntu release
@@ -379,38 +387,9 @@ Feature: Command behaviour when attached to an UA subscription
            | focal   | enabled      |
            | xenial  | enabled      |
            | hirsute | n/a          |
-           | groovy  | n/a          |
-
-    @series.lts
-    Scenario Outline: Purge package after attaching it to a machine
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token` with sudo
-        And I run `touch /etc/apt/preferences.d/ubuntu-esm-infra` with sudo
-        Then I verify that files exist matching `/var/log/ubuntu-advantage.log`
-        And I verify that running `test -d /var/lib/ubuntu-advantage` `with sudo` exits `0`
-        And I verify that files exist matching `/etc/apt/auth.conf.d/90ubuntu-advantage`
-        And I verify that files exist matching `/etc/apt/trusted.gpg.d/ubuntu-advantage-esm-infra-trusty.gpg`
-        And I verify that files exist matching `/etc/apt/sources.list.d/ubuntu-esm-infra.list`
-        And I verify that files exist matching `/etc/apt/preferences.d/ubuntu-esm-infra`
-        When I run `apt-get purge ubuntu-advantage-tools -y` with sudo, retrying exit [100]
-        Then stdout matches regexp:
-        """
-        Purging configuration files for ubuntu-advantage-tools
-        """
-        And I verify that no files exist matching `/var/log/ubuntu-advantage.log`
-        And I verify that no files exist matching `/var/lib/ubuntu-advantage`
-        And I verify that no files exist matching `/etc/apt/auth.conf.d/90ubuntu-advantage`
-        And I verify that no files exist matching `/etc/apt/sources.list.d/ubuntu-*`
-        And I verify that no files exist matching `/etc/apt/trusted.gpg.d/ubuntu-advantage-*`
-        And I verify that no files exist matching `/etc/apt/preferences.d/ubuntu-*`
-
-        Examples: ubuntu release
-           | release |
-           | bionic  |
-           | focal   |
-           | xenial  |
 
     @series.lts
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Enable command with invalid repositories in user machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -418,7 +397,7 @@ Feature: Command behaviour when attached to an UA subscription
         And I run `add-apt-repository ppa:cloud-init-dev/daily -y` with sudo, retrying exit [1]
         And I run `apt update` with sudo
         And I run `sed -i 's/ubuntu/ubun/' /etc/apt/sources.list.d/<ppa_file>.list` with sudo
-        And I run `ua enable esm-infra` with sudo
+        And I verify that running `ua enable esm-infra` `with sudo` exits `1`
         Then stdout matches regexp:
         """
         One moment, checking your subscription first
@@ -433,3 +412,214 @@ Feature: Command behaviour when attached to an UA subscription
            | xenial  | cloud-init-dev-ubuntu-daily-xenial |
            | bionic  | cloud-init-dev-ubuntu-daily-bionic |
            | focal   | cloud-init-dev-ubuntu-daily-focal  |
+
+    @series.all
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Run timer script on an attached machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I run `systemctl stop ua-timer.timer` with sudo
+        And I attach `contract_token` with sudo
+        Then I verify that running `ua config set update_messaging_timer=-2` `with sudo` exits `1`
+        And stderr matches regexp:
+        """
+        Cannot set update_messaging_timer to -2: <value> for interval must be a positive integer.
+        """
+        When I run `python3 /usr/lib/ubuntu-advantage/timer.py` with sudo
+        And I run `cat /var/lib/ubuntu-advantage/jobs-status.json` with sudo
+        Then stdout matches regexp:
+        """"
+        "update_messaging":
+        """
+        And stdout matches regexp:
+        """"
+        "update_status":
+        """
+        When I run `ua config show` with sudo
+        Then stdout matches regexp:
+        """
+        update_messaging_timer  +21600
+        update_status_timer     +43200
+        """
+        When I delete the file `/var/lib/ubuntu-advantage/jobs-status.json`
+        And I run `ua config set update_messaging_timer=0` with sudo
+        And I run `python3 /usr/lib/ubuntu-advantage/timer.py` with sudo
+        And I run `cat /var/lib/ubuntu-advantage/jobs-status.json` with sudo
+        Then stdout does not match regexp:
+        """"
+        "update_messaging":
+        """
+        And stdout matches regexp:
+        """"
+        "update_status":
+        """
+        When I delete the file `/var/lib/ubuntu-advantage/jobs-status.json`
+        And I create the file `/etc/ubuntu-advantage/uaclient.conf` with the following:
+        """
+        contract_url: https://contracts.canonical.com
+        data_dir: /var/lib/ubuntu-advantage
+        log_file: /var/log/ubuntu-advantage.log
+        log_level: debug
+        security_url: https://ubuntu.com/security
+        ua_config:
+          apt_http_proxy: null
+          apt_https_proxy: null
+          http_proxy: null
+          https_proxy: null
+          update_messaging_timer: 14400
+          update_status_timer: 0
+          metering_timer: 0
+        """
+        And I run `python3 /usr/lib/ubuntu-advantage/timer.py` with sudo
+        And I run `cat /var/lib/ubuntu-advantage/jobs-status.json` with sudo
+        Then stdout matches regexp:
+        """"
+        "update_messaging":
+        """
+        And stdout does not match regexp:
+        """"
+        "update_status":
+        """
+        When I delete the file `/var/lib/ubuntu-advantage/jobs-status.json`
+        And I create the file `/etc/ubuntu-advantage/uaclient.conf` with the following:
+        """
+        contract_url: https://contracts.canonical.com
+        data_dir: /var/lib/ubuntu-advantage
+        log_file: /var/log/ubuntu-advantage.log
+        log_level: debug
+        security_url: https://ubuntu.com/security
+        ua_config:
+          apt_http_proxy: null
+          apt_https_proxy: null
+          http_proxy: null
+          https_proxy: null
+          update_messaging_timer: -10
+          update_status_timer: notanumber
+          metering_timer: 0
+        """
+        And I run `python3 /usr/lib/ubuntu-advantage/timer.py` with sudo
+        Then I verify that running `grep "Invalid value for update_messaging interval found in config." /var/log/ubuntu-advantage-timer.log` `with sudo` exits `0`
+        And I verify that running `grep "Invalid value for update_status interval found in config." /var/log/ubuntu-advantage-timer.log` `with sudo` exits `0`
+        And I verify that the timer interval for `update_messaging` is `21600`
+        And I verify that the timer interval for `update_status` is `43200`
+
+        Examples: ubuntu release
+           | release |
+           | xenial  |
+           | bionic  |
+           | focal   |
+           | hirsute |
+
+    @series.lts
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Run timer script on an attached machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I create the file `/tmp/machine-token-overlay.json` with the following:
+        """
+        {
+            "machineTokenInfo": {
+                "contractInfo": {
+                   "id": "testCID"
+                },
+                "machineId": "testMID"
+            }
+        }
+        """
+        And I create the file `/tmp/response-overlay.json` with the following:
+        """
+        {
+            "https://contracts.canonical.com/v1/contracts/testCID/machine-activity/testMID": [
+              {
+                "code": 200,
+                "response": {
+                  "activityToken": "test",
+                  "activityID": "ac-id",
+                  "machineTokenInfo": {
+                      "contractInfo": {
+                          "resourceEntitlements": [
+                              {
+                                  "type": "cc-eal",
+                                  "entitled": false
+                              }
+                          ]
+                      },
+                      "machineId": "new-machine-id"
+                  }
+                }
+              }
+            ]
+        }
+        """
+        And I append the following on uaclient config:
+        """
+        features:
+          machine_token_overlay: "/tmp/machine-token-overlay.json"
+          serviceclient_url_responses: "/tmp/response-overlay.json"
+        """
+        And I run `ua config set metering_timer=14400` with sudo
+        And I run `python3 /usr/lib/ubuntu-advantage/timer.py` with sudo
+        Then I verify that running `grep -q activityToken /var/lib/ubuntu-advantage/private/machine-token.json` `with sudo` exits `0`
+        And I verify that running `grep -q activityID /var/lib/ubuntu-advantage/private/machine-token.json` `with sudo` exits `0`
+        When I run `cat /var/lib/ubuntu-advantage/private/machine-id` with sudo
+        Then stdout matches regexp:
+        """
+        new-machine-id
+        """
+        When I run `cat /var/lib/ubuntu-advantage/jobs-status.json` with sudo
+        Then stdout matches regexp:
+        """
+        \"metering\"
+        """
+
+        Examples: ubuntu release
+           | release |
+           | xenial  |
+           | bionic  |
+           | focal   |
+
+    @series.lts
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Run collect-logs on an attached machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `python3 /usr/lib/ubuntu-advantage/timer.py` with sudo
+        And I verify that running `ua collect-logs` `as non-root` exits `1`
+        Then I will see the following on stderr:
+             """
+             This command must be run as root (try using sudo).
+             """
+        When I run `ua collect-logs` with sudo
+        Then I verify that files exist matching `ua_logs.tar.gz`
+        When I run `tar zxf ua_logs.tar.gz` as non-root
+        Then I verify that files exist matching `logs/`
+        When I run `sh -c "ls -1 logs/ | sort -d"` as non-root
+        # On Xenial, the return value for inexistent services is the same as for dead ones (3).
+        # So the -error suffix does not appear there.
+        Then stdout matches regexp:
+        """
+        cloud-id.txt
+        jobs-status.json
+        journalctl.txt
+        livepatch-status.txt-error
+        systemd-timers.txt
+        ua-auto-attach.path.txt(-error)?
+        ua-auto-attach.service.txt(-error)?
+        uaclient.conf
+        ua-license-check.path.txt
+        ua-license-check.service.txt
+        ua-license-check.timer.txt
+        ua-reboot-cmds.service.txt
+        ua-status.json
+        ua-timer.service.txt
+        ua-timer.timer.txt
+        ubuntu-advantage-license-check.log
+        ubuntu-advantage.log
+        ubuntu-advantage-timer.log
+        ubuntu-esm-apps.list
+        ubuntu-esm-infra.list
+        """
+        Examples: ubuntu release
+           | release |
+           | xenial  |
+           | bionic  |
+           | focal   |
diff --git a/features/attached_enable.feature b/features/attached_enable.feature
index c8d49c2..63e8daa 100644
--- a/features/attached_enable.feature
+++ b/features/attached_enable.feature
@@ -1,8 +1,26 @@
 @uses.config.contract_token
 Feature: Enable command behaviour when attached to an UA subscription
 
+    @series.xenial
+    @uses.config.machine_type.lxd.container
+    Scenario: Attached enable Common Criteria service in an ubuntu lxd container
+        Given a `xenial` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable cc-eal` `as non-root` exits `1`
+        And I will see the following on stderr:
+            """
+            This command must be run as root (try using sudo).
+            """
+        When I verify that running `ua enable cc-eal --beta` `with sudo` exits `1`
+        Then I will see the following on stdout:
+            """
+            One moment, checking your subscription first
+            GPG key '/usr/share/keyrings/ubuntu-cc-keyring.gpg' not found.
+            """
+
     @series.all
-    Scenario Outline: Attached enable Common Criteria service in a ubuntu machine
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Attached enable Common Criteria service in an ubuntu lxd container
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
         Then I verify that running `ua enable cc-eal` `as non-root` exits `1`
@@ -31,10 +49,10 @@ Feature: Enable command behaviour when attached to an UA subscription
            | release | msg                                                            |
            | bionic  | CC EAL2 is not available for Ubuntu 18.04 LTS (Bionic Beaver). |
            | focal   | CC EAL2 is not available for Ubuntu 20.04 LTS (Focal Fossa).   |
-           | groovy  | CC EAL2 is not available for Ubuntu 20.10 (Groovy Gorilla).    |
            | hirsute | CC EAL2 is not available for Ubuntu 21.04 (Hirsute Hippo).     |
 
     @series.lts
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached enable of a service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -124,12 +142,32 @@ Feature: Enable command behaviour when attached to an UA subscription
            | bionic  |
            | focal   |
            | xenial  |
-           | groovy  |
            | hirsute |
 
