Merge pull request #833 from canonical/fix/render-gids

Add workshop user to netdev and render groups for other bases

Author: dmitry-lyfar

internal/workshop/lxd/lxd_backend.go

@@ -1004,8 +1004,8 @@ users:
   - name: workshop
     primary_group: workshop
     sudo: ALL=(ALL) NOPASSWD:ALL
-    groups: adm,cdrom,sudo,dip,plugdev,audio,netdev,lxd,video,render
     shell: /bin/bash
+    {GROUPS}
 apt:
   conf: |
     # Installed by workshop
@@ -1040,6 +1040,50 @@ runcmd:
   - networkctl reload
 `
 
+	groups := `create_groups: false
+    groups:
+    - 'adm'
+    - 'cdrom'
+    - 'sudo'
+    - 'dip'
+    - 'plugdev'
+    - 'audio'
+    - 'netdev'
+    - 'lxd'
+    - 'video'
+    - 'render'
+    # Compatibility GIDs for various host systems:
+    - '108' # netdev on 26.04
+    - '111' # netdev on 24.04
+    - '118' # netdev on 20.04
+    - '119' # netdev on 22.04
+    - '109' # render on 20.04
+    - '110' # render on 22.04
+    - '990' # render on 26.04
+    - '992' # render on 24.04
+bootcmd:
+- |
+  set -e
+  maybe_groupadd() {
+      # Ignore GID not unique (exit code 4) or group name not unique (exit code 9)
+      groupadd -g "$1" -r "$2" || case $? in 4|9) ;; *) return $? ;; esac
+  }
+  maybe_groupadd 1000 workshop
+  maybe_groupadd 108 netdev-compat-108
+  maybe_groupadd 111 netdev-compat-111
+  maybe_groupadd 118 netdev-compat-118
+  maybe_groupadd 119 netdev-compat-119
+  maybe_groupadd 109 render-compat-109
+  maybe_groupadd 110 render-compat-110
+  maybe_groupadd 990 render-compat-990
+  maybe_groupadd 992 render-compat-992
+`
+	if format.N < 2 {
+		groups = `groups: adm,cdrom,sudo,dip,plugdev,audio,netdev,lxd,video,render
+`
+	}
+	cloudInitConfig = strings.Replace(cloudInitConfig, "{GROUPS}\n", groups, 1)
+
 	// Based on lxd-imagebuilder Ubuntu template. By default
 	// systemd-networkd derives the DHCP client ID from /etc/machine-id,
 	// which can change when refreshing to a new base image.

internal/workshop/lxd/lxd_backend_snapshots.go

@@ -859,7 +859,7 @@ func (s *Backend) snapshotClients(ctx context.Context) (lxd.InstanceServer, lxd.
 // replay some of the install-sdk and setup-base tasks. These can be handled in
 // the same way as in-progress launches and refreshes.
 func (s *Backend) FormatRevision() sdk.Revision {
-	return sdk.R(1)
+	return sdk.R(2)
 }
 
 func (s *Backend) HashSnapshot(snapshot workshop.Snapshot) (string, error) {

internal/workshop/lxd/tests/integration/snapshot-format.yaml

@@ -16,7 +16,7 @@ launched:
     raw.lxc: lxc.mount.entry = tmpfs tmp tmpfs defaults
     security.nesting: 'true'
     user.network-config: '5842bd1995c03c7f704de0db9e91dac3f61f5a1cd9395c813d613a1c6ace81c8c7a76be30770382e95979c2932fa9565'
-    user.user-data: '59c339a3a3271e1ae41686809a3c1607cced545f64c625fb6219d6d5f3147b205cf96d3ffca74c94be7dabcdf309b9cd'
+    user.user-data: '3d5ea3cb0e8e195272207f49a626ff7c17367d021f0b3a36483ee49f557a962429a5e3ebacc3b9a4dbdbc1f47d48bc78'
     user.workshop.name: test
     user.workshop.project-id: '42424242'
   description: ''
@@ -55,7 +55,7 @@ started:
     raw.lxc: lxc.mount.entry = tmpfs tmp tmpfs defaults
     security.nesting: 'true'
     user.network-config: '5842bd1995c03c7f704de0db9e91dac3f61f5a1cd9395c813d613a1c6ace81c8c7a76be30770382e95979c2932fa9565'
-    user.user-data: '59c339a3a3271e1ae41686809a3c1607cced545f64c625fb6219d6d5f3147b205cf96d3ffca74c94be7dabcdf309b9cd'
+    user.user-data: '3d5ea3cb0e8e195272207f49a626ff7c17367d021f0b3a36483ee49f557a962429a5e3ebacc3b9a4dbdbc1f47d48bc78'
     user.workshop.name: test
     user.workshop.project-id: '42424242'
   description: ''
@@ -94,7 +94,7 @@ sdk-attached:
     raw.lxc: lxc.mount.entry = tmpfs tmp tmpfs defaults
     security.nesting: 'true'
     user.network-config: '5842bd1995c03c7f704de0db9e91dac3f61f5a1cd9395c813d613a1c6ace81c8c7a76be30770382e95979c2932fa9565'
-    user.user-data: '59c339a3a3271e1ae41686809a3c1607cced545f64c625fb6219d6d5f3147b205cf96d3ffca74c94be7dabcdf309b9cd'
+    user.user-data: '3d5ea3cb0e8e195272207f49a626ff7c17367d021f0b3a36483ee49f557a962429a5e3ebacc3b9a4dbdbc1f47d48bc78'
     user.workshop.name: test
     user.workshop.project-id: '42424242'
   description: ''
@@ -145,7 +145,7 @@ sdk-mounted:
     raw.lxc: lxc.mount.entry = tmpfs tmp tmpfs defaults
     security.nesting: 'true'
     user.network-config: '5842bd1995c03c7f704de0db9e91dac3f61f5a1cd9395c813d613a1c6ace81c8c7a76be30770382e95979c2932fa9565'
-    user.user-data: '59c339a3a3271e1ae41686809a3c1607cced545f64c625fb6219d6d5f3147b205cf96d3ffca74c94be7dabcdf309b9cd'
+    user.user-data: '3d5ea3cb0e8e195272207f49a626ff7c17367d021f0b3a36483ee49f557a962429a5e3ebacc3b9a4dbdbc1f47d48bc78'
     user.workshop.name: test
     user.workshop.project-id: '42424242'
   description: ''

tests/main/interface-gpu/task.yaml

@@ -36,3 +36,12 @@ execute: |
   echo "Check a user cannot install a GPU slot (violates slot declaration)"
   workshop_exec launch ws-gpu-fail > launch.log || true
   MATCH ".*installation not allowed by \"user-gpu\" slot rule of interface \"gpu\"" < launch.log
+
+  echo "Check the user belongs to the render group for all supported bases"
+  workshop_exec exec ws-gpu id -Gz > groups.log
+  mapfile -d '' -t groups < groups.log
+  printf '%s\n' "${groups[@]}" > groups.log
+  MATCH '^109$' < groups.log
+  MATCH '^110$' < groups.log
+  MATCH '^990$' < groups.log
+  MATCH '^992$' < groups.log