Revert "Do not re-create Container FS for each NodeAgentContext"

16 files changed, 69 insertions, 107 deletions

diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/identity/AthenzCredentialsMaintainer.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/identity/AthenzCredentialsMaintainer.java
index a237ec6dd4f..280e58c91f1 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/identity/AthenzCredentