use static uid/gid in images

This centralizes all user and group creation into a single source. This
will fix any current and furture uid/gid mismatches (such as with
nova-libvirt).

In the process, we also unify users between the distros in a standard
way. The users in the following containers change from thier defaults:

Ubuntu: _chrony user is now chrony
Ubuntu: memcache user is now memcached
All: qemu user is used for ownership and socket permissions

All uid and gid numbers are customizable via kolla-build.conf

Co-Authored-By: Kris Lindgren <klindgren@godaddy.com>
Change-Id: I120f26ab0683dc87d69727c3df8d4707e52a4543
Partially-Implements: blueprint static-uid-gid

2 files changed, 266 insertions, 0 deletions

diff --git a/kolla/common/config.py b/kolla/common/config.py
index cacd20cb3..eb8d37bee 100755
--- a/kolla/common/config.py
+++ b/kolla/common/config.py
@@ -500,6 +500,240 @@ SOURCES = {
 }
 
 
+# NOTE(SamYaple): Only increment the UID. Never reuse old or removed UIDs.
+#     Starting point 42400+ was choosen arbitrarily to ensure no conflicts
+USERS = {
+    'kolla-user': {
+        'uid': 42400,
+        'gid': 42400,
+    },
+    'ansible-user': {
+        'uid': 42401,
+        'gid': 42401,
+    },
+    'aodh-user': {
+        'uid': 42402,
+        'gid': 42402,
+    },
+    'barbican-user': {
+        'uid': 42403,
+        'gid': 42403,
+    },
+    'bifrost-user': {
+        'uid': 42404,
+        'gid': 42404,
+    },
+    'ceilometer-user': {
+        'uid': 42405,
+        'gid': 42405,
+    },
+    'chrony-user': {
+        'uid': 42406,
+        'gid': 42406,
+    },
+    'cinder-user': {
+        'uid': 42407,
+        'gid': 42407,
+    },
+    'cloudkitty-user': {
+        'uid': 42408,
+        'gid': 42408,
+    },
+    'collectd-user': {
+        'uid': 42409,
+        'gid': 42409,
+    },
+    'congress-user': {
+        'uid': 42410,
+        'gid': 42410,
+    },
+    'designate-user': {
+        'uid': 42411,
+        'gid': 42411,
+    },
+    'elasticsearch-user': {
+        'uid': 42412,
+        'gid': 42412,
+    },
+    'etcd-user': {
+        'uid': 42413,
+        'gid': 42413,
+    },
+    'freezer-user': {
+        'uid': 42414,
+        'gid': 42414,
+    },
+    'glance-user': {
+        'uid': 42415,
+        'gid': 42415,
+    },
+    'gnocchi-user': {
+        'uid': 42416,
+        'gid': 42416,
+    },
+    'grafana-user': {
+        'uid': 42417,
+        'gid': 42417,
+    },
+    'heat-user': {
+        'uid': 42418,
+        'gid': 42418,
+    },
+    'heka-user': {
+        'uid': 42419,
+        'gid': 42419,
+    },
+    'horizon-user': {
+        'uid': 42420,
+        'gid': 42420,
+    },
+    'influxdb-user': {
+        'uid': 42421,
+        'gid': 42421,
+    },
+    'ironic-user': {
+        'uid': 42422,
+        'gid': 42422,
+    },
+    'kafka-user': {
+        'uid': 42423,
+        'gid': 42423,
+    },
+    'keystone-user': {
+        'uid': 42425,
+        'gid': 42425,
+    },
+    'kibana-user': {
+        'uid': 42426,
+        'gid': 42426,
+    },
+    'qemu-user': {
+        'uid': 42427,
+        'gid': 42427,
+    },
+    'magnum-user': {
+        'uid': 42428,
+        'gid': 42428,
+    },
+    'manila-user': {
+        'uid': 42429,
+        'gid': 42429,
+    },
+    'mistral-user': {
+        'uid': 42430,
+        'gid': 42430,
+    },
+    'monasca-user': {
+        'uid': 42431,
+        'gid': 42431,
+    },
+    'mongodb-user': {
+        'uid': 42432,
+        'gid': 65534,
+    },
+    'murano-user': {
+        'uid': 42433,
+        'gid': 42433,
+    },
+    'mysql-user': {
+        'uid': 42434,
+        'gid': 42434,
+    },
+    'neutron-user': {
+        'uid': 42435,
+        'gid': 42435,
+    },
+    'nova-user': {
+        'uid': 42436,
+        'gid': 42436,
+    },
+    'octavia-user': {
+        'uid': 42437,
+        'gid': 42437,
+    },
+    'panko-user': {
+        'uid': 42438,
+        'gid': 42438,
+    },
+    'rabbitmq-user': {
+        'uid': 42439,
+        'gid': 42439,
+    },
+    'rally-user': {
+        'uid': 42440,
+        'gid': 42440,
+    },
+    'sahara-user': {
+        'uid': 42441,
+        'gid': 42441,
+    },
+    'searchlight-user': {
+        'uid': 42442,
+        'gid': 42442,
+    },
+    'senlin-user': {
+        'uid': 42443,
+        'gid': 42443,
+    },
+    'solum-user': {
+        'uid': 42444,
+        'gid': 42444,
+    },
+    'swift-user': {
+        'uid': 42445,
+        'gid': 42445,
+    },
+    'tacker-user': {
+        'uid': 42446,
+        'gid': 42446,
+    },
+    'td-agent-user': {
+        'uid': 42447,
+        'gid': 42447,
+    },
+    'telegraf-user': {
+        'uid': 42448,
+        'gid': 42448,
+    },
+    'trove-user': {
+        'uid': 42449,
+        'gid': 42449,
+    },
+    'vmtp-user': {
+        'uid': 42450,
+        'gid': 42450,
+    },
+    'watcher-user': {
+        'uid': 42451,
+        'gid': 42451,
+    },
+    'zaqar-user': {
+        'uid': 42452,
+        'gid': 42452,
+    },
+    'zookeeper-user': {
+        'uid': 42453,
+        'gid': 42453,
+    },
+    'haproxy-user': {
+        'uid': 42454,
+        'gid': 42454,
+    },
+    'ceph-user': {
+        'uid': 64045,
+        'gid': 64045,
+    },
+    'memcached-user': {
+        'uid': 42457,
+        'gid': 42457,
+    },
+    'karbor-user': {
+        'uid': 42458,
+        'gid': 42458,
+    },
+}
+
+
 def get_source_opts(type_=None, location=None, reference=None):
     return [cfg.StrOpt('type', choices=['local', 'git', 'url'],
                        default=type_,
@@ -511,6 +745,20 @@ def get_source_opts(type_=None, location=None, reference=None):
                              'or branch name'))]
 
