Nova uid/gid sync, default/standards

[Filippo DiNoto]

The Nova role provides an option for configuration of the UID and GID of the Nova system user, but there is no default setting.

If this setting is defined after an initial deployment. Ansible will attempt to change the UID/GID on the running deployment. On a running deployment there are processes owned by the previous UID and the playbook will fail and leave the host in an inconsistent state which in a short time will cause service failures.

I believe it would be best if OSA were to set the UID/GID of system users by default, because changing these values after the fact can be troublesome. However, there should also be a safety mechanism in place to avoid breaking an existing deployment.

As for default UID/GID values, this seems to be a good reference:

https://www.ibm.com/support/knowledgecenter/en/SST55W_4.3.0/liaca/liaca_customize_service_user.html

The 2 most important services to standardize would be Nova and Glance because they have well known configuration scenarios in which multiple hosts would access the same shared filesystem.

nova uid=162 gid=162
glance uid=161 gid=161

[Jean-Philippe Evrard (jean-philippe-evrard)]

I am fine with introducing consistency.
To avoid issues, I think it would be best to have it as an optional future default if the user doesn't exist yet.

We should probably use those IBM uid/gid for suse, use the redhat ones for centos (they might be the same), and for ubuntu use the following ones from the discussion here:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884178

[Jean-Philippe Evrard (jean-philippe-evrard)]

Please also see the bug triage conversation of Feb 6th, 2018.