use static uid/gid in images

This centralizes all user and group creation into a single source. This
will fix any current and furture uid/gid mismatches (such as with
nova-libvirt).

In the process, we also unify users between the distros in a standard
way. The users in the following containers change from thier defaults:

Ubuntu: _chrony user is now chrony
Ubuntu: memcache user is now memcached
All: qemu user is used for ownership and socket permissions

All uid and gid numbers are customizable via kolla-build.conf

Co-Authored-By: Kris Lindgren <klindgren@godaddy.com>
Change-Id: I120f26ab0683dc87d69727c3df8d4707e52a4543
Partially-Implements: blueprint static-uid-gid

3 files changed, 10 insertions, 21 deletions

diff --git a/docker/nova/nova-base/Dockerfile.j2 b/docker/nova/nova-base/Dockerfile.j2
index 7f8570693..13109388e 100644
--- a/docker/nova/nova-base/Dockerfile.j2
+++ b/docker/nova/nova-base/Dockerfile.j2
@@ -5,6 +5,8 @@ MAINTAINER {{ maintainer }}
 
 {% import "macros.j2" as macros with context %}
 
+{{ macros.configure_user(name='nova', groups='qemu') }}
+
 {% if install_type == 'binary' %}
     {% if base_distro in ['centos', 'oraclelinux', 'rhel'] %}
 
@@ -56,12 +58,10 @@ MAINTAINER {{ maintainer }}
 
 ADD nova-base-archive /nova-base-source
 RUN ln -s nova-base-source/* nova \
-    && useradd --user-group --create-home --home-dir /var/lib/nova nova \
-    && chmod 755 /var/lib/nova \
     && /var/lib/kolla/venv/bin/pip --no-cache-dir install --upgrade -c requirements/upper-constraints.txt /nova \
-    && mkdir -p /etc/nova /var/lib/nova \
+    && mkdir -p /etc/nova/ \
     && cp -r /nova/etc/nova/* /etc/nova/ \
-    && chown -R nova: /etc/nova /var/lib/nova \
+    && chown -R nova: /etc/nova/ \
     && sed -i 's|^exec_dirs.*|exec_dirs=/var/lib/kolla/venv/bin,/sbin,/usr/sbin,/bin,/usr/bin,/usr/local/bin,/usr/local/sbin|g' /etc/nova/rootwrap.conf
 
 COPY nova_sudoers /etc/sudoers.d/kolla_nova_sudoers
@@ -75,6 +75,4 @@ COPY extend_start.sh /usr/local/bin/kolla_extend_start
 RUN touch /usr/local/bin/kolla_nova_extend_start \
     && chmod 755 /usr/local/bin/kolla_extend_start /usr/local/bin/kolla_nova_extend_start
 
-RUN usermod -a -G kolla nova
-
 {% block nova_base_footer %}{% endblock %}
diff --git a/docker/nova/nova-libvirt/Dockerfile.j2 b/docker/nova/nova-libvirt/Dockerfile.j2
index 7fa39f819..4b2a58944 100644
--- a/docker/nova/nova-libvirt/Dockerfile.j2
+++ b/docker/nova/nova-libvirt/Dockerfile.j2
@@ -1,10 +1,12 @@
-FROM {{ namespace }}/{{ image_prefix }}nova-base:{{ tag }}
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
 MAINTAINER {{ maintainer }}
 
 {% block nova_libvirt_header %}{% endblock %}
 
 {% import "macros.j2" as macros with context %}
 
+{{ macros.configure_user(name='nova', groups='qemu') }}
+
 {% if base_distro in ['centos', 'oraclelinux', 'rhel'] %}
 
     {% set nova_libvirt_packages = [
@@ -30,8 +32,6 @@ MAINTAINER {{ maintainer }}
         'xen-utils-4.6'
     ] %}
 
-    {% set libvirt_group = 'libvirtd' %}
-
 {% elif base_distro == 'debian' %}
 
     {% set nova_libvirt_packages = [
@@ -46,22 +46,13 @@ MAINTAINER {{ maintainer }}
         'usermode'
     ] %}
 
-    {% set libvirt_group = 'libvirt' %}
-
 {% endif %}
 
 {{ macros.install_packages(nova_libvirt_packages | customizable("packages")) }}
 
-{% if base_distro in ['centos', 'oraclelinux', 'rhel'] %}
-
-RUN usermod -a -G qemu nova
-
-{% elif base_distro in ['ubuntu', 'debian'] %}
+{% if base_distro in ['ubuntu', 'debian'] %}
 
-RUN mkdir -p /etc/ceph \
-    && rm -f /etc/libvirt/qemu/networks/default.xml \
-        /etc/libvirt/qemu/networks/autostart/default.xml \
-    && usermod -a -G {{ libvirt_group }} nova
+RUN rm -f /etc/libvirt/qemu/networks/default.xml /etc/libvirt/qemu/networks/autostart/default.xml
 
 {% endif %}
 
diff --git a/docker/nova/nova-libvirt/extend_start.sh b/docker/nova/nova-libvirt/extend_start.sh
index e04d95265..a0ccf18de 100644
--- a/docker/nova/nova-libvirt/extend_start.sh
+++ b/docker/nova/nova-libvirt/extend_start.sh
@@ -5,7 +5,7 @@
 # Do not remove unless CentOS has been validated
 if [[ -c /dev/kvm ]]; then
     chmod 660 /dev/kvm
-    chown root:kvm /dev/kvm
+    chown root:qemu /dev/kvm
 fi
 
 # Mount xenfs for libxl to work