     @series.lts
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached enable not entitled service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I create the file `/tmp/machine-token-overlay.json` with the following:
+        """
+        {
+            "machineTokenInfo": {
+                "contractInfo": {
+                    "resourceEntitlements": [
+                        {
+                            "type": "esm-apps",
+                            "entitled": false
+                        }
+                    ]
+                }
+            }
+        }
+        """
+        And I append the following on uaclient config:
+        """
+        features:
+          machine_token_overlay: "/tmp/machine-token-overlay.json"
+        """
         When I attach `contract_token` with sudo
         Then I verify that running `ua enable esm-apps` `as non-root` exits `1`
         And I will see the following on stderr:
@@ -151,6 +189,7 @@ Feature: Enable command behaviour when attached to an UA subscription
            | xenial  |
 
     @series.lts
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached enable of cis service in a ubuntu machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
@@ -245,13 +284,14 @@ Feature: Enable command behaviour when attached to an UA subscription
     @series.bionic
     @series.xenial
     @uses.config.machine_type.lxd.vm
-    Scenario Outline: Attached enable of vm-based services in a bionic lxd vm
+    Scenario Outline: Attached disable of livepatch in a lxd vm
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
         And I run `ua status` with sudo
         Then stdout matches regexp:
         """
         cis          +yes      +disabled +Center for Internet Security Audit Tools
+        esm-apps     +yes      +enabled  +UA Apps: Extended Security Maintenance \(ESM\)
         esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance \(ESM\)
         fips         +yes      +disabled +NIST-certified core packages
         fips-updates +yes      +disabled +NIST-certified core packages with priority security updates
@@ -268,6 +308,7 @@ Feature: Enable command behaviour when attached to an UA subscription
         Then stdout matches regexp:
         """
         cis          +yes      +disabled +Center for Internet Security Audit Tools
+        esm-apps     +yes      +enabled  +UA Apps: Extended Security Maintenance \(ESM\)
         esm-infra    +yes      +enabled  +UA Infra: Extended Security Maintenance \(ESM\)
         fips         +yes      +disabled +NIST-certified core packages
         fips-updates +yes      +disabled +NIST-certified core packages with priority security updates
@@ -313,7 +354,7 @@ Feature: Enable command behaviour when attached to an UA subscription
 
     @series.bionic
     @uses.config.machine_type.lxd.vm
-    Scenario: Attached enable fips on a machine with livepatch active
+    Scenario: Attached enable livepatch on a machine with fips active
         Given a `bionic` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
         Then stdout matches regexp:
@@ -347,7 +388,7 @@ Feature: Enable command behaviour when attached to an UA subscription
 
     @series.bionic
     @uses.config.machine_type.lxd.vm
-    Scenario: Attached enable livepatch on a machine with fips active
+    Scenario: Attached enable fips on a machine with livepatch active
         Given a `bionic` machine with ubuntu-advantage-tools installed
         When I attach `contract_token` with sudo
         Then stdout matches regexp:
@@ -448,3 +489,155 @@ Feature: Enable command behaviour when attached to an UA subscription
            | release |
            | bionic  |
            | xenial  |
+
+    @series.lts
+    @uses.config.contract_token
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Attached enable ros on a machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua status --all` as non-root
+        Then stdout matches regexp
+        """
+        ros           yes                disabled           Security Updates for the Robot Operating System
+        """
+        When I run `ua enable ros --assume-yes --beta` with sudo
+        And I run `ua status --all` as non-root
+        Then stdout matches regexp
+        """
+        ros           yes                enabled            Security Updates for the Robot Operating System
+        """
+        And stdout matches regexp
+        """
+        esm-apps      yes                enabled            UA Apps: Extended Security Maintenance \(ESM\)
+        """
+        And stdout matches regexp
+        """
+        esm-infra     yes                enabled            UA Infra: Extended Security Maintenance \(ESM\)
+        """
+        When I verify that running `ua disable esm-apps` `with sudo` and stdin `N` exits `1`
+        Then stdout matches regexp
+        """
+        ROS ESM Security Updates depends on UA Apps: ESM.
+        Disable ROS ESM Security Updates and proceed to disable UA Apps: ESM\? \(y\/N\) Cannot disable UA Apps: ESM when ROS ESM Security Updates is enabled.
+        """
+        When I run `ua disable esm-apps` `with sudo` and stdin `y`
+        Then stdout matches regexp
+        """
+        ROS ESM Security Updates depends on UA Apps: ESM.
+        Disable ROS ESM Security Updates and proceed to disable UA Apps: ESM\? \(y\/N\) Disabling dependent service: ROS ESM Security Updates
+        Updating package lists
+        """
+        When I run `ua status --all` as non-root
+        Then stdout matches regexp
+        """
+        ros           yes                disabled           Security Updates for the Robot Operating System
+        """
+        And stdout matches regexp
+        """
+        esm-apps      yes                disabled           UA Apps: Extended Security Maintenance \(ESM\)
+        """
+        When I verify that running `ua enable ros --beta` `with sudo` and stdin `N` exits `1`
+        Then stdout matches regexp
+        """
+        ROS ESM Security Updates cannot be enabled with UA Apps: ESM disabled.
+        Enable UA Apps: ESM and proceed to enable ROS ESM Security Updates\? \(y\/N\) Cannot enable ROS ESM Security Updates when UA Apps: ESM is disabled.
+        """
+
+        When I run `ua enable ros --beta` `with sudo` and stdin `y`
+        Then stdout matches regexp
+        """
+        One moment, checking your subscription first
+        ROS ESM Security Updates cannot be enabled with UA Apps: ESM disabled.
+        Enable UA Apps: ESM and proceed to enable ROS ESM Security Updates\? \(y\/N\) Enabling required service: UA Apps: ESM
+        UA Apps: ESM enabled
+        Updating package lists
+        ROS ESM Security Updates enabled
+        """
+        When I run `ua status --all` as non-root
+        Then stdout matches regexp
+        """
+        ros           yes                enabled            Security Updates for the Robot Operating System
+        """
+        And stdout matches regexp
+        """
+        esm-apps      yes                enabled            UA Apps: Extended Security Maintenance \(ESM\)
+        """
+        And stdout matches regexp
+        """
+        esm-infra     yes                enabled            UA Infra: Extended Security Maintenance \(ESM\)
+        """
+        When I run `apt-cache policy` as non-root
+        Then apt-cache policy for the following url has permission `500`
+        """
+        <ros-security-source> amd64 Packages
+        """
+        When I run `apt install python3-catkin-pkg -y` with sudo
+        Then I verify that `python3-catkin-pkg` is installed from apt source `<ros-security-source>`
+
+        When I run `ua enable ros-updates --assume-yes --beta` with sudo
+        And I run `ua status --all` as non-root
+        Then stdout matches regexp
+        """
+        ros-updates   yes                enabled            All Updates for the Robot Operating System
+        """
+        When I run `apt-cache policy` as non-root
+        Then apt-cache policy for the following url has permission `500`
+        """
+        <ros-updates-source> amd64 Packages
+        """
+        When I run `apt install python3-catkin-pkg -y` with sudo
+        Then I verify that `python3-catkin-pkg` is installed from apt source `<ros-updates-source>`
+        When I run `ua disable ros` `with sudo` and stdin `y`
+        Then stdout matches regexp
+        """
+        ROS ESM All Updates depends on ROS ESM Security Updates.
+        Disable ROS ESM All Updates and proceed to disable ROS ESM Security Updates\? \(y\/N\) Disabling dependent service: ROS ESM All Updates
+        Updating package lists
+        """
+        When I run `ua enable ros-updates --beta` `with sudo` and stdin `y`
+        Then stdout matches regexp
+        """
+        One moment, checking your subscription first
+        ROS ESM All Updates cannot be enabled with ROS ESM Security Updates disabled.
+        Enable ROS ESM Security Updates and proceed to enable ROS ESM All Updates\? \(y\/N\) Enabling required service: ROS ESM Security Updates
+        ROS ESM Security Updates enabled
+        Updating package lists
+        ROS ESM All Updates enabled
+        """
+        When I run `ua status --all` as non-root
+        Then stdout matches regexp
+        """
+        ros-updates   yes                enabled            All Updates for the Robot Operating System
+        """
+        And stdout matches regexp
+        """
+        ros           yes                enabled            Security Updates for the Robot Operating System
+        """
+        When I run `ua disable ros-updates --assume-yes` with sudo
+        When I run `ua disable ros --assume-yes` with sudo
+        When I run `ua disable esm-apps --assume-yes` with sudo
+        When I run `ua disable esm-infra --assume-yes` with sudo
+        When I run `ua enable ros-updates --assume-yes --beta` with sudo
+        When I run `ua status --all` as non-root
+        Then stdout matches regexp
+        """
+        ros-updates   yes                enabled            All Updates for the Robot Operating System
+        """
+        And stdout matches regexp
+        """
+        ros           yes                enabled            Security Updates for the Robot Operating System
+        """
+        And stdout matches regexp
+        """
+        esm-apps      yes                enabled            UA Apps: Extended Security Maintenance \(ESM\)
+        """
+        And stdout matches regexp
+        """
+        esm-infra     yes                enabled            UA Infra: Extended Security Maintenance \(ESM\)
+        """
+
+        Examples: ubuntu release
+           | release | ros-security-source                                    | ros-updates-source                                            |
+           | xenial  | https://esm.ubuntu.com/ros/ubuntu xenial-security/main | https://esm.ubuntu.com/ros-updates/ubuntu xenial-updates/main |
+           | bionic  | https://esm.ubuntu.com/ros/ubuntu bionic-security/main | https://esm.ubuntu.com/ros-updates/ubuntu bionic-updates/main |
diff --git a/features/attached_status.feature b/features/attached_status.feature
new file mode 100644
index 0000000..62da122
--- /dev/null
+++ b/features/attached_status.feature
@@ -0,0 +1,29 @@
[e-mail]_token
+Feature: Attached status
+
+    @series.all
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Attached status in a ubuntu machine - formatted
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua status --format json` as non-root
+        Then stdout is formatted as `json` and has keys:
+            """
+            _doc _schema_version account attached config config_path contract effective
+            environment_vars execution_details execution_status expires machine_id notices
+            services version
+            """
+        When I run `ua status --format yaml` as non-root
+        Then stdout is formatted as `yaml` and has keys:
+            """
+            _doc _schema_version account attached config config_path contract effective
+            environment_vars execution_details execution_status expires machine_id notices
+            services version
+            """
+
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | xenial  |
+           | hirsute |
diff --git a/features/aws-ids.yaml b/features/aws-ids.yaml
index 2167bf9..e0198a7 100644
--- a/features/aws-ids.yaml
+++ b/features/aws-ids.yaml
@@ -1,3 +1,3 @@
-bionic: ami-0e11aa8c6a6d58146
-focal: ami-0383ece2c0f6de239
-xenial: ami-09e110a448d322f4a
+bionic: ami-094e9c95623db463c
+focal: ami-0193aa0a9df84a08b
+xenial: ami-06e94647aeaed1e5c
diff --git a/features/cloud.py b/features/cloud.py
index 3b5e856..86671ad 100644
--- a/features/cloud.py
+++ b/features/cloud.py
@@ -1,15 +1,11 @@
 import json
-import os
 import logging
-import pycloudlib  # type: ignore
+import os
 import time
-import yaml
+from typing import List, Optional, Tuple
 
-try:
-    from typing import Tuple, List, Optional  # noqa
-except ImportError:
-    # typing isn't available on trusty, so ignore its absence
-    pass
+import pycloudlib  # type: ignore
+import yaml
 
 
 class Cloud:
@@ -28,13 +24,13 @@ class Cloud:
 
     name = ""
     pro_ids_path = ""
-    env_vars: "Tuple[str, ...]" = ()
+    env_vars: Tuple[str, ...] = ()
 
     def __init__(
         self,
         machine_type: str,
-        region: "Optional[str]" = None,
-        tag: "Optional[str]" = None,
+        region: Optional[str] = None,
+        tag: Optional[str] = None,
         timestamp_suffix: bool = True,
     ) -> None:
         if tag:
@@ -69,9 +65,10 @@ class Cloud:
     def _create_instance(
         self,
         series: str,
-        instance_name: "Optional[str]" = None,
-        image_name: "Optional[str]" = None,
-        user_data: "Optional[str]" = None,
+        instance_name: Optional[str] = None,
+        image_name: Optional[str] = None,
+        user_data: Optional[str] = None,
+        ephemeral: bool = False,
     ) -> pycloudlib.instance:
         """Create an instance for on the cloud provider.
 
