[INSTRM-592] Pin down pfs and pfs-data uid/gids before shipping to Subaru.

Relates — Mon, 14 Jan 2019 16:50:29 +0000

~~INSTRM-22~~ lists some OS conventions for ICS machines and software, and was written before PFS computers started being integrated at Subaru. LAM and JHU had settled on the pfs and pfs-data accounts having uid/gids of 1000 and 1001, respectively. But at Subaru user accounts are managed through a central LDAP server, and the two accounts were assigned 2085 and 2087. The ids will conflict when we deliver the SM1 BEEs.

I can think of four solutions:

renumber existing accounts at JHU and LAM. Ugh, especially at LAM.
use NFSv4 id mapping. NFSv4 uses user@domain names, and has mechanisms for mapping those to ids. We can try/test how well this works.
do not treat the pfs and pfs-data accounts as LDAP-managed accounts at Subaru, and leave them at 1000/1001.
reconfigure the ids just on the BEEs on arrival at Subaru, or re-image them. We might be able to convince ourselves this is safe, testing-wise.

I think that re-imaging is the right choice. If not that, renumbering. We still need to build a decent way to re-image the BEEs in any case, and being able to set the user ids dynamically would be a modest requirement.

fmadec? Kiaina Schubert?

PFS-JIRA

[INSTRM-592] Pin down pfs and pfs-data uid/gids before shipping to Subaru.