Install epel via dib for centos builds

Pre-install epel using the epel element, but set the flag so it is
default disabled.  This means we white-list any EPEL use during image
build.  See for example Idad4d68c1f26070660357e559d09859e4a4db4cd.

See also If6cf1bc300c6b59a8defb09fb3a3a1254e392a43 where we remove
EPEL install from install_puppet.sh.  Also
I714cd44afb77191c89ac82f79cf57aa85a794e6d where we overwrite the
packaged version with our local mirrors.

Change-Id: I2d060e048f9106292f9024efe0fd1d529d801a30
Depends-On: Iedf6167a7cd69418255ebbee095aea04c50d73fd

nodepool/nodepool.yaml

@@ -932,12 +932,14 @@ diskimages:
       - growroot
       - infra-package-needs
       - stackviz
+      - epel
     env-vars:
       TMPDIR: /opt/dib_tmp
       DIB_CHECKSUM: '1'
       DIB_IMAGE_CACHE: /opt/dib_cache
       QEMU_IMG_OPTIONS: compat=0.10
       DIB_GRUB_TIMEOUT: '0'
+      DIB_EPEL_DISABLED: '1'
   - name: fedora-25
     elements:
       - fedora-minimal

tools/build-image.sh

@@ -52,6 +52,14 @@ if [ ! -f ${ZUUL_USER_SSH_PUBLIC_KEY} ]; then
     exit 1
 fi
 
+## Several parts of infra node bringup require EPEL, but we don't want
+## to introduce dependencies on it, so keep disabled.
+if [[ ${DISTRO} == "centos-minimal" ]]; then
+    EXTRA_ELEMENTS+="epel "
+    export DIB_EPEL_DISABLED=1
+fi
+
+
 ## If your firewall won't allow outbound DNS connections, you'll want
 ## to set these to local resolvers
 # NODEPOOL_STATIC_NAMESERVER_V4=192.168.0.1