@@ -85,6 +82,8 @@ class Cloud:
             The name of the image to be used when creating the instance
         :param user_data:
             The user data to be passed when creating the instance
+        :param ephemeral":
+            If instance should be ephemeral
 
         :returns:
             A cloud provider instance
@@ -108,14 +107,15 @@ class Cloud:
                 % (result.stdout, result.stderr)
             )
 
-        print("--- cloud-init succeeded")
+        logging.info("--- cloud-init succeeded")
 
     def launch(
         self,
         series: str,
-        instance_name: "Optional[str]" = None,
-        image_name: "Optional[str]" = None,
-        user_data: "Optional[str]" = None,
+        instance_name: Optional[str] = None,
+        image_name: Optional[str] = None,
+        user_data: Optional[str] = None,
+        ephemeral: bool = False,
     ) -> pycloudlib.instance.BaseInstance:
         """Create and wait for cloud provider instance to be ready.
 
@@ -129,6 +129,8 @@ class Cloud:
             The name of the image to be used when creating the instance
         :param user_data:
             The user data to be passed when creating the instance
+        :param ephemeral":
+            If instance should be ephemeral
 
         :returns:
             An cloud provider instance
@@ -138,8 +140,9 @@ class Cloud:
             instance_name=instance_name,
             image_name=image_name,
             user_data=user_data,
+            ephemeral=ephemeral,
         )
-        print(
+        logging.info(
             "--- {} instance launched: {}. Waiting for ssh access".format(
                 self.name, inst.name
             )
@@ -150,7 +153,7 @@ class Cloud:
                 inst.wait()
                 break
             except Exception as e:
-                print("--- Retrying instance.wait on {}".format(str(e)))
+                logging.info("--- Retrying instance.wait on {}".format(str(e)))
 
         self._check_cloudinit_status(inst)
         return inst
@@ -168,7 +171,7 @@ class Cloud:
         """
         return instance.id
 
-    def format_missing_env_vars(self, missing_env_vars: "List") -> "List[str]":
+    def format_missing_env_vars(self, missing_env_vars: List) -> List[str]:
         """Format missing env vars to be displayed in log.
 
         :returns:
@@ -176,7 +179,7 @@ class Cloud:
         """
         return [" - {}\n".format(env_var) for env_var in missing_env_vars]
 
-    def missing_env_vars(self) -> "List[str]":
+    def missing_env_vars(self) -> List[str]:
         """Return a list of env variables necessary for this cloud provider.
 
         :returns:
@@ -216,8 +219,8 @@ class Cloud:
 
     def manage_ssh_key(
         self,
-        private_key_path: "Optional[str]" = None,
-        key_name: "Optional[str]" = None,
+        private_key_path: Optional[str] = None,
+        key_name: Optional[str] = None,
     ) -> None:
         """Create and manage ssh key pairs to be used in the cloud provider.
 
@@ -265,19 +268,16 @@ class EC2(Cloud):
     """
 
     name = "aws"
-    env_vars: "Tuple[str, ...]" = (
-        "aws_access_key_id",
-        "aws_secret_access_key",
-    )
+    env_vars: Tuple[str, ...] = ("aws_access_key_id", "aws_secret_access_key")
     pro_ids_path = "features/aws-ids.yaml"
 
     def __init__(
         self,
-        aws_access_key_id: "Optional[str]",
-        aws_secret_access_key: "Optional[str]",
+        aws_access_key_id: Optional[str],
+        aws_secret_access_key: Optional[str],
         machine_type: str,
-        region: "Optional[str]" = "us-east-2",
-        tag: "Optional[str]" = None,
+        region: Optional[str] = "us-east-2",
+        tag: Optional[str] = None,
         timestamp_suffix: bool = True,
     ) -> None:
         self.aws_access_key_id = aws_access_key_id
@@ -308,8 +308,8 @@ class EC2(Cloud):
 
     def manage_ssh_key(
         self,
-        private_key_path: "Optional[str]" = None,
-        key_name: "Optional[str]" = None,
+        private_key_path: Optional[str] = None,
+        key_name: Optional[str] = None,
     ) -> None:
         """Create and manage ssh key pairs to be used in the cloud provider.
 
@@ -327,7 +327,7 @@ class EC2(Cloud):
                 self.api.delete_key(self.key_name)
 
             private_key_path = "ec2-{}.pem".format(self.key_name)
-            print(
+            logging.info(
                 "--- Creating local keyfile {} for EC2".format(
                     private_key_path
                 )
@@ -343,9 +343,10 @@ class EC2(Cloud):
     def _create_instance(
         self,
         series: str,
-        instance_name: "Optional[str]" = None,
-        image_name: "Optional[str]" = None,
-        user_data: "Optional[str]" = None,
+        instance_name: Optional[str] = None,
+        image_name: Optional[str] = None,
+        user_data: Optional[str] = None,
+        ephemeral: bool = False,
     ) -> pycloudlib.instance:
         """Launch an instance on the cloud provider.
 
@@ -359,6 +360,8 @@ class EC2(Cloud):
             The name of the image to be used when creating the instance
         :param user_data:
             The user data to be passed when creating the instance
+        :param ephemeral":
+            If instance should be ephemeral
 
         :returns:
             An AWS cloud provider instance
@@ -366,13 +369,15 @@ class EC2(Cloud):
         if not image_name:
             image_name = self.locate_image_name(series)
 
-        print("--- Launching AWS image {}({})".format(image_name, series))
+        logging.info(
+            "--- Launching AWS image {}({})".format(image_name, series)
+        )
         vpc = self.api.get_or_create_vpc(name="uaclient-integration")
 
         try:
             inst = self.api.launch(image_name, user_data=user_data, vpc=vpc)
         except Exception as e:
-            print(str(e))
+            logging.error(str(e))
             raise
 
         return inst
@@ -401,7 +406,7 @@ class Azure(Cloud):
     """
 
     name = "Azure"
-    env_vars: "Tuple[str, ...]" = (
+    env_vars: Tuple[str, ...] = (
         "az_client_id",
         "az_client_secret",
         "az_tenant_id",
@@ -412,13 +417,13 @@ class Azure(Cloud):
     def __init__(
         self,
         machine_type: str,
-        region: "Optional[str]" = "centralus",
-        tag: "Optional[str]" = None,
+        region: Optional[str] = "centralus",
+        tag: Optional[str] = None,
         timestamp_suffix: bool = True,
-        az_client_id: "Optional[str]" = None,
-        az_client_secret: "Optional[str]" = None,
-        az_tenant_id: "Optional[str]" = None,
-        az_subscription_id: "Optional[str]" = None,
+        az_client_id: Optional[str] = None,
+        az_client_secret: Optional[str] = None,
+        az_tenant_id: Optional[str] = None,
+        az_subscription_id: Optional[str] = None,
     ) -> None:
         self.az_client_id = az_client_id
         self.az_client_secret = az_client_secret
@@ -464,8 +469,8 @@ class Azure(Cloud):
 
     def manage_ssh_key(
         self,
-        private_key_path: "Optional[str]" = None,
-        key_name: "Optional[str]" = None,
+        private_key_path: Optional[str] = None,
+        key_name: Optional[str] = None,
     ) -> None:
         """Create and manage ssh key pairs to be used in the cloud provider.
 
@@ -476,7 +481,7 @@ class Azure(Cloud):
         if not private_key_path:
             private_key_path = "azure-priv-{}.pem".format(self.key_name)
             pub_key_path = "azure-pub-{}.txt".format(self.key_name)
-            print(
+            logging.info(
                 "--- Creating local keyfile {} for Azure".format(
                     private_key_path
                 )
@@ -500,9 +505,10 @@ class Azure(Cloud):
     def _create_instance(
         self,
         series: str,
-        instance_name: "Optional[str]" = None,
-        image_name: "Optional[str]" = None,
-        user_data: "Optional[str]" = None,
+        instance_name: Optional[str] = None,
+        image_name: Optional[str] = None,
+        user_data: Optional[str] = None,
+        ephemeral: bool = False,
     ) -> pycloudlib.instance:
         """Launch an instance on the cloud provider.
 
@@ -516,6 +522,8 @@ class Azure(Cloud):
             The name of the image to be used when creating the instance
         :param user_data:
             The user data to be passed when creating the instance
+        :param ephemeral":
+            If instance should be ephemeral
 
         :returns:
             An AWS cloud provider instance
@@ -523,7 +531,9 @@ class Azure(Cloud):
         if not image_name:
             image_name = self.locate_image_name(series)
 
-        print("--- Launching Azure image {}({})".format(image_name, series))
+        logging.info(
+            "--- Launching Azure image {}({})".format(image_name, series)
+        )
         inst = self.api.launch(image_id=image_name, user_data=user_data)
         return inst
 
@@ -549,17 +559,17 @@ class GCP(Cloud):
         of the provided tag.
     """
 
-    env_vars: "Tuple[str, ...]" = ("gcp_credentials_path", "gcp_project")
+    env_vars: Tuple[str, ...] = ("gcp_credentials_path", "gcp_project")
 
     def __init__(
         self,
         machine_type: str,
-        region: "Optional[str]" = "us-west2",
-        tag: "Optional[str]" = None,
+        region: Optional[str] = "us-west2",
+        tag: Optional[str] = None,
         timestamp_suffix: bool = True,
-        zone: "Optional[str]" = "a",
-        gcp_credentials_path: "Optional[str]" = None,
-        gcp_project: "Optional[str]" = None,
+        zone: Optional[str] = "a",
+        gcp_credentials_path: Optional[str] = None,
+        gcp_project: Optional[str] = None,
     ) -> None:
         self.gcp_credentials_path = gcp_credentials_path
         self.gcp_project = gcp_project
@@ -603,9 +613,10 @@ class GCP(Cloud):
     def _create_instance(
         self,
         series: str,
-        instance_name: "Optional[str]" = None,
-        image_name: "Optional[str]" = None,
-        user_data: "Optional[str]" = None,
+        instance_name: Optional[str] = None,
+        image_name: Optional[str] = None,
+        user_data: Optional[str] = None,
+        ephemeral: bool = False,
     ) -> pycloudlib.instance:
         """Launch an instance on the cloud provider.
 
@@ -619,6 +630,8 @@ class GCP(Cloud):
             The name of the image to be used when creating the instance
         :param user_data:
             The user data to be passed when creating the instance
+        :param ephemeral":
+            If instance should be ephemeral
 
         :returns:
             An AWS cloud provider instance
@@ -626,7 +639,9 @@ class GCP(Cloud):
         if not image_name:
             image_name = self.locate_image_name(series)
 
-        print("--- Launching GCP image {}({})".format(image_name, series))
+        logging.info(
+            "--- Launching GCP image {}({})".format(image_name, series)
+        )
         inst = self.api.launch(image_id=image_name, user_data=user_data)
         return inst
 
@@ -634,6 +649,20 @@ class GCP(Cloud):
 class _LXD(Cloud):
     name = "_lxd"
 
+    def __init__(
+        self,
+        machine_type: str,
+        region: Optional[str] = None,
+        tag: Optional[str] = None,
+        timestamp_suffix: bool = True,
+    ) -> None:
+        super().__init__(
+            machine_type=machine_type,
+            region=region,
+            tag=tag,
+            timestamp_suffix=timestamp_suffix,
+        )
+
     @property
     def pycloudlib_cls(self):
         """Return the pycloudlib cls to be used as an api."""
@@ -642,9 +671,10 @@ class _LXD(Cloud):
     def _create_instance(
         self,
         series: str,
-        instance_name: "Optional[str]" = None,
-        image_name: "Optional[str]" = None,
-        user_data: "Optional[str]" = None,
+        instance_name: Optional[str] = None,
+        image_name: Optional[str] = None,
+        user_data: Optional[str] = None,
+        ephemeral: bool = False,
     ) -> pycloudlib.instance:
         """Launch an instance on the cloud provider.
 
