)]}'
{"specs/consistent-uid-gid.rst":[{"author":{"_account_id":22368,"name":"Justin Scott","email":"justin.a.scott@intel.com","username":"jascott1"},"change_message_id":"f04d55692fb0231c441da6899d88adfd27df8132","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Security impact"},{"line_number":43,"context_line":"---------------"},{"line_number":44,"context_line":"N/A"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a71b18c_29ddae14","line":43,"updated":"2016-12-01 21:47:12.000000000","message":"This improves security by establishing a map of uid/guid presumably closing tiny holes where a new service using same uid/guid could have access where it should not.","commit_id":"4ad5a9c0d7aac6d4192b1d13d3f78fbe2a7bda7a"},{"author":{"_account_id":16233,"name":"Mauricio Lima","email":"mauriciolimab@gmail.com","username":"limamauricio"},"change_message_id":"5ba2efe5e5643f0328fe034b0f59d2320f6ddb0f","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Consistent user of userid/gid for openstack services in containers"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a71b18c_94e31233","line":1,"updated":"2016-12-02 13:07:20.000000000","message":"please, use the line break for readability","commit_id":"5f423294ba8a1460a890c35639609547f9ea3c39"},{"author":{"_account_id":16233,"name":"Mauricio Lima","email":"mauriciolimab@gmail.com","username":"limamauricio"},"change_message_id":"5ba2efe5e5643f0328fe034b0f59d2320f6ddb0f","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Include the URL of your launchpad blueprint:"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"https://blueprints.launchpad.net/kolla/+spec/example"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec purposes to update kolla to explicitly set a consitent, operator overidable, uid/gid  for each openstack service.  Doing so will allow us to remove the chown operations on each container start and ensure that we use consistent id\u0027s between upgrades."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a71b18c_74bf56fb","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":52},"updated":"2016-12-02 13:07:20.000000000","message":"Can you fill the bp?","commit_id":"5f423294ba8a1460a890c35639609547f9ea3c39"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"dec34c5c0111e38761b6cac10257651bb9843083","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Use cases"},{"line_number":19,"context_line":"---------"},{"line_number":20,"context_line":"1. Allowing a consistent uid/gid to be used between the container host and the container.  So that file writen by the container use the correct filesystem permisions on the host."},{"line_number":21,"context_line":"2. Containers that read/write to files that are read by other containers, should use different and consistent uid\u0027s for their services."},{"line_number":22,"context_line":"3. Upgrading a container should not cause file ownership to change."},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_ccba6be1","line":20,"updated":"2017-02-05 15:08:06.000000000","message":"no need touch the container host. no need create the user in host OS.","commit_id":"5f423294ba8a1460a890c35639609547f9ea3c39"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"dec34c5c0111e38761b6cac10257651bb9843083","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Use cases"},{"line_number":19,"context_line":"---------"},{"line_number":20,"context_line":"1. Allowing a consistent uid/gid to be used between the container host and the container.  So that file writen by the container use the correct filesystem permisions on the host."},{"line_number":21,"context_line":"2. Containers that read/write to files that are read by other containers, should use different and consistent uid\u0027s for their services."},{"line_number":22,"context_line":"3. Upgrading a container should not cause file ownership to change."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Proposed change"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_ecbd67d8","line":21,"updated":"2017-02-05 15:08:06.000000000","message":"different cosistent uid?  \nwhy not the same uid?","commit_id":"5f423294ba8a1460a890c35639609547f9ea3c39"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"dec34c5c0111e38761b6cac10257651bb9843083","unresolved":false,"context_lines":[{"line_number":28,"context_line":"2. In the docker image build code add the passing of uid and gid as varriables into jinja."},{"line_number":29,"context_line":"    a) Discussion here needed on how, each image/project in kolla gets its own \u0027conf\u0027 section (that not many people know about afaik)"},{"line_number":30,"context_line":"        should the uid and gid per project go into each conf section, or just globals.yml, or all the above????"},{"line_number":31,"context_line":"            I don\u0027t know the answer here, seeking input :-P"},{"line_number":32,"context_line":"    b) should we add all services users to all templates?"