fix kolla_toolbox running with wrong HOME env

There is a possibility that the ansible-runner in kolla_toolbox
is executed with the wrong environment variables if run in a specific
way. The cause is not super clear, but the solution is to simply force
it to use the correct HOME value.

Closes-Bug: #2153544

Change-Id: Ibad84e358f21564c570161f7e4f21b117398df3b
Signed-off-by: Bertrand Lanson <bertrand.lanson@infomaniak.com>
(cherry picked from commit 2104f74a2616821c2bd848411ebfce266a3edd69)

2 files changed, 64 insertions, 1 deletions

diff --git a/ansible/library/kolla_toolbox.py b/ansible/library/kolla_toolbox.py
index 2749f3b4b..faa67dbe9 100644
--- a/ansible/library/kolla_toolbox.py
+++ b/ansible/library/kolla_toolbox.py
@@ -382,7 +382,10 @@ class KollaToolboxWorker():
         try:
             self._push_private_data_dir(kolla_toolbox, pdd, user)
 
+            exec_user = user or 'ansible'
             runner_env = {}
+            if exec_user == 'ansible':
+                runner_env['HOME'] = _PDD_BASEDIR
             if self.module._diff:
                 runner_env['ANSIBLE_DIFF_MODE'] = '1'
 
@@ -391,7 +394,7 @@ class KollaToolboxWorker():
                 ['/opt/ansible/bin/ansible-runner', 'run', pdd,
                  '--playbook', 'main.json',
                  '--rotate-artifacts', '1'],
-                user=user,
+                user=exec_user,
                 environment=runner_env
             )
             # exit 2 = task failed/unreachable; handled via event below.
diff --git a/tests/test_kolla_toolbox.py b/tests/test_kolla_toolbox.py
index 89eafdebb..818840179 100644
--- a/tests/test_kolla_toolbox.py
+++ b/tests/test_kolla_toolbox.py
@@ -649,6 +649,66 @@ class TestKollaToolboxWorkerMain(TestKollaToolboxModule):
                                   self.fake_ktbw.main)
         self.assertIn('ansible-runner', error.result['msg'])
 
+    def test_runner_exec_uses_ansible_user_when_no_user_param(self):
+        """user=None must exec ansible-runner as 'ansible', not as root.
+
+        Podman serialises user=None as null in ExecCreate; some daemon
+        versions interpret null as UID 0 (root), which breaks openstacksdk
+        lookups because HOME becomes /root instead of /var/lib/ansible.
+        """
+        self.mock_ansible_module.params['user'] = None
+
+        with mock.patch.object(self.fake_ktbw, '_push_private_data_dir'), \
+             mock.patch.object(self.fake_ktbw, '_parse_runner_result',
+                               return_value={'changed': False}):
+            self.fake_ktbw.main()
+
+        # call[0]=check_runner, call[1]=ansible-runner, call[2]=cleanup
+        runner_call = self.mock_container.exec_run.call_args_list[1]
+        self.assertEqual('ansible', runner_call.kwargs.get('user'))
+
+    def test_runner_exec_sets_home_to_pdd_basedir_for_ansible_user(self):
+        """HOME must be set to _PDD_BASEDIR to finds clouds.yaml."""
+        self.mock_ansible_module.params['user'] = None
+
+        with mock.patch.object(self.fake_ktbw, '_push_private_data_dir'), \
+             mock.patch.object(self.fake_ktbw, '_parse_runner_result',
+                               return_value={'changed': False}):
+            self.fake_ktbw.main()
+
+        runner_call = self.mock_container.exec_run.call_args_list[1]
+        env = runner_call.kwargs.get('environment', {})
+        self.assertEqual(kolla_toolbox._PDD_BASEDIR, env.get('HOME'))
+
+    def test_runner_exec_uses_explicit_user_param(self):
+        """When user='rabbitmq', ansible-runner must exec as 'rabbitmq'."""
+        self.mock_ansible_module.params['user'] = 'rabbitmq'
+
+        with mock.patch.object(self.fake_ktbw, '_push_private_data_dir'), \
+             mock.patch.object(self.fake_ktbw, '_parse_runner_result',
+                               return_value={'changed': False}):
+            self.fake_ktbw.main()
+
+        runner_call = self.mock_container.exec_run.call_args_list[1]
+        self.assertEqual('rabbitmq', runner_call.kwargs.get('user'))
+
+    def test_runner_exec_no_home_override_for_non_ansible_user(self):
+        """HOME must not be overridden for non-ansible users.
+
+        Forcing HOME=/var/lib/ansible when running as rabbitmq causes
+        PermissionError because rabbitmq cannot write to ansible's home.
+        """
+        self.mock_ansible_module.params['user'] = 'rabbitmq'
+
+        with mock.patch.object(self.fake_ktbw, '_push_private_data_dir'), \
+             mock.patch.object(self.fake_ktbw, '_parse_runner_result',
+                               return_value={'changed': False}):
+            self.fake_ktbw.main()
+
+        runner_call = self.mock_container.exec_run.call_args_list[1]
+        env = runner_call.kwargs.get('environment', {})
+        self.assertNotIn('HOME', env)
+
 
 class TestModuleInteraction(TestKollaToolboxModule):
     """Class focused on testing user input data from playbook."""