@@ -658,6 +688,8 @@ class _LXD(Cloud):
             The name of the image to be used when creating the instance
         :param user_data:
             The user data to be passed when creating the instance
+        :param ephemeral":
+            If instance should be ephemeral
 
         :returns:
             An AWS cloud provider instance
@@ -667,14 +699,24 @@ class _LXD(Cloud):
 
         image_type = self.name.title().replace("-", " ")
 
-        print(
+        logging.info(
             "--- Launching {} image {}({})".format(
                 image_type, image_name, series
             )
         )
 
+        if self.name == "lxd-virtual-machine" and series == "xenial":
+            # Livepatch won't apply patches on Xenial with secure boot enabled
+            config_dict = {"security.secureboot": False}
+        else:
+            config_dict = {}
+
         inst = self.api.launch(
-            name=instance_name, image_id=image_name, user_data=user_data
+            name=instance_name,
+            image_id=image_name,
+            user_data=user_data,
+            ephemeral=ephemeral,
+            config_dict=config_dict,
         )
         return inst
 
diff --git a/features/enable_fips_cloud.feature b/features/enable_fips_cloud.feature
new file mode 100644
index 0000000..bab8338
--- /dev/null
+++ b/features/enable_fips_cloud.feature
@@ -0,0 +1,606 @@
[e-mail]_token
+Feature: FIPS enablement in cloud based machines
+
+    @series.lts
+    @uses.config.machine_type.gcp.generic
+    Scenario Outline: Attached enable of FIPS services in an ubuntu gcp vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable <fips_service> --assume-yes` `with sudo` exits `1`
+        And stdout matches regexp:
+        """
+        Ubuntu <release_title> does not provide a GCP optimized FIPS kernel
+        """
+
+        Examples: fips
+            | release | release_title | fips_service  |
+            | xenial  | Xenial        | fips          |
+            | xenial  | Xenial        | fips-updates  |
+            | focal   | Focal         | fips          |
+            | focal   | Focal         | fips-updates  |
+
+    @series.xenial
+    @uses.config.machine_type.azure.generic
+    Scenario Outline: Enable FIPS services in an ubuntu Xenial Azure vm
+        Given a `xenial` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable <fips_service> --assume-yes` `with sudo` exits `1`
+        And stdout matches regexp:
+        """
+        Ubuntu Xenial does not provide an Azure optimized FIPS kernel
+        """
+
+        Examples: fips
+           | fips_service  |
+           | fips          |
+           | fips-updates  |
+
+    @series.focal
+    @uses.config.machine_type.azure.generic
+    Scenario Outline: Refuse to enable FIPS on a Focal Azure vm
+        Given a `focal` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable <fips_service> --assume-yes` `with sudo` exits `1`
+        And stdout matches regexp:
+        """
+        Ubuntu Focal does not provide an Azure optimized FIPS kernel
+        """
+
+        Examples: fips
+           | fips_service  |
+           | fips          |
+           | fips-updates  |
+
+    @series.focal
+    @uses.config.machine_type.aws.generic
+    Scenario Outline: Refuse to enable FIPS on a Focal AWS vm
+        Given a `focal` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        Then I verify that running `ua enable <fips_service> --assume-yes` `with sudo` exits `1`
+        And stdout matches regexp:
+        """
+        Ubuntu Focal does not provide an AWS optimized FIPS kernel
+        """
+
+        Examples: fips
+           | fips_service  |
+           | fips          |
+           | fips-updates  |
+
+
+    @series.bionic
+    @uses.config.machine_type.azure.generic
+    Scenario Outline: Enable FIPS in an ubuntu Bionic Azure vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo
+        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `apt-cache policy ubuntu-azure-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            azure-fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+        """
+        Updating package lists
+        """
+        When I run `apt-cache policy ubuntu-azure-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                |
+           | bionic  | FIPS         | fips         |https://esm.ubuntu.com/fips/ubuntu bionic/main |
+
+    @series.focal
+    @uses.config.machine_type.azure.generic
+    Scenario Outline: Enable FIPS in an ubuntu Focal Azure vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo
+        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
+        And I append the following on uaclient config:
+            """
+            features:
+              allow_default_fips_metapackage_on_focal_cloud: true
+            """
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> strongswan-hmac package could not be installed
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        When I run `apt-cache policy ubuntu-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+        """
+        Updating package lists
+        """
+        When I run `apt-cache policy ubuntu-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                |
+           | focal   | FIPS         | fips         |https://esm.ubuntu.com/fips/ubuntu focal/main  |
+
+    @series.xenial
+    @uses.config.machine_type.aws.generic
+    Scenario Outline: Attached FIPS in an ubuntu Xenial AWS vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo
+        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `apt-cache policy ubuntu-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+        """
+        Updating package lists
+        """
+        When I run `apt-cache policy ubuntu-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                |
+           | xenial  | FIPS         | fips         |https://esm.ubuntu.com/fips/ubuntu xenial/main |
+
+    @series.bionic
+    @uses.config.machine_type.aws.generic
+    Scenario Outline: Attached enable of FIPS in an ubuntu Bionic AWS vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo
+        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `apt-cache policy ubuntu-aws-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            aws-fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+        """
+        Updating package lists
+        """
+        When I run `apt-cache policy ubuntu-aws-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                |
+           | bionic  | FIPS         | fips         |https://esm.ubuntu.com/fips/ubuntu bionic/main |
+
+    @series.focal
+    @uses.config.machine_type.aws.generic
+    Scenario Outline: Attached enable of FIPS in an ubuntu Focal AWS vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo
+        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
+        And I append the following on uaclient config:
+            """
+            features:
+              allow_default_fips_metapackage_on_focal_cloud: true
+            """
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> strongswan-hmac package could not be installed
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        When I run `apt-cache policy ubuntu-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+        """
+        Updating package lists
+        """
+        When I run `apt-cache policy ubuntu-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                               |
+           | focal   | FIPS         | fips         |https://esm.ubuntu.com/fips/ubuntu focal/main |
+
+    @series.bionic
+    @uses.config.machine_type.gcp.generic
+    Scenario Outline: Attached enable of FIPS in an ubuntu Bionic GCP vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo
+        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `apt-cache policy ubuntu-gcp-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            gcp-fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+        """
+        Updating package lists
+        """
+        When I run `apt-cache policy ubuntu-gcp-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                |
+           | bionic  | FIPS         | fips         |https://esm.ubuntu.com/fips/ubuntu bionic/main |
+
+    @series.bionic
+    @uses.config.machine_type.gcp.generic
+    Scenario Outline: Attached enable of FIPS in an ubuntu GCP AWS vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that running `grep Traceback /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I run `apt-cache policy ubuntu-gcp-fips` as non-root
+        Then stdout does not match regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            gcp-fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+        """
+        Updating package lists
+        """
+        When I run `apt-cache policy ubuntu-gcp-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                |
+           | bionic  | FIPS Updates | fips-updates |https://esm.ubuntu.com/fips-updates/ubuntu bionic-updates/main |
diff --git a/features/enable_fips_vm.feature b/features/enable_fips_vm.feature
new file mode 100644
index 0000000..69b0b78
--- /dev/null
+++ b/features/enable_fips_vm.feature
@@ -0,0 +1,410 @@
[e-mail]_token
+Feature: FIPS enablement in lxd VMs
+
+    @series.xenial
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable of FIPS in an ubuntu lxd vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
+        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
+        And I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And stdout matches regexp:
+            """
+            FIPS support requires system reboot to complete configuration
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua status --all` with sudo
+        Then stdout does not match regexp:
+            """
+            FIPS support requires system reboot to complete configuration
+            """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            A reboot is required to complete disable operation
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            Disabling FIPS requires system reboot to complete operation
+            """
+        When I run `apt-cache policy ubuntu-fips` as non-root
+        Then stdout matches regexp:
+        """
+        .*Installed: \(none\)
+        """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+        Then stdout does not match regexp:
+            """
+            Disabling FIPS requires system reboot to complete operation
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                |
+           | xenial  | FIPS         | fips         |https://esm.ubuntu.com/fips/ubuntu xenial/main |
+           | bionic  | FIPS         | fips         |https://esm.ubuntu.com/fips/ubuntu bionic/main |
+
+    @series.xenial
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable of FIPS-updates in an ubuntu lxd vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
+        When I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            A reboot is required to complete disable operation
+            """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
+        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+        When I verify that running `ua enable fips --assume-yes` `with sudo` exits `1`
+        Then stdout matches regexp:
+            """
+            Cannot enable FIPS because FIPS Updates was once enabled.
+            """
+        And I verify that files exist matching `/var/lib/ubuntu-advantage/services-once-enabled`
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                                |
+           | xenial  | FIPS Updates | fips-updates |https://esm.ubuntu.com/fips-updates/ubuntu xenial-updates/main |
+           | bionic  | FIPS Updates | fips-updates |https://esm.ubuntu.com/fips-updates/ubuntu bionic-updates/main |
+
+    @series.focal
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable of FIPS in an ubuntu lxd vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
+        When I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            FIPS strongswan-hmac package could not be installed
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            A reboot is required to complete disable operation
+            """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                               |
+           | focal   | FIPS         | fips         |https://esm.ubuntu.com/fips/ubuntu focal/main |
+
+    @series.focal
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable of FIPS-updates in an ubuntu lxd vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
+        When I run `ua enable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing <fips-name> packages
+            <fips-name> enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                enabled
+            """
+        And I verify that running `apt update` `with sudo` exits `0`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When I reboot the `<release>` machine
+        And  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+        When I run `ua disable <fips-service> --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            A reboot is required to complete disable operation
+            """
+        When I reboot the `<release>` machine
+        Then I verify that `openssh-server` installed version matches regexp `fips`
+        And I verify that `openssh-client` installed version matches regexp `fips`
+        And I verify that `strongswan` installed version matches regexp `fips`
+        And I verify that `strongswan-hmac` installed version matches regexp `fips`
+        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
+        Then I will see the following on stdout:
+        """
+        openssh-client was already not hold.
+        openssh-server was already not hold.
+        strongswan was already not hold.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            <fips-service> +yes                disabled
+            """
+        When I verify that running `ua enable fips --assume-yes` `with sudo` exits `1`
+        Then stdout matches regexp:
+            """
+            Cannot enable FIPS because FIPS Updates was once enabled.
+            """
+        And I verify that files exist matching `/var/lib/ubuntu-advantage/services-once-enabled`
+
+        Examples: ubuntu release
+           | release | fips-name    | fips-service |fips-apt-source                                               |
+           | focal   | FIPS Updates | fips-updates |https://esm.ubuntu.com/fips-updates/ubuntu focal-updates/main |
+
+    @series.xenial
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: Attached enable fips-updates on fips enabled vm
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
+        And I run `ua enable fips --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing FIPS packages
+            FIPS enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            fips +yes                enabled
+            """
+        When I reboot the `<release>` machine
+        And  I run `ua enable fips-updates --assume-yes` with sudo
+        Then stdout matches regexp:
+            """
+            Updating package lists
+            Installing FIPS Updates packages
+            FIPS Updates enabled
+            A reboot is required to complete install
+            """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+            """
+            fips +yes                n/a
+            """
+        And stdout matches regexp:
+            """
+            fips-updates +yes                enabled
+            """
+        When I reboot the `<release>` machine
+        Then I verify that running `apt update` `with sudo` exits `0`
+        And I verify that `ubuntu-fips` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
+        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
+        When  I run `uname -r` as non-root
+        Then stdout matches regexp:
+            """
+            fips
+            """
+        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
+        Then I will see the following on stdout:
+        """
+        1
+        """
+
+        Examples: ubuntu release
+           | release | fips-apt-source                                                        |
+           | xenial  | https://esm.ubuntu.com/fips-updates/ubuntu xenial-updates/main |
+           | bionic  | https://esm.ubuntu.com/fips-updates/ubuntu bionic-updates/main |
+
+    @series.xenial
+    @series.bionic
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: FIPS enablement message when cloud init didn't run properly
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I delete the file `/run/cloud-init/instance-data.json`
+        And I attach `contract_token` with sudo
+        And I run `ua disable livepatch` with sudo
+        And I run `ua enable fips --assume-yes` with sudo
+        Then stderr matches regexp:
+        """
+        Could not determine cloud, defaulting to generic FIPS package.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+        """
+        fips +yes                enabled
+        """
+
+        Examples: ubuntu release
+        | release |
+        | xenial  |
+        | bionic  |
+
+    @series.focal
+    @uses.config.machine_type.lxd.vm
+    Scenario Outline: FIPS enablement message when cloud init didn't run properly
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I delete the file `/run/cloud-init/instance-data.json`
+        And I attach `contract_token` with sudo
+        And I run `ua enable fips --assume-yes` with sudo
+        Then stderr matches regexp:
+        """
+        Could not determine cloud, defaulting to generic FIPS package.
+        """
+        When I run `ua status --all` with sudo
+        Then stdout matches regexp:
+        """
+        fips +yes                enabled
+        """
+
+        Examples: ubuntu release
+        | release |
+        | focal   |
diff --git a/features/environment.py b/features/environment.py
index 07b5cdd..d486bf0 100644
--- a/features/environment.py
+++ b/features/environment.py
@@ -1,25 +1,20 @@
 import datetime
-import os
 import itertools
+import logging
+import os
+import random
 import re
+import string
 import tempfile
 import textwrap
-import logging
-import pycloudlib  # type: ignore
-
-try:
-    from typing import Dict, Optional, Union, List, Tuple, Any  # noqa: F401
-except ImportError:
-    # typing isn't available on trusty, so ignore its absence
-    pass
+from typing import Any, Dict, List, Optional, Tuple, Union  # noqa: F401
 