},{"line_number":33,"context_line":"3. Update the container start scripts to stop changing the ownership of files inside the container"},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_0cb553ed","line":31,"updated":"2017-02-05 15:08:06.000000000","message":"uid/gid should be configured during build stage, so it should be in kolla-build.conf file at least.\n\ni propose to use static map in build.py script. the mapping shouldn\u0027t be changed after it is created. otherwise it will cause upgrade issue agasin.\n\nso just add a dict like:\n\nuid_mapping \u003d {\n\"nova\": (10001,10001),\n\"glance\": (10002, 1002)\n}","commit_id":"5f423294ba8a1460a890c35639609547f9ea3c39"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"dec34c5c0111e38761b6cac10257651bb9843083","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    a) Discussion here needed on how, each image/project in kolla gets its own \u0027conf\u0027 section (that not many people know about afaik)"},{"line_number":30,"context_line":"        should the uid and gid per project go into each conf section, or just globals.yml, or all the above????"},{"line_number":31,"context_line":"            I don\u0027t know the answer here, seeking input :-P"},{"line_number":32,"context_line":"    b) should we add all services users to all templates?"},{"line_number":33,"context_line":"3. Update the container start scripts to stop changing the ownership of files inside the container"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Q. Do we need to update kolla-ansible to create the same user mapping on container hosts?"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_2cb84fe5","line":32,"updated":"2017-02-05 15:08:06.000000000","message":"no. this is not neccessary.  Just create the user when need.","commit_id":"5f423294ba8a1460a890c35639609547f9ea3c39"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"dec34c5c0111e38761b6cac10257651bb9843083","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        should the uid and gid per project go into each conf section, or just globals.yml, or all the above????"},{"line_number":31,"context_line":"            I don\u0027t know the answer here, seeking input :-P"},{"line_number":32,"context_line":"    b) should we add all services users to all templates?"},{"line_number":33,"context_line":"3. Update the container start scripts to stop changing the ownership of files inside the container"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Q. Do we need to update kolla-ansible to create the same user mapping on container hosts?"},{"line_number":36,"context_line":"    I am thinking yes."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_4ccf5b7f","line":33,"updated":"2017-02-05 15:08:06.000000000","message":"this is still needed, like /var/log/kolla/\u003cservice\u003e\n\nwe may need remove permissions section in config.json file.","commit_id":"5f423294ba8a1460a890c35639609547f9ea3c39"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"dec34c5c0111e38761b6cac10257651bb9843083","unresolved":false,"context_lines":[{"line_number":33,"context_line":"3. Update the container start scripts to stop changing the ownership of files inside the container"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Q. Do we need to update kolla-ansible to create the same user mapping on container hosts?"},{"line_number":36,"context_line":"    I am thinking yes."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Q. What happens to the existing users of kolla that have images built already, should the default behavior stay or die???"},{"line_number":39,"context_line":"   I would vote that the old behavior die, and with it the chowning on the start of each container stop, but asking for opinions here."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_6cca5770","line":36,"updated":"2017-02-05 15:08:06.000000000","message":"no need. we do not need create the same user/group on host.\n\nuser name and group name is used for human. the host only know uid and gid.","commit_id":"5f423294ba8a1460a890c35639609547f9ea3c39"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"dec34c5c0111e38761b6cac10257651bb9843083","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    I am thinking yes."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Q. What happens to the existing users of kolla that have images built already, should the default behavior stay or die???"},{"line_number":39,"context_line":"   I would vote that the old behavior die, and with it the chowning on the start of each container stop, but asking for opinions here."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Security impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_8cc9437b","line":39,"updated":"2017-02-05 15:08:06.000000000","message":"what that means?\n\ni guess you are meaning: when install nova-api package, it create nova user automatically. if so, it is not big deal, nova-api won\u0027t create user again if it exist already.","commit_id":"5f423294ba8a1460a890c35639609547f9ea3c39"},{"author":{"_account_id":10962,"name":"David Bingham","email":"dbingham@godaddy.com","username":"wwriverrat"},"change_message_id":"a5d6da5adddcfc1f782bb06f2f4686fbb2d0b7d7","unresolved":false,"context_lines":[{"line_number":23,"context_line":"container, incase the uid/gid has changed between an older container and a new"},{"line_number":24,"context_line":"one.  