Page MenuHomePhabricator

'swift' user/group IDs should be consistent across the fleet
Open, Stalled, MediumPublic

Description

At the moment both swift user and group IDs are not fixed in puppet, this means that their assigned IDs depend on package installation order. This in turn makes it clunky to do a reimage/reinstall while keeping the data disks intact. After reinstall the uid/gid in passwd are not guaranteed to match what's on the data disk filesystem.

The plan is thus to first fix the swift user/group uid/gid before puppet runs, then once the fleet is all at the same uid/gid we can let the 'admin' module create the user/group as needed. The UID/GID reserved for swift is 902, see also https://gerrit.wikimedia.org/r/c/operations/puppet/+/575217

Event Timeline

fgiunchedi raised the priority of this task from to Medium.
fgiunchedi updated the task description. (Show Details)
fgiunchedi added a subscriber: fgiunchedi.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 18 2016, 11:58 AM

I've started provisioning the swift user before puppet on the new swift hardware, since there might be a few packages already installed either post-provisioning or after puppet runs which will claim user/group IDs I've set swift to be 130 for user/group

Restricted Application added a subscriber: Steinsplitter. · View Herald TranscriptJun 22 2016, 4:35 PM
fgiunchedi added a comment.EditedJun 23 2016, 9:48 AM

doable also post-puppet but before machines are in services (i.e. many files owned by swift)

swift-init all stop
userdel swift
groupdel swift
groupadd -g 902 --system swift
useradd -g 902 -u 902 --system --home-dir /var/lib/swift --shell /bin/false swift
chown -R swift:swift /var/cache/swift

Change 297242 had a related patch set uploaded (by Filippo Giunchedi):
install_server: pre-provision swift uid/gid

https://gerrit.wikimedia.org/r/297242

Change 297242 merged by Filippo Giunchedi:
install_server: pre-provision swift uid/gid

https://gerrit.wikimedia.org/r/297242

@fgiunchedi: Hi, the patch in Gerrit has been merged. Can this task be resolved (via Add Action...Change Status in the dropdown menu), or is there more to do in this task? Asking as you are set as task assignee. Thanks in advance!

fgiunchedi changed the task status from Open to Stalled.Feb 19 2020, 4:20 PM

@fgiunchedi: Hi, the patch in Gerrit has been merged. Can this task be resolved (via Add Action...Change Status in the dropdown menu), or is there more to do in this task? Asking as you are set as task assignee. Thanks in advance!

Thanks for the heads up, I'm stalling the task since it'll likely be resolvable once we've decom'd all the old swift backends that still use old IDs

jbond added a subscriber: jbond.Feb 26 2020, 2:02 PM

Change 575217 had a related patch set uploaded (by Filippo Giunchedi; owner: Filippo Giunchedi):
[operations/puppet@production] swift: use fleetwide uid/gid

https://gerrit.wikimedia.org/r/575217

Change 575217 merged by Filippo Giunchedi:
[operations/puppet@production] swift: use fleetwide uid/gid

https://gerrit.wikimedia.org/r/575217

fgiunchedi updated the task description. (Show Details)Feb 27 2020, 1:52 PM

Change 599693 had a related patch set uploaded (by Filippo Giunchedi; owner: Filippo Giunchedi):
[operations/puppet@production] install_server: add thanos-fe/thanos-be to late_command swift uid preprovision

https://gerrit.wikimedia.org/r/599693

Change 599693 merged by Filippo Giunchedi:
[operations/puppet@production] install_server: add thanos-fe/thanos-be to late_command swift uid preprovision

https://gerrit.wikimedia.org/r/599693

Mentioned in SAL (#wikimedia-operations) [2020-05-29T08:30:26Z] <godog> update swift uid/gid on thanos hosts - T123918