+import pycloudlib  # type: ignore
 from behave.model import Feature, Scenario
-
 from behave.runner import Context
 
 import features.cloud as cloud
-
-from features.util import emit_spinner_on_travis, lxc_get_property, build_debs
+from features.util import build_debs, emit_spinner_on_travis, lxc_get_property
 
 ALL_SUPPORTED_SERIES = ["bionic", "focal", "xenial"]
 
@@ -44,8 +39,9 @@ runcmd:
 
 USERDATA_RUNCMD_ENABLE_PROPOSED = """
 runcmd:
-  - printf \"deb http://archive.ubuntu.com/ubuntu/ {series}-proposed restricted main multiverse universe\" > /etc/apt/sources.list.d/uaclient-proposed.list
-  - apt-get update
+  - printf \"deb http://archive.ubuntu.com/ubuntu/ {series}-proposed main\" > /etc/apt/sources.list.d/uaclient-proposed.list
+  - "printf \\"Package: *\\nPin: release a={series}-proposed\\nPin-Priority: 400\\n\\" > /etc/apt/preferences.d/lower-proposed"
+  - "printf \\"Package: ubuntu-advantage-tools\\nPin: release a={series}-proposed\\nPin-Priority: 1001\\n\\" > /etc/apt/preferences.d/uaclient-proposed"
 """  # noqa: E501
 
 USERDATA_APT_SOURCE_PPA = """\
@@ -121,6 +117,8 @@ class UAClientBehaveConfig:
         "destroy_instances",
         "cache_source",
         "enable_proposed",
+        "ephemeral_instance",
+        "snapshot_strategy",
     ]
     str_options = [
         "aws_access_key_id",
@@ -179,6 +177,8 @@ class UAClientBehaveConfig:
         destroy_instances: bool = True,
         cache_source: bool = True,
         enable_proposed: bool = False,
+        ephemeral_instance: bool = False,
+        snapshot_strategy: bool = False,
         machine_type: str = "lxd.container",
         private_key_file: str = None,
         private_key_name: str = "uaclient-integration",
@@ -192,7 +192,7 @@ class UAClientBehaveConfig:
         ppa_keyid: str = DAILY_PPA_KEYID,
         userdata_file: str = None,
         check_version: str = None,
-        cmdline_tags: "List" = []
+        cmdline_tags: List = []
     ) -> None:
         # First, store the values we've detected
         self.aws_access_key_id = aws_access_key_id
@@ -206,6 +206,8 @@ class UAClientBehaveConfig:
         self.build_pr = build_pr
         self.cache_source = cache_source
         self.enable_proposed = enable_proposed
+        self.ephemeral_instance = ephemeral_instance
+        self.snapshot_strategy = snapshot_strategy
         self.contract_token = contract_token
         self.contract_token_staging = contract_token_staging
         self.contract_token_staging_expired = contract_token_staging_expired
@@ -268,6 +270,14 @@ class UAClientBehaveConfig:
             job_suffix = job_suffix.split("PR-")[-1]
         timed_job_tag += str(job_suffix)
         timed_job_tag = timed_job_tag.replace(".", "-")
+
+        # Add 8-digit random suffix to the tag, so it does not conflict when
+        # spinning many jobs at the same time
+        random_suffix = "".join(
+            random.choices(string.ascii_lowercase + string.digits, k=8)
+        )
+        timed_job_tag += "-" + random_suffix
+
         if "aws" in self.machine_type:
             self.cloud_manager = cloud.EC2(
                 aws_access_key_id,
@@ -404,7 +414,7 @@ def before_all(context: Context) -> None:
         )
 
 
-def _should_skip_tags(context: Context, tags: "List") -> str:
+def _should_skip_tags(context: Context, tags: List) -> str:
     """Return a reason if a feature or scenario should be skipped"""
     machine_type = getattr(context.config, "machine_type", "")
     machine_types = []
@@ -554,7 +564,9 @@ def after_step(context, step):
                 artifact_file = os.path.join(
                     artifacts_dir, os.path.basename(log_file)
                 )
-                print("-- pull instance:{} {}".format(log_file, artifact_file))
+                logging.info(
+                    "-- pull instance:{} {}".format(log_file, artifact_file)
+                )
                 try:
                     result = context.instances["uaclient"].execute(
                         ["cat", log_file], use_sudo=True
@@ -575,11 +587,13 @@ def after_step(context, step):
 
 def after_all(context):
     if context.config.ppa == "":
-        print(" No custom images to delete. UACLIENT_BEHAVE_PPA is unset.")
+        logging.info(
+            " No custom images to delete. UACLIENT_BEHAVE_PPA is unset."
+        )
     elif context.config.image_clean:
         for key, image in context.series_image_name.items():
             if key == context.series_reuse_image:
-                print(
+                logging.info(
                     " Not deleting this image: ",
                     context.series_image_name[key],
                 )
@@ -587,41 +601,38 @@ def after_all(context):
                 context.config.cloud_api.delete_image(image)
 
 
-def _capture_container_as_image(
-    container_name: str,
-    image_name: str,
-    cloud_api: "pycloudlib.cloud.BaseCloud",
+def capture_container_as_image(
+    container_id: str, image_name: str, cloud_api: pycloudlib.cloud.BaseCloud
 ) -> str:
     """Capture a container as an image.
 
-    :param container_name:
-        The name of the container to be captured.  Note that this container
+    :param container_id:
+        The id of the container to be captured.  Note that this container
         will be stopped.
     :param image_name:
         The name under which the image should be published.
     :param cloud_api: Optional pycloud BaseCloud api for applicable
         machine_types.
     """
-    print(
-        "--- Creating  base image snapshot from vm {}".format(container_name)
+    logging.info(
+        "--- Creating  base image snapshot from vm {}".format(container_id)
     )
-    inst = cloud_api.get_instance(container_name)
+    inst = cloud_api.get_instance(container_id)
     return cloud_api.snapshot(instance=inst)
 
 
-def build_debs_from_dev_instance(context: Context, series: str) -> "List[str]":
-    """Create a development instance, instal build dependencies and build debs
+def build_debs_from_sbuild(context: Context, series: str) -> List[str]:
+    """Create a chroot and build the package using sbuild
 
 
     Will stop the development instance after deb build succeeds.
 
     :return: A list of paths to applicable deb files published.
     """
-    time_suffix = datetime.datetime.now().strftime("%s%f")
     deb_paths = []
 
     if context.config.debs_path:
-        print(
+        logging.info(
             "--- Checking if debs can be reused in {}".format(
                 context.config.debs_path
             )
@@ -635,36 +646,22 @@ def build_debs_from_dev_instance(context: Context, series: str) -> "List[str]":
             ]
 
     if len(deb_paths):
-        print("--- Reusing debs: {}".format(", ".join(deb_paths)))
+        logging.info("--- Reusing debs: {}".format(", ".join(deb_paths)))
     else:
-        print("--- Could not find any debs to reuse. Building it locally")
-        print(
-            "--- Launching vm to build ubuntu-advantage*debs from local source"
-        )
-        build_container_name = (
-            "ubuntu-behave-image-pre-build-%s-" % series + time_suffix
-        )
-
-        cloud_manager = context.config.cloud_manager
-        if "pro" in context.config.machine_type:
-            user_data = USERDATA_BLOCK_AUTO_ATTACH_IMG
-        else:
-            user_data = ""
-        inst = cloud_manager.launch(
-            instance_name=build_container_name,
-            series=series,
-            user_data=user_data,
+        logging.info(
+            "--- Could not find any debs to reuse. Building it locally"
         )
 
-        build_container_name = cloud_manager.get_instance_id(inst)
-
         with emit_spinner_on_travis("Building debs from local source... "):
+            output_deb_dir = os.path.join(tempfile.gettempdir(), series)
             deb_paths = build_debs(
-                build_container_name,
-                output_deb_dir=os.path.join(tempfile.gettempdir(), series),
-                cloud_api=context.config.cloud_api,
+                series=series,
+                output_deb_dir=output_deb_dir,
                 cache_source=context.config.cache_source,
             )
+            context.config.debs_path = output_deb_dir
+
+        logging.info("--- sbuild has finished building the packages")
 
     if "pro" in context.config.machine_type:
         return deb_paths
@@ -672,7 +669,9 @@ def build_debs_from_dev_instance(context: Context, series: str) -> "List[str]":
     return [deb_path for deb_path in deb_paths if "pro" not in deb_path]
 
 
-def create_uat_image(context: Context, series: str) -> None:
+def create_instance_with_uat_installed(
+    context: Context, series: str, name: str
+) -> None:
     """Create a given series lxd image with ubuntu-advantage-tools installed
 
     This will launch a container, install ubuntu-advantage-tools, and publish
@@ -687,7 +686,7 @@ def create_uat_image(context: Context, series: str) -> None:
     """
 
     if series in context.reuse_container:
-        print(
+        logging.info(
             "\n Reusing the existing container: ",
             context.reuse_container[series],
         )
@@ -695,28 +694,21 @@ def create_uat_image(context: Context, series: str) -> None:
     ppa = context.config.ppa
     if ppa == "":
         image_name = context.config.cloud_manager.locate_image_name(series)
-        print(
+        logging.info(
             "--- Unset UACLIENT_BEHAVE_PPA. Using ubuntu-advantage-tools "
             + "from image: {}".format(image_name)
         )
         context.series_image_name[series] = image_name
         return
 
-    time_suffix = datetime.datetime.now().strftime("%s%f")
     deb_paths = []
     if context.config.build_pr:
-        deb_paths = build_debs_from_dev_instance(context, series)
+        deb_paths = build_debs_from_sbuild(context, series)
 
-    print(
+    logging.info(
         "--- Launching VM to create a base image with updated ubuntu-advantage"
     )
 
-    is_vm = bool(context.config.machine_type == "lxd.vm")
-    build_container_name = "ubuntu-behave-image-build-%s-%s" % (
-        "-vm" if is_vm else "",
-        series + time_suffix,
-    )
-
     user_data = ""
     ud_file = context.config.userdata_file
     if ud_file and os.path.exists(ud_file):
@@ -747,44 +739,38 @@ def create_uat_image(context: Context, series: str) -> None:
                 ppa_url=ppa, ppa_keyid=ppa_keyid
             )
     inst = context.config.cloud_manager.launch(
-        instance_name=build_container_name, series=series, user_data=user_data
+        instance_name=name, series=series, user_data=user_data
     )
-    build_container_name = context.config.cloud_manager.get_instance_id(inst)
+    instance_id = context.config.cloud_manager.get_instance_id(inst)
 
     _install_uat_in_container(
-        build_container_name,
+        instance_id,
         series=series,
         config=context.config,
         machine_type=context.config.machine_type,
         deb_paths=deb_paths,
     )
 
-    image_name = _capture_container_as_image(
-        build_container_name,
-        image_name="ubuntu-behave-image-%s-" % series + time_suffix,
-        cloud_api=context.config.cloud_api,
-    )
-    context.series_image_name[series] = image_name
-    inst.delete(wait=False)
+    return inst
 
 
 def _install_uat_in_container(
-    container_name: str,
+    container_id: str,
     series: str,
     config: UAClientBehaveConfig,
     machine_type: str,
-    deb_paths: "Optional[List[str]]" = None,
+    deb_paths: Optional[List[str]] = None,
 ) -> None:
     """Install ubuntu-advantage-tools into the specified container
 
-    :param container_name:
-        The name of the container into which ubuntu-advantage-tools should be
+    :param container_id:
+        The id of the container into which ubuntu-advantage-tools should be
         installed.
     :param series: The name of the series that is being used
     :param config: UAClientBehaveConfig
     :param deb_paths: Optional paths to local deb files we need to install
     """
-    cmds: "List[Any]" = [["systemctl", "is-system-running", "--wait"]]
+    cmds: List[Any] = [["systemctl", "is-system-running", "--wait"]]
 
     if deb_paths is None:
         deb_paths = []
@@ -793,7 +779,7 @@ def _install_uat_in_container(
         cmds.append(["sudo", "apt-get", "update", "-qqy"])
 
         deb_files = []
-        inst = config.cloud_api.get_instance(container_name)
+        inst = config.cloud_api.get_instance(container_id)
 
         for deb_file in deb_paths:
             if "pro" in deb_file and "pro" not in config.machine_type:
@@ -823,6 +809,7 @@ def _install_uat_in_container(
         if "pro" in machine_type:
             ua_pkg.append("ubuntu-advantage-pro")
 
+        cmds.append(["sudo", "apt-get", "update"])
         cmds.append(
             " ".join(
                 [
@@ -853,14 +840,14 @@ def _install_uat_in_container(
         cmds.append("sudo ua detach --assume-yes")
 
     cmds.append(["ua", "version"])
-    instance = config.cloud_api.get_instance(container_name)
+    instance = config.cloud_api.get_instance(container_id)
     for cmd in cmds:  # type: ignore
         result = instance.execute(cmd)
         if result.failed:
-            print(
+            logging.info(
                 "--- Failed {}: out {} err {}".format(
                     cmd, result.stdout, result.stderr
                 )
             )
         elif "version" in cmd:
-            print("--- " + result)
+            logging.info("--- " + result)
diff --git a/features/install_uninstall.feature b/features/install_uninstall.feature
new file mode 100644
index 0000000..6f9fd66
--- /dev/null
+++ b/features/install_uninstall.feature
@@ -0,0 +1,46 @@
+Feature: UA Install and Uninstall related tests
+
+    @series.all
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Do not fail on postinst when cloud-id returns error
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I delete the file `/run/cloud-init/instance-data.json`
+        Then I verify that running `dpkg-reconfigure ubuntu-advantage-tools` `with sudo` exits `0`
+
+        Examples: ubuntu release
+           | release |
+           | xenial  |
+           | bionic  |
+           | focal   |
+           | hirsute |
+
+    @series.lts
+    @uses.config.contract_token
+    @uses.config.machine_type.lxd.container
+    Scenario Outline: Purge package after attaching it to a machine
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I attach `contract_token` with sudo
+        And I run `touch /etc/apt/preferences.d/ubuntu-esm-infra` with sudo
+        Then I verify that files exist matching `/var/log/ubuntu-advantage.log`
+        And I verify that running `test -d /var/lib/ubuntu-advantage` `with sudo` exits `0`
+        And I verify that files exist matching `/etc/apt/auth.conf.d/90ubuntu-advantage`
+        And I verify that files exist matching `/etc/apt/trusted.gpg.d/ubuntu-advantage-esm-infra-trusty.gpg`
+        And I verify that files exist matching `/etc/apt/sources.list.d/ubuntu-esm-infra.list`
+        And I verify that files exist matching `/etc/apt/preferences.d/ubuntu-esm-infra`
+        When I run `apt-get purge ubuntu-advantage-tools -y` with sudo, retrying exit [100]
+        Then stdout matches regexp:
+        """
+        Purging configuration files for ubuntu-advantage-tools
+        """
+        And I verify that no files exist matching `/var/log/ubuntu-advantage.log`
+        And I verify that no files exist matching `/var/lib/ubuntu-advantage`
+        And I verify that no files exist matching `/etc/apt/auth.conf.d/90ubuntu-advantage`
+        And I verify that no files exist matching `/etc/apt/sources.list.d/ubuntu-*`
+        And I verify that no files exist matching `/etc/apt/trusted.gpg.d/ubuntu-advantage-*`
+        And I verify that no files exist matching `/etc/apt/preferences.d/ubuntu-*`
+
+        Examples: ubuntu release
+           | release |
+           | bionic  |
+           | focal   |
+           | xenial  |
diff --git a/features/license_check.feature b/features/license_check.feature
new file mode 100644
index 0000000..54479e2
--- /dev/null
+++ b/features/license_check.feature
@@ -0,0 +1,120 @@
+Feature: License check timer only runs in environments where necessary
+
+    @series.lts
+    @uses.config.contract_token
+    @uses.config.machine_type.gcp.generic
+    Scenario Outline: license_check job should run periodically on gcp generic lts
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        # verify its enabled
+        Then I verify the `ua-license-check` systemd timer is scheduled to run within `10` minutes
+        # run it and verify that it didn't disable itself
+        When I run `systemctl start ua-license-check.service` with sudo
+        When I wait `5` seconds
+        Then I verify the `ua-license-check` systemd timer is scheduled to run within `10` minutes
+        # verify attach disables it
+        When I wait `5` seconds
+        When I attach `contract_token` with sudo
+        Then I verify the `ua-license-check` systemd timer is disabled
+        # verify detach enables it
+        When I run `ua detach --assume-yes` with sudo
+        Then I verify the `ua-license-check` systemd timer is scheduled to run within `10` minutes
+        # verify stopping and deleting marker file and stopping disables it
+        #   We need to call stop both before and after rm-ing the marker file
+        #     because at least one version of systemd requires it before (245.4-4ubuntu3.11
+        #     on focal gcp), and every other tested version of systemd requires it after
+        #   But this is only necessary when manually running the steps or in this test.
+        #     `disable_license_checks_if_applicable` works fine with only calling stop after,
+        #     as evidenced by the "verify attach disables it" steps above passing on focal gcp.
+        When I run `systemctl stop ua-license-check.timer` with sudo
+        When I run `rm /var/lib/ubuntu-advantage/marker-license-check` with sudo
+        When I run `systemctl stop ua-license-check.timer` with sudo
+        Then I verify the `ua-license-check` systemd timer is disabled
+        # verify creating marker file enables it
+        When I run `touch /var/lib/ubuntu-advantage/marker-license-check` with sudo
+        Then I verify the `ua-license-check` systemd timer is scheduled to run within `10` minutes
+        Examples: version
+            | release |
+            | xenial  |
+            | bionic  |
+            | focal   |
+
+    @series.hirsute
+    @uses.config.contract_token
+    @uses.config.machine_type.gcp.generic
+    Scenario Outline: license_check is disabled gcp generic non lts
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        Then I verify the `ua-license-check` systemd timer is disabled
+        # verify creating marker file enables it, but it disables itself
+        When I run `touch /var/lib/ubuntu-advantage/marker-license-check` with sudo
+        Then I verify the `ua-license-check` systemd timer either ran within the past `5` seconds OR is scheduled to run within `10` minutes
+        When I run `systemctl start ua-license-check.service` with sudo
+        When I wait `5` seconds
+        Then I verify the `ua-license-check` systemd timer is disabled
+        # verify attach and detach does not enable it
+        When I wait `5` seconds
+        When I attach `contract_token` with sudo
+        When I run `ua detach --assume-yes` with sudo
+        When I wait `5` seconds
+        Then I verify the `ua-license-check` systemd timer is disabled
+        Examples: version
+            | release |
+            | hirsute |
+
+    @series.all
+    @uses.config.contract_token
+    @uses.config.machine_type.lxd.container
+    @uses.config.machine_type.lxd.vm
+    @uses.config.machine_type.aws.generic
+    @uses.config.machine_type.azure.generic
+    Scenario Outline: license_check is disabled everywhere but gcp generic
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        Then I verify the `ua-license-check` systemd timer is disabled
+        When I reboot the `<release>` machine
+        Then I verify the `ua-license-check` systemd timer is disabled
+        # verify creating marker file enables it, but it disables itself
+        When I run `touch /var/lib/ubuntu-advantage/marker-license-check` with sudo
+        Then I verify the `ua-license-check` systemd timer either ran within the past `5` seconds OR is scheduled to run within `10` minutes
+        When I run `systemctl start ua-license-check.service` with sudo
+        When I wait `5` seconds
+        And I verify that running `grep "Disabling gcp_auto_attach job" /var/log/ubuntu-advantage-license-check.log` `with sudo` exits `0`
+        And I verify that running `grep "Disabling gcp_auto_attach job" /var/log/ubuntu-advantage.log` `with sudo` exits `1`
+        Then I verify the `ua-license-check` systemd timer is disabled
+        # verify attach and detach does not enable it
+        When I wait `5` seconds
+        When I attach `contract_token` with sudo
+        When I run `ua detach --assume-yes` with sudo
+        When I wait `5` seconds
+        Then I verify the `ua-license-check` systemd timer is disabled
+        Examples: version
+            | release |
+            | xenial  |
+            | bionic  |
+            | focal   |
+            | hirsute |
+
+    @series.lts
+    @uses.config.machine_type.aws.pro
+    @uses.config.machine_type.azure.pro
+    @uses.config.machine_type.gcp.pro
+    Scenario Outline: license_check is disabled everywhere but gcp generic
+        Given a `<release>` machine with ubuntu-advantage-tools installed
+        When I create the file `/etc/ubuntu-advantage/uaclient.conf` with the following:
+        """
+        contract_url: 'https://contracts.canonical.com'
+        data_dir: /var/lib/ubuntu-advantage
+        log_level: debug
+        log_file: /var/log/ubuntu-advantage.log
+        """
+        When I run `ua auto-attach` with sudo
+        Then I verify the `ua-license-check` systemd timer is disabled
+        # verify creating marker file enables it, but it disables itself
+        When I run `touch /var/lib/ubuntu-advantage/marker-license-check` with sudo
+        Then I verify the `ua-license-check` systemd timer either ran within the past `5` seconds OR is scheduled to run within `10` minutes
+        When I run `systemctl start ua-license-check.service` with sudo
+        When I wait `5` seconds
+        Then I verify the `ua-license-check` systemd timer is disabled
+        Examples: version
+            | release |
+            | xenial  |
+            | bionic  |
+            | focal   |
diff --git a/features/proxy_config.feature b/features/proxy_config.feature
index 1bdcfa0..46b549a 100644
--- a/features/proxy_config.feature
+++ b/features/proxy_config.feature
@@ -2,6 +2,7 @@
 Feature: Proxy configuration
 