This is also problematic under glance when files are stored on a NFS"},{"line_number":25,"context_line":"share.  As the restart of the service using a new container will change all the"},{"line_number":26,"context_line":"filesystem permisions on the NFS store, potentally breaking other glance"},{"line_number":27,"context_line":"services.  This is also problematic where two containers containers write files"},{"line_number":28,"context_line":"that are read by other containers/servers (nova/libvirt)."},{"line_number":29,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_5a12270a","line":26,"range":{"start_line":26,"start_character":40,"end_line":26,"end_character":50},"updated":"2016-12-05 22:36:42.000000000","message":"Nit: s/potentally/potentially\n\nCheck spelling throughout doc. I\u0027ll continue reviewing for content from here without adding other found spelling errors.","commit_id":"bd758a268fee6c4ac21bc3e04e51e4f321487f0c"},{"author":{"_account_id":1297,"name":"Joshua Harlow","email":"jxharlow@godaddy.com","username":"harlowja"},"change_message_id":"709ce55f457b5f652dc6b7bddbf9eb09fc020278","unresolved":false,"context_lines":[{"line_number":39,"context_line":"Proposed change"},{"line_number":40,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"1. In the docker build jinja templates, update the useradd commands to also "},{"line_number":43,"context_line":"   include -u \u003cuid\u003e -g \u003cgid\u003e."},{"line_number":44,"context_line":"2. In the docker image build code add the passing of uid and gid as varriables"},{"line_number":45,"context_line":"   into jinja."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_74729912","line":42,"updated":"2016-12-05 22:04:35.000000000","message":"Nit whitespace!\n\nDownload the following (mainly created by me):\n\n\n  # pip install doc8\n  # doc8 \u003cyour-file\u003e\n\nFix things, repeat.","commit_id":"bd758a268fee6c4ac21bc3e04e51e4f321487f0c"},{"author":{"_account_id":10962,"name":"David Bingham","email":"dbingham@godaddy.com","username":"wwriverrat"},"change_message_id":"a5d6da5adddcfc1f782bb06f2f4686fbb2d0b7d7","unresolved":false,"context_lines":[{"line_number":50,"context_line":"            I don\u0027t know the answer here, seeking input"},{"line_number":51,"context_line":"    b) should we add all services users to all templates?"},{"line_number":52,"context_line":"3. Update the container start scripts to stop changing the ownership of files"},{"line_number":53,"context_line":"   inside the container"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Q. Do we need to update kolla-ansible to create the same user mapping on"},{"line_number":56,"context_line":"   container hosts?"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a71b18c_9a6cbf36","line":53,"updated":"2016-12-05 22:36:42.000000000","message":"Or... rather than stopping completely. Only update ownership if the user uid or group gid changed.  If possible. Might solve the answer to the second question you have below.","commit_id":"bd758a268fee6c4ac21bc3e04e51e4f321487f0c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"04a32985587a9c25157d5eec0129e14ef8e60feb","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Include the URL of your launchpad blueprint:"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"https://blueprints.launchpad.net/kolla/+spec/example"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec purposes to update kolla to explicitly set a consitent, operator"},{"line_number":10,"context_line":"overidable, uid/gid  for each openstack service.  Doing so will allow us to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_89a1c6fa","line":7,"updated":"2016-12-06 11:57:07.000000000","message":"register a new bp?","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"04a32985587a9c25157d5eec0129e14ef8e60feb","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec purposes to update kolla to explicitly set a consitent, operator"},{"line_number":10,"context_line":"overidable, uid/gid  for each openstack service.  Doing so will allow us to"},{"line_number":11,"context_line":"remove the chown operations on each container start and ensure that we use"},{"line_number":12,"context_line":"consistent id\u0027s between upgrades."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_a9c922ae","line":11,"updated":"2016-12-06 11:57:07.000000000","message":"this is still required. like \n/var/log/kolla/nova folder. consistent uid do not cover this.\n\nconsistent uid can fix potential uid/gid change between two image building.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"9a10153a23d7a11d316e6e06fb11f4687387e8b6","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec purposes to update kolla to explicitly set a consitent, operator"},{"line_number":10,"context_line":"overidable, uid/gid  for each openstack service.  Doing so will allow us to"},{"line_number":11,"context_line":"remove the chown operations on each container start and ensure that we use"},{"line_number":12,"context_line":"consistent id\u0027s between upgrades."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a6eadb0_9d3a8735","line":11,"in_reply_to":"3a71b18c_839b2872","updated":"2016-12-13 08:00:39.000000000","message":"just to clarify, that is kolla-ansible\u0027s philosophy. All kolla-* projects in the future won\u0027t necessarily follow that. Kolla itself (container images) shouldn\u0027t ever need host modification to work.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":9076,"name":"Kris Lindgren","email":"klindgren@godaddy.com","username":"klindgren"},"change_message_id":"44d32e57bbdea5ebc25ba5f21edd17345f095ced","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec purposes to update kolla to explicitly set a consitent, operator"},{"line_number":10,"context_line":"overidable, uid/gid  for each openstack service.  Doing so will allow us to"},{"line_number":11,"context_line":"remove the chown operations on each container start and ensure that we use"},{"line_number":12,"context_line":"consistent id\u0027s between upgrades."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_b93317f5","line":11,"in_reply_to":"3a71b18c_a9c922ae","updated":"2016-12-06 20:52:40.000000000","message":"It would if ansible had access to the mapping and set the file ownership correctly on the host node to start with.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"3213b9463b80291563ab0dfd303cc1d219847165","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This spec purposes to update kolla to explicitly set a consitent, operator"},{"line_number":10,"context_line":"overidable, uid/gid  for each openstack service.  Doing so will allow us to"},{"line_number":11,"context_line":"remove the chown operations on each container start and ensure that we use"},{"line_number":12,"context_line":"consistent id\u0027s between upgrades."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Problem description"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_839b2872","line":11,"in_reply_to":"3a71b18c_b93317f5","updated":"2016-12-07 13:50:25.000000000","message":"on of kolla\u0027s Philosophy is do not touch the host OS.\n\nSo we won\u0027t touch the host OS unless we have no choice.\n\nand if let ansible to handle the permission, ansible need get more info about the image he deploying. we just need change some folder, why not use simple few lines of bash to handle this?\n\nwe are using docker named volume, we do not stop the end-user to use other volume plugin, if so ansible can not handle this.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"9a10153a23d7a11d316e6e06fb11f4687387e8b6","unresolved":false,"context_lines":[{"line_number":19,"context_line":"users were added before the useradd command was run.  Additionally, it\u0027s"},{"line_number":20,"context_line":"entirerly possible for two different services in containers to end up using"},{"line_number":21,"context_line":"the same uid/gid on the host.  This causes kolla on startup of every container"},{"line_number":22,"context_line":"to `chown` all of the files on all of volumes that are mapped into the"},{"line_number":23,"context_line":"container, incase the uid/gid has changed between an older container and a new"},{"line_number":24,"context_line":"one.  This is also problematic under glance when files are stored on a NFS"},{"line_number":25,"context_line":"share.  As the restart of the service using a new container will change all the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a6eadb0_bd02e33c","line":22,"updated":"2016-12-13 08:00:39.000000000","message":"technically it checks to see if the ownership is correct first, then chowns if it isn\u0027t.\n\nI think that check needs to remain anyway. But I agree with not wanting to run the recursive chown at all.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"04a32985587a9c25157d5eec0129e14ef8e60feb","unresolved":false,"context_lines":[{"line_number":25,"context_line":"share.  As the restart of the service using a new container will change all the"},{"line_number":26,"context_line":"filesystem permisions on the NFS store, potentally breaking other glance"},{"line_number":27,"context_line":"services.  This is also problematic where two containers containers write files"},{"line_number":28,"context_line":"that are read by other containers/servers (nova/libvirt)."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Use cases"},{"line_number":31,"context_line":"---------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_e9fcfab9","line":28,"updated":"2016-12-06 11:57:07.000000000","message":"technically, this is not a issue now. libvirt and nova image have the same nova user ( same uid ) and nova user is a member of qemu group. so it works without any issue.\n\nBut the issue is nova-libvirt\u0027s parent image is nova-base, which is a bad idea.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"04a32985587a9c25157d5eec0129e14ef8e60feb","unresolved":false,"context_lines":[{"line_number":31,"context_line":"---------"},{"line_number":32,"context_line":"1. Allowing a consistent uid/gid to be used between the container host and the"},{"line_number":33,"context_line":"   container.  So that file writen by the container use the correct filesystem"},{"line_number":34,"context_line":"   permisions on the host."},{"line_number":35,"context_line":"2. Containers that read/write to files that are read by other containers,"},{"line_number":36,"context_line":"   should use different and consistent uid\u0027s for their services."},{"line_number":37,"context_line":"3. Upgrading a container should not cause file ownership to change."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_c9281e36","line":34,"updated":"2016-12-06 11:57:07.000000000","message":"no need create the same user on container host. \n\nOS only knowes id of the user and group, not the name. So it works as expect if you do not create the same user on host OS.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"9a10153a23d7a11d316e6e06fb11f4687387e8b6","unresolved":false,"context_lines":[{"line_number":31,"context_line":"---------"},{"line_number":32,"context_line":"1. Allowing a consistent uid/gid to be used between the container host and the"},{"line_number":33,"context_line":"   container.  So that file writen by the container use the correct filesystem"},{"line_number":34,"context_line":"   permisions on the host."},{"line_number":35,"context_line":"2. Containers that read/write to files that are read by other containers,"},{"line_number":36,"context_line":"   should use different and consistent uid\u0027s for their services."},{"line_number":37,"context_line":"3. Upgrading a container should not cause file ownership to change."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a6eadb0_1d1e77ba","line":34,"in_reply_to":"3a71b18c_c9281e36","updated":"2016-12-13 08:00:39.000000000","message":"While creating the same user on the host is not a _requirement_ we should consider this when setting uid/gid and work with existing uid/gid mappings.\n\nKolla-ansible does not bind directories from the host, but kolla-* might. Reasonable defaults should be chosen.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":23928,"name":"Pete Birley","email":"petebirley@gmail.com","username":"portdirect"},"change_message_id":"8ff6f3bd970ff505cc927c48a0475014ec84a523","unresolved":false,"context_lines":[{"line_number":40,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"1. In the docker build jinja templates, update the useradd commands to also"},{"line_number":43,"context_line":"   include -u \u003cuid\u003e -g \u003cgid\u003e."},{"line_number":44,"context_line":"2. In the docker image build code add the passing of uid and gid as varriables"},{"line_number":45,"context_line":"   into jinja."},{"line_number":46,"context_line":"   a) Discussion here needed on how, each image/project in kolla gets its own"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_66c3708b","line":43,"updated":"2016-12-07 16:47:28.000000000","message":"Would it be worth using the RDO (or similar) uid here? eg. https://github.com/rdo-packages/nova-distgit/blob/rpm-master/openstack-nova.spec#L656","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"6044492d27481b285c34742474457a5af779da08","unresolved":false,"context_lines":[{"line_number":40,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"1. In the docker build jinja templates, update the useradd commands to also"},{"line_number":43,"context_line":"   include -u \u003cuid\u003e -g \u003cgid\u003e."},{"line_number":44,"context_line":"2. In the docker image build code add the passing of uid and gid as varriables"},{"line_number":45,"context_line":"   into jinja."},{"line_number":46,"context_line":"   a) Discussion here needed on how, each image/project in kolla gets its own"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a430d35_cca18bab","line":43,"updated":"2017-02-05 15:08:08.000000000","message":"i prefer no.\n\nbetter use a uid which is used in os in default. like 10000?","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"04a32985587a9c25157d5eec0129e14ef8e60feb","unresolved":false,"context_lines":[{"line_number":47,"context_line":"   \u0027conf\u0027 section (that not many people know about afaik)"},{"line_number":48,"context_line":"   should the uid and gid per project go into each conf section,"},{"line_number":49,"context_line":"   or just globals.yml, or all the above????"},{"line_number":50,"context_line":"   I don\u0027t know the answer here, seeking input"},{"line_number":51,"context_line":"   b) should we add all services users to all templates?"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"3. Update the container start scripts to stop changing the ownership of files"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_499a4e6f","line":50,"updated":"2016-12-06 11:57:07.000000000","message":"I prefer to use a static dict in kolla to hold all user and id mapping.\n\nLike:\n\nUSER_IDS_MAPPING \u003d {\nnova: (100002,10002)\nglance: (100003, 10003)\n}\n\n\u003cservice\u003e: (\u003cuid\u003e, \u003cgid\u003e)\n\n\nI do not want the end-user can change this mapping. because it may cause upgrade issue as we meet now.\n\n\nWe create user with id in the build stage. So even if you want to make this configuration, this should belong to kolla-build.conf file.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":9076,"name":"Kris Lindgren","email":"klindgren@godaddy.com","username":"klindgren"},"change_message_id":"44d32e57bbdea5ebc25ba5f21edd17345f095ced","unresolved":false,"context_lines":[{"line_number":47,"context_line":"   \u0027conf\u0027 section (that not many people know about afaik)"},{"line_number":48,"context_line":"   should the uid and gid per project go into each conf section,"},{"line_number":49,"context_line":"   or just globals.yml, or all the above????"},{"line_number":50,"context_line":"   I don\u0027t know the answer here, seeking input"},{"line_number":51,"context_line":"   b) should we add all services users to all templates?"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"3. Update the container start scripts to stop changing the ownership of files"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_569bb065","line":50,"in_reply_to":"3a71b18c_499a4e6f","updated":"2016-12-06 20:52:40.000000000","message":"I strongly disagree about not allowing the end user to change the mapping.  You are looking at this as an upgrade issue.\n\nI am looking at this as a how do I brownfield kolla into our existing environment where I have some services (glance) that store information on shared filesystems and as such I need uids to be consistent across machines.\n\nI can\u0027t have the first machine I upgrade chown all of the files on the share with its own uid, so that it is the only one who can access it.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"3213b9463b80291563ab0dfd303cc1d219847165","unresolved":false,"context_lines":[{"line_number":47,"context_line":"   \u0027conf\u0027 section (that not many people know about afaik)"},{"line_number":48,"context_line":"   should the uid and gid per project go into each conf section,"},{"line_number":49,"context_line":"   or just globals.yml, or all the above????"},{"line_number":50,"context_line":"   I don\u0027t know the answer here, seeking input"},{"line_number":51,"context_line":"   b) should we add all services users to all templates?"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"3. Update the container start scripts to stop changing the ownership of files"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_a31024ad","line":50,"in_reply_to":"3a71b18c_569bb065","updated":"2016-12-07 13:50:25.000000000","message":"OK. that\u0027s a case.\n\nbecause the end-user may use different uid between upgrade.\nSo if we implement customize uid, he will hit the same issue we are facing right now. \n\n\n\nwe \n\nwe have two choice: \n1. keep current permissions solution in config.json file.\n2. warning the end-user, you should not change the uid during upgrade. if u do , kolla do not guarantee it works.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"9a10153a23d7a11d316e6e06fb11f4687387e8b6","unresolved":false,"context_lines":[{"line_number":47,"context_line":"   \u0027conf\u0027 section (that not many people know about afaik)"},{"line_number":48,"context_line":"   should the uid and gid per project go into each conf section,"},{"line_number":49,"context_line":"   or just globals.yml, or all the above????"},{"line_number":50,"context_line":"   I don\u0027t know the answer here, seeking input"},{"line_number":51,"context_line":"   b) should we add all services users to all templates?"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"3. Update the container start scripts to stop changing the ownership of files"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a6eadb0_fd77fbff","line":50,"in_reply_to":"3a71b18c_a31024ad","updated":"2016-12-13 08:00:39.000000000","message":"end users should be able to change teh UID/GID mappings in my opinion. We can\u0027t define the environment kolla containers run in for the future.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"04a32985587a9c25157d5eec0129e14ef8e60feb","unresolved":false,"context_lines":[{"line_number":48,"context_line":"   should the uid and gid per project go into each conf section,"},{"line_number":49,"context_line":"   or just globals.yml, or all the above????"},{"line_number":50,"context_line":"   I don\u0027t know the answer here, seeking input"},{"line_number":51,"context_line":"   b) should we add all services users to all templates?"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"3. Update the container start scripts to stop changing the ownership of files"},{"line_number":54,"context_line":"   inside the container"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_c9b2dee4","line":51,"updated":"2016-12-06 11:57:07.000000000","message":"depends.\n\ncreate all users in base image is easy to implements.\nBut create the user when necessary is optimal. for example nova user should only be created in nova related image and nova-libvirt image.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"04a32985587a9c25157d5eec0129e14ef8e60feb","unresolved":false,"context_lines":[{"line_number":51,"context_line":"   b) should we add all services users to all templates?"