Do not run things in containers as root

[gibizer]

nova-operator/pkg/novaapi/dbsync.go

Line 53 in 6e5ff21

runAsUser := int64(0)

we should not be runnign as root

https://sdk.operatorframework.io/docs/best-practices/best-practices/#summary-1

"Does not run as root"

we should be using the nova user here.

the nova user and group is 42436

https://github.com/openstack/kolla/blob/master/kolla/common/users.py#L148-L151

https://github.com/openstack/tripleo-common/blob/0a4ca78500a30e80a1746ac65188350d597a32bc/container-images/kolla/base/uid_gid_manage.sh#L62

Originally posted by @SeanMooney in #84 (comment)

also in

nova-operator/templates/novaapi/config/nova-api-config.json

Line 25 in 6e5ff21

"owner": "root",

Originally posted by @SeanMooney in #84 (comment)

also in

nova-operator/pkg/novaapi/deployment.go

Line 37 in 6e5ff21

runAsUser := int64(0)

Originally posted by @SeanMooney in #84 (comment)

[mrkisaolamb]

Currently we are using RunAsUser: ptr.To(nova.NovaUserID) and also only file that we mount with root are ssl.conf so maybe we can mount with apache user and we can close this

[gibizer]

It seems we did the majority of the work in #598. #795 is nice to have. We can merge it if CI is green. I agree we can close this ticket.
As a side note, we still cannot be fully rootless due to kolla uses sudo.