     @series.lts
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attach command when proxy is configured
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I launch a `focal` `proxy` machine
@@ -83,6 +84,11 @@ Feature: Proxy configuration
         """
         "invalidurl" is not a valid url. Not setting as proxy.
         """
+        When I verify that running `ua config set http_proxy=http://host:port` `with sudo` exits `1`
+        Then stderr matches regexp:
+        """
+        "http://host:port" is not a valid url. Not setting as proxy
+        """
         When I create the file `/etc/ubuntu-advantage/uaclient.conf` with the following:
         """
         ua_config:
@@ -208,6 +214,7 @@ Feature: Proxy configuration
            | bionic  |
 
     @series.lts
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attach command when authenticated proxy is configured
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I launch a `focal` `proxy` machine
diff --git a/features/staging_commands.feature b/features/staging_commands.feature
index f768851..360b329 100644
--- a/features/staging_commands.feature
+++ b/features/staging_commands.feature
@@ -1,25 +1,8 @@
 @uses.config.contract_token_staging
 Feature: Enable command behaviour when attached to an UA staging subscription
 
-    @series.xenial
-    Scenario: Attached enable CC EAL service in a xenial lxd container
-        Given a `xenial` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        Then I verify that running `ua enable cc-eal` `as non-root` exits `1`
-        And I will see the following on stderr:
-            """
-            This command must be run as root (try using sudo).
-            """
-        When I run `ua enable cc-eal --beta` with sudo
-        Then I will see the following on stdout:
-            """
-            One moment, checking your subscription first
-            GPG key '/usr/share/keyrings/ubuntu-cc-keyring.gpg' not found.
-            """ 
-
-    @series.xenial
-    @series.bionic
-    @series.focal
+    @series.lts
+    @uses.config.machine_type.lxd.container
     Scenario Outline: Attached enable esm-apps on a machine
         Given a `<release>` machine with ubuntu-advantage-tools installed
         When I attach `contract_token_staging` with sudo
@@ -107,518 +90,3 @@ Feature: Enable command behaviour when attached to an UA staging subscription
            | bionic  | bundler  |
            | focal   | ant      |
            | xenial  | jq       |
-
-    @series.xenial
-    @series.bionic
-    @uses.config.machine_type.lxd.vm
-    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        And I run `ua disable livepatch` with sudo
-        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
-        And I run `apt-mark hold openssh-client openssh-server strongswan` with sudo
-        And I run `ua enable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            Installing <fips-name> packages
-            <fips-name> enabled
-            A reboot is required to complete install
-            """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                enabled
-            """
-        And stdout matches regexp:
-            """
-            FIPS support requires system reboot to complete configuration
-            """
-        And I verify that running `apt update` `with sudo` exits `0`
-        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
-        When I reboot the `<release>` machine
-        And  I run `uname -r` as non-root
-        Then stdout matches regexp:
-            """
-            fips
-            """
-        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
-        Then I will see the following on stdout:
-        """
-        1
-        """
-        When I run `ua status --all` with sudo
-        Then stdout does not match regexp:
-            """
-            FIPS support requires system reboot to complete configuration
-            """
-        When I run `ua disable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            A reboot is required to complete disable operation
-            """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            Disabling FIPS requires system reboot to complete operation
-            """
-        When I run `apt-cache policy ubuntu-fips` as non-root
-        Then stdout matches regexp:
-        """
-        .*Installed: \(none\)
-        """
-        When I reboot the `<release>` machine
-        Then I verify that `openssh-server` installed version matches regexp `fips`
-        And I verify that `openssh-client` installed version matches regexp `fips`
-        And I verify that `strongswan` installed version matches regexp `fips`
-        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
-        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
-        And I verify that `strongswan-hmac` installed version matches regexp `fips`
-        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
-        Then I will see the following on stdout:
-        """
-        openssh-client was already not hold.
-        openssh-server was already not hold.
-        strongswan was already not hold.
-        """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                disabled
-            """
-        Then stdout does not match regexp:
-            """
-            Disabling FIPS requires system reboot to complete operation
-            """
-
-        Examples: ubuntu release
-           | release | fips-name    | fips-service |fips-apt-source                                        |
-           | xenial  | FIPS         | fips         |https://esm.staging.ubuntu.com/fips/ubuntu xenial/main |
-           | bionic  | FIPS         | fips         |https://esm.staging.ubuntu.com/fips/ubuntu bionic/main |
-
-    @series.xenial
-    @series.bionic
-    @uses.config.machine_type.lxd.vm
-    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        And I run `ua disable livepatch` with sudo
-        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
-        When I run `ua enable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            Installing <fips-name> packages
-            <fips-name> enabled
-            A reboot is required to complete install
-            """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                enabled
-            """
-        And I verify that running `apt update` `with sudo` exits `0`
-        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
-        When I reboot the `<release>` machine
-        And  I run `uname -r` as non-root
-        Then stdout matches regexp:
-            """
-            fips
-            """
-        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
-        Then I will see the following on stdout:
-        """
-        1
-        """
-        When I run `ua disable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            A reboot is required to complete disable operation
-            """
-        When I reboot the `<release>` machine
-        Then I verify that `openssh-server` installed version matches regexp `fips`
-        And I verify that `openssh-client` installed version matches regexp `fips`
-        And I verify that `strongswan` installed version matches regexp `fips`
-        And I verify that `openssh-server-hmac` installed version matches regexp `fips`
-        And I verify that `openssh-client-hmac` installed version matches regexp `fips`
-        And I verify that `strongswan-hmac` installed version matches regexp `fips`
-        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
-        Then I will see the following on stdout:
-        """
-        openssh-client was already not hold.
-        openssh-server was already not hold.
-        strongswan was already not hold.
-        """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                disabled
-            """
-        When I verify that running `ua enable fips --assume-yes` `with sudo` exits `1`
-        Then stdout matches regexp:
-            """
-            Cannot enable FIPS because FIPS Updates was once enabled.
-            """
-        And I verify that files exist matching `/var/lib/ubuntu-advantage/services-once-enabled`
-
-        Examples: ubuntu release
-           | release | fips-name    | fips-service |fips-apt-source                                                        |
-           | xenial  | FIPS Updates | fips-updates |https://esm.staging.ubuntu.com/fips-updates/ubuntu xenial-updates/main |
-           | bionic  | FIPS Updates | fips-updates |https://esm.staging.ubuntu.com/fips-updates/ubuntu bionic-updates/main |
-
-    @series.focal
-    @uses.config.machine_type.lxd.vm
-    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
-        And I create the file `/home/ubuntu/machine-token-overlay.json` with the following:
-        """
-        {
-           "availableResources": [
-               {
-                 "available": true,
-                 "name": "fips"
-               }
-            ],
-            "machineTokenInfo": {
-                "contractInfo": {
-                   "resourceEntitlements": [
-                      {
-                        "type": "fips",
-                        "entitled": true,
-                        "affordances": {
-                          "series": [
-                            "xenial",
-                            "bionic",
-                            "focal"
-                          ]
-                         },
-                        "directives": {
-                          "suites": [
-                            "xenial",
-                            "bionic",
-                            "focal"
-                          ]
-                        }
-                     }
-                   ]
-                }
-            }
-        }
-        """
-        And I append the following on uaclient config:
-        """
-        features:
-          machine_token_overlay: "/home/ubuntu/machine-token-overlay.json"
-        """
-        When I run `ua enable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            Installing <fips-name> packages
-            FIPS strongswan-hmac package could not be installed
-            <fips-name> enabled
-            A reboot is required to complete install
-            """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                enabled
-            """
-        And I verify that running `apt update` `with sudo` exits `0`
-        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
-        When I reboot the `<release>` machine
-        And  I run `uname -r` as non-root
-        Then stdout matches regexp:
-            """
-            fips
-            """
-        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
-        Then I will see the following on stdout:
-        """
-        1
-        """
-        When I run `ua disable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            A reboot is required to complete disable operation
-            """
-        When I reboot the `<release>` machine
-        Then I verify that `openssh-server` installed version matches regexp `fips`
-        And I verify that `openssh-client` installed version matches regexp `fips`
-        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
-        Then I will see the following on stdout:
-        """
-        openssh-client was already not hold.
-        openssh-server was already not hold.
-        strongswan was already not hold.
-        """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                disabled
-            """
-
-        Examples: ubuntu release
-           | release | fips-name    | fips-service |fips-apt-source                               |
-           | focal   | FIPS         | fips |https://esm.staging.ubuntu.com/fips/ubuntu focal/main |
-
-    @series.focal
-    @uses.config.machine_type.lxd.vm
-    Scenario Outline: Attached enable of vm-based services in an ubuntu lxd vm
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
-        And I create the file `/home/ubuntu/machine-token-overlay.json` with the following:
-        """
-        {
-           "availableResources": [
-               {
-                 "available": true,
-                 "name": "fips-updates"
-               }
-            ],
-            "machineTokenInfo": {
-                "contractInfo": {
-                   "resourceEntitlements": [
-                      {
-                        "type": "fips-updates",
-                        "entitled": true,
-                        "affordances": {
-                          "series": [
-                            "xenial",
-                            "bionic",
-                            "focal"
-                          ]
-                         },
-                        "directives": {
-                          "suites": [
-                            "xenial-updates",
-                            "bionic-updates",
-                            "focal-updates"
-                          ]
-                        }
-                     }
-                   ]
-                }
-            }
-        }
-        """
-        And I append the following on uaclient config:
-        """
-        features:
-          machine_token_overlay: "/home/ubuntu/machine-token-overlay.json"
-        """
-        When I run `ua enable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            Installing <fips-name> packages
-            <fips-name> enabled
-            A reboot is required to complete install
-            """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                enabled
-            """
-        And I verify that running `apt update` `with sudo` exits `0`
-        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
-        When I reboot the `<release>` machine
-        And  I run `uname -r` as non-root
-        Then stdout matches regexp:
-            """
-            fips
-            """
-        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
-        Then I will see the following on stdout:
-        """
-        1
-        """
-        When I run `ua disable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            A reboot is required to complete disable operation
-            """
-        When I reboot the `<release>` machine
-        Then I verify that `openssh-server` installed version matches regexp `fips`
-        And I verify that `openssh-client` installed version matches regexp `fips`
-        And I verify that `strongswan` installed version matches regexp `fips`
-        And I verify that `strongswan-hmac` installed version matches regexp `fips`
-        When I run `apt-mark unhold openssh-client openssh-server strongswan` with sudo
-        Then I will see the following on stdout:
-        """
-        openssh-client was already not hold.
-        openssh-server was already not hold.
-        strongswan was already not hold.
-        """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                disabled
-            """
-        When I verify that running `ua enable fips --assume-yes` `with sudo` exits `1`
-        Then stdout matches regexp:
-            """
-            Cannot enable FIPS because FIPS Updates was once enabled.
-            """
-        And I verify that files exist matching `/var/lib/ubuntu-advantage/services-once-enabled`
-
-        Examples: ubuntu release
-           | release | fips-name    | fips-service |fips-apt-source                                                       |
-           | focal   | FIPS Updates | fips-updates |https://esm.staging.ubuntu.com/fips-updates/ubuntu focal-updates/main |
-
-   @series.xenial
-   @uses.config.machine_type.lxd.vm
-   Scenario Outline: Attached FIPS upgrade across LTS releases
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        And I run `apt-get install lsof` with sudo, retrying exit [100]
-        And I run `ua disable livepatch` with sudo
-        And I run `ua enable <fips-service> --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            Installing <fips-name> packages
-            <fips-name> enabled
-            A reboot is required to complete install
-            """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            <fips-service> +yes                enabled
-            """
-        And I verify that running `apt update` `with sudo` exits `0`
-        When I reboot the `<release>` machine
-        And  I run `uname -r` as non-root
-        Then stdout matches regexp:
-        """
-        fips
-        """
-        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
-        Then I will see the following on stdout:
-        """
-        1
-        """
-        When I run `apt-get dist-upgrade -y --allow-downgrades` with sudo
-        # A package may need a reboot after running dist-upgrade
-        And I reboot the `<release>` machine
-        And I create the file `/etc/update-manager/release-upgrades.d/ua-test.cfg` with the following
-        """
-        [Sources]
-        AllowThirdParty=yes
-        """
-        Then I verify that running `do-release-upgrade --frontend DistUpgradeViewNonInteractive` `with sudo` exits `0`
-        When I reboot the `<release>` machine
-        And I run `lsb_release -cs` as non-root
-        Then I will see the following on stdout:
-        """
-        <next_release>
-        """
-        When I verify that running `egrep "disabled" /etc/apt/sources.list.d/<source-file>.list` `as non-root` exits `1`
-        Then I will see the following on stdout:
-        """
-        """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-        """
-        <fips-service> +yes                enabled
-        """
-        When  I run `uname -r` as non-root
-        Then stdout matches regexp:
-            """
-            fips
-            """
-        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
-        Then I will see the following on stdout:
-        """
-        1
-        """
-
-        Examples: ubuntu release
-        | release | next_release | fips-service  | fips-name    | source-file         |
-        | xenial  | bionic       | fips          | FIPS         | ubuntu-fips         |
-        | xenial  | bionic       | fips-updates  | FIPS Updates | ubuntu-fips-updates |
-
-    @series.xenial
-    @series.bionic
-    @uses.config.machine_type.lxd.vm
-    Scenario Outline: Attached enable fips-updates on fips enabled vm
-        Given a `<release>` machine with ubuntu-advantage-tools installed
-        When I attach `contract_token_staging` with sudo
-        And I run `ua disable livepatch` with sudo
-        And I run `DEBIAN_FRONTEND=noninteractive apt-get install -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -y openssh-client openssh-server strongswan` with sudo, retrying exit [100]
-        And I run `ua enable fips --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            Installing FIPS packages
-            FIPS enabled
-            A reboot is required to complete install
-            """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            fips +yes                enabled
-            """
-        When I reboot the `<release>` machine
-        And  I run `ua enable fips-updates --assume-yes` with sudo
-        Then stdout matches regexp:
-            """
-            Updating package lists
-            Installing FIPS Updates packages
-            FIPS Updates enabled
-            A reboot is required to complete install
-            """
-        When I run `ua status --all` with sudo
-        Then stdout matches regexp:
-            """
-            fips +yes                n/a
-            """
-        And stdout matches regexp:
-            """
-            fips-updates +yes                enabled
-            """
-        When I reboot the `<release>` machine
-        Then I verify that running `apt update` `with sudo` exits `0`
-        And I verify that `ubuntu-fips` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-server` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-server-hmac` is installed from apt source `<fips-apt-source>`
-        And I verify that `openssh-client-hmac` is installed from apt source `<fips-apt-source>`
-        And I verify that `strongswan-hmac` is installed from apt source `<fips-apt-source>`
-        When  I run `uname -r` as non-root
-        Then stdout matches regexp:
-            """
-            fips
-            """
-        When I run `cat /proc/sys/crypto/fips_enabled` with sudo
-        Then I will see the following on stdout:
-        """
-        1
-        """
-
-        Examples: ubuntu release
-           | release | fips-apt-source                                                        |
-           | xenial  | https://esm.staging.ubuntu.com/fips-updates/ubuntu xenial-updates/main |
-           | bionic  | https://esm.staging.ubuntu.com/fips-updates/ubuntu bionic-updates/main |
diff --git a/features/steps/steps.py b/features/steps/steps.py
index 390a829..4b662b1 100644
--- a/features/steps/steps.py
+++ b/features/steps/steps.py
@@ -1,27 +1,48 @@
 import datetime
 import logging
 import os
-import subprocess
 import re
 import shlex
+import subprocess
 import time
 