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"3. Update the container start scripts to stop changing the ownership of files"},{"line_number":54,"context_line":"   inside the container"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Q. Do we need to update kolla-ansible to create the same user mapping on"},{"line_number":57,"context_line":"   container hosts?"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_49bfaea9","line":54,"updated":"2016-12-06 11:57:07.000000000","message":"for the upgrade issue, we need keep the start script for at least one cycle.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"04a32985587a9c25157d5eec0129e14ef8e60feb","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Q. Do we need to update kolla-ansible to create the same user mapping on"},{"line_number":57,"context_line":"   container hosts?"},{"line_number":58,"context_line":"   - I am thinking yes."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Q. What happens to the existing users of kolla that have images built already,"},{"line_number":61,"context_line":"   should the default behavior stay or die???"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_69e0eacd","line":58,"updated":"2016-12-06 11:57:07.000000000","message":"i do not think so. explain above.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"04a32985587a9c25157d5eec0129e14ef8e60feb","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Q. What happens to the existing users of kolla that have images built already,"},{"line_number":61,"context_line":"   should the default behavior stay or die???"},{"line_number":62,"context_line":"   - I would vote that the old behavior die, and with it the chowning on the"},{"line_number":63,"context_line":"   start of each container stop, but asking for opinions here."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Security impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_29f2729a","line":63,"updated":"2016-12-06 11:57:07.000000000","message":"not clear what you are meaning. could u explain more?","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":9076,"name":"Kris Lindgren","email":"klindgren@godaddy.com","username":"klindgren"},"change_message_id":"44d32e57bbdea5ebc25ba5f21edd17345f095ced","unresolved":false,"context_lines":[{"line_number":60,"context_line":"Q. What happens to the existing users of kolla that have images built already,"},{"line_number":61,"context_line":"   should the default behavior stay or die???"},{"line_number":62,"context_line":"   - I would vote that the old behavior die, and with it the chowning on the"},{"line_number":63,"context_line":"   start of each container stop, but asking for opinions here."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Security impact"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_d917f342","line":63,"in_reply_to":"3a71b18c_29f2729a","updated":"2016-12-06 20:52:40.000000000","message":"I think this was answered above, where you said you want to keep the script in place for one cycle, then remove it.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":23717,"name":"Surya Prakash Singh","email":"singh.surya64mnnit@gmail.com","username":"SuryaPrakash"},"change_message_id":"03f413112a8485a5194544c12703ff2d4af33666","unresolved":false,"context_lines":[{"line_number":84,"context_line":"Assignee(s)"},{"line_number":85,"context_line":"-----------"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Primary assignee:"},{"line_number":88,"context_line":"klindgren"},{"line_number":89,"context_line":"harlowja"},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a6eadb0_20d94c22","line":87,"range":{"start_line":87,"start_character":8,"end_line":87,"end_character":16},"updated":"2016-12-13 08:22:42.000000000","message":"s/assignee/Assignees or s/assignee/assignees","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":7488,"name":"Jeffrey Zhang","email":"zhang.lei.fly@gmail.com","username":"Jeffrey4l"},"change_message_id":"04a32985587a9c25157d5eec0129e14ef8e60feb","unresolved":false,"context_lines":[{"line_number":92,"context_line":"----------"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Target Milestone for completion:"},{"line_number":95,"context_line":"  Ocata-1"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Work Items"},{"line_number":98,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a71b18c_692e2afc","line":95,"updated":"2016-12-06 11:57:07.000000000","message":"ocata-2 at least. :)\nocata-1 is done.","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"},{"author":{"_account_id":14119,"name":"Sam Yaple","email":"sam+git@yaple.net","username":"SamYaple"},"change_message_id":"9a10153a23d7a11d316e6e06fb11f4687387e8b6","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Documentation Impact"},{"line_number":106,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":107,"context_line":"None?"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a6eadb0_dd515f64","line":107,"updated":"2016-12-13 08:00:39.000000000","message":"documenting the UID/GID would be nice :)","commit_id":"b8edcb22b035fe2a1520045abccc060702780b8c"}]}