 
+def get_user_opts(uid, gid):
+    return [
+        cfg.StrOpt('uid', default=uid, help='The user id'),
+        cfg.StrOpt('gid', default=gid, help='The group id'),
+    ]
+
+
+def gen_all_user_opts():
+    for name, params in USERS.items():
+        uid = params['uid']
+        gid = params['gid']
+        yield name, get_user_opts(uid, gid)
+
+
 def gen_all_source_opts():
     for name, params in SOURCES.items():
         type_ = params['type']
@@ -524,6 +772,7 @@ def list_opts():
                             (None, _BASE_OPTS),
                             ('profiles', _PROFILE_OPTS)],
                            gen_all_source_opts(),
+                           gen_all_user_opts(),
                            )
 
 
@@ -534,6 +783,8 @@ def parse(conf, args, usage=None, prog=None,
     conf.register_opts(_PROFILE_OPTS, group='profiles')
     for name, opts in gen_all_source_opts():
         conf.register_opts(opts, name)
+    for name, opts in gen_all_user_opts():
+        conf.register_opts(opts, name)
 
     conf(args=args,
          project='kolla',
diff --git a/kolla/image/build.py b/kolla/image/build.py
index 35029f198..8760b46cb 100755
--- a/kolla/image/build.py
+++ b/kolla/image/build.py
@@ -631,6 +631,20 @@ class KollaWorker(object):
             'debian_package_install': jinja_methods.debian_package_install,
         }
 
+    def get_users(self):
+        all_sections = (set(six.iterkeys(self.conf._groups)) |
+                        set(self.conf.list_all_sections()))
+        ret = dict()
+        for section in all_sections:
+            match = re.search('^.*-user$', section)
+            if match:
+                user = self.conf[match.group(0)]
+                ret[match.group(0)[:-5]] = {
+                    'uid': user.uid,
+                    'gid': user.gid,
+                }
+        return ret
+
     def create_dockerfiles(self):
         kolla_version = version.version_info.cached_version_string()
         supported_distro_release = common_config.DISTRO_RELEASE.get(
@@ -650,6 +664,7 @@ class KollaWorker(object):
                       'maintainer': self.maintainer,
                       'kolla_version': kolla_version,
                       'image_name': image_name,
+                      'users': self.get_users(),
                       'rpm_setup': self.rpm_setup}
             env = jinja2.Environment(  # nosec: not used to render HTML
                 loader=jinja2.FileSystemLoader(self.working_dir))