+import yaml
 from behave import given, then, when
 from hamcrest import (
     assert_that,
+    contains_string,
     equal_to,
     matches_regexp,
     not_,
-    contains_string,
 )
 
-from features.environment import create_uat_image
+from features.environment import (
+    capture_container_as_image,
+    create_instance_with_uat_installed,
+)
 from features.util import SLOW_CMDS, emit_spinner_on_travis, nullcontext
-
 from uaclient.defaults import DEFAULT_CONFIG_FILE, DEFAULT_MACHINE_TOKEN_PATH
+from uaclient.util import DatetimeAwareJSONDecoder
 
+CONTAINER_PREFIX = "ubuntu-behave-test"
+IMAGE_BUILD_PREFIX = "ubuntu-behave-image-build"
+IMAGE_PREFIX = "ubuntu-behave-image"
 
-CONTAINER_PREFIX = "ubuntu-behave-test-"
+
+def add_test_name_suffix(context, series, prefix):
+    pr_number = os.environ.get("UACLIENT_BEHAVE_JENKINS_CHANGE_ID")
+    pr_suffix = "-" + str(pr_number) if pr_number else ""
+    is_vm = bool(context.config.machine_type == "lxd.vm")
+    vm_suffix = "-vm" if is_vm else ""
+    time_suffix = datetime.datetime.now().strftime("-%s%f")
+
+    return "{prefix}{pr_suffix}{vm_suffix}-{series}{time_suffix}".format(
+        prefix=prefix,
+        pr_suffix=pr_suffix,
+        vm_suffix=vm_suffix,
+        series=series,
+        time_suffix=time_suffix,
+    )
 
 
 @given("a `{series}` machine with ubuntu-advantage-tools installed")
@@ -38,29 +59,44 @@ def given_a_machine(context, series):
             ] = context.config.cloud_api.get_instance(context.container_name)
         return
 
-    if series not in context.series_image_name:
-        with emit_spinner_on_travis():
-            create_uat_image(context, series)
+    instance_name = add_test_name_suffix(context, series, CONTAINER_PREFIX)
 
-    is_vm = bool(context.config.machine_type == "lxd.vm")
-    pr_number = os.environ.get("UACLIENT_BEHAVE_JENKINS_CHANGE_ID")
-    now = datetime.datetime.now()
-
-    vm_prefix = "vm-" if is_vm else ""
-    pr_prefix = str(pr_number) + "-" if pr_number else ""
-    date_prefix = now.strftime("-%s%f")
+    if context.config.snapshot_strategy:
+        if series not in context.series_image_name:
+            with emit_spinner_on_travis():
+                build_container_name = add_test_name_suffix(
+                    context, series, IMAGE_BUILD_PREFIX
+                )
+                image_inst = create_instance_with_uat_installed(
+                    context, series, build_container_name
+                )
 
-    instance_name = (
-        CONTAINER_PREFIX + pr_prefix + vm_prefix + series + date_prefix
-    )
+                image_name = add_test_name_suffix(
+                    context, series, IMAGE_PREFIX
+                )
+                image_inst_id = context.config.cloud_manager.get_instance_id(
+                    image_inst
+                )
+                image_id = capture_container_as_image(
+                    image_inst_id,
+                    image_name=image_name,
+                    cloud_api=context.config.cloud_api,
+                )
+                context.series_image_name[series] = image_id
+                image_inst.delete(wait=False)
 
-    context.instances = {
-        "uaclient": context.config.cloud_manager.launch(
+        inst = context.config.cloud_manager.launch(
             series=series,
             instance_name=instance_name,
             image_name=context.series_image_name[series],
+            ephemeral=context.config.ephemeral_instance,
         )
-    }
+    else:
+        inst = create_instance_with_uat_installed(
+            context, series, instance_name
+        )
+
+    context.instances = {"uaclient": inst}
 
     context.container_name = context.config.cloud_manager.get_instance_id(
         context.instances["uaclient"]
@@ -68,7 +104,7 @@ def given_a_machine(context, series):
 
     def cleanup_instance() -> None:
         if not context.config.destroy_instances:
-            print(
+            logging.info(
                 "--- Leaving instance running: {}".format(
                     context.instances["uaclient"].name
                 )
@@ -77,17 +113,16 @@ def given_a_machine(context, series):
             try:
                 context.instances["uaclient"].delete(wait=False)
             except RuntimeError as e:
-                print(
+                logging.error(
                     "Failed to delete instance: {}\n{}".format(
                         context.instances["uaclient"].name, str(e)
                     )
                 )
 
     context.add_cleanup(cleanup_instance)
-    logging.warning(
+    logging.info(
         "--- instance ip: {}".format(context.instances["uaclient"].ip)
     )
-    print("--- instance ip: {}".format(context.instances["uaclient"].ip))
 
 
 @when("I launch a `{series}` `{instance_name}` machine")
@@ -104,7 +139,7 @@ def launch_machine(context, series, instance_name):
         try:
             context.instances[instance_name].delete(wait=False)
         except RuntimeError as e:
-            print(
+            logging.error(
                 "Failed to delete instance: {}\n{}".format(
                     context.instances[instance_name].name, str(e)
                 )
@@ -154,7 +189,7 @@ def when_i_retry_run_command(context, command, user_spec, exit_codes):
                 "Exhausted retries waiting for exit codes: %s", exit_codes
             )
             break
-        print(
+        logging.info(
             "--- Retrying on exit {exit_code}: {command}".format(
                 exit_code=context.process.returncode, command=command
             )
@@ -163,6 +198,15 @@ def when_i_retry_run_command(context, command, user_spec, exit_codes):
     assert_that(context.process.returncode, equal_to(0))
 
 
+@when("I run `{command}` `{user_spec}` and stdin `{stdin}`")
+def when_i_run_command_with_stdin(
+    context, command, user_spec, stdin, instance_name="uaclient"
+):
+    when_i_run_command(
+        context=context, command=command, user_spec=user_spec, stdin=stdin
+    )
+
+
 @when("I run `{command}` {user_spec}")
 def when_i_run_command(
     context,
@@ -197,9 +241,9 @@ def when_i_run_command(
     )
 
     if verify_return and result.return_code != 0:
-        print("Error executing command: {}".format(command))
-        print("stdout: {}".format(result.stdout))
-        print("stderr: {}".format(result.stderr))
+        logging.error("Error executing command: {}".format(command))
+        logging.error("stdout: {}".format(result.stdout))
+        logging.error("stderr: {}".format(result.stderr))
 
     if verify_return:
         assert_that(process.returncode, equal_to(0))
@@ -287,7 +331,7 @@ def when_i_attach_staging_token(
             except IndexError:  # no more timeouts
                 logging.warning("Exhausted retries waiting for exit code: 0")
                 break
-            print(
+            logging.info(
                 "--- Retrying on exit {exit_code}: {cmd}".format(
                     exit_code=context.process.returncode, cmd=cmd
                 )
@@ -323,11 +367,23 @@ def when_i_create_file_with_content(context, file_path):
     when_i_run_command(context, cmd, "with sudo")
 
 
+@when("I delete the file `{file_path}`")
+def when_i_delete_file(context, file_path):
+    cmd = "rm -rf {}".format(file_path)
+    cmd = 'sh -c "{}"'.format(cmd)
+    when_i_run_command(context, cmd, "with sudo")
+
+
 @when("I reboot the `{series}` machine")
 def when_i_reboot_the_machine(context, series):
     context.instances["uaclient"].restart(wait=True)
 
 
+@when("I wait `{seconds}` seconds")
+def when_i_wait(context, seconds):
+    time.sleep(int(seconds))
+
+
 @then("I will see the following on stdout")
 def then_i_will_see_on_stdout(context):
     assert_that(context.process.stdout.strip(), equal_to(context.text))
@@ -337,31 +393,47 @@ def then_i_will_see_on_stdout(context):
 def then_conditional_stdout_matches_regexp(context, value1, value2):
     """Only apply regex assertion if value1 in value2."""
     if value1 in value2.split(" or "):
-        then_stdout_matches_regexp(context)
+        then_stream_matches_regexp(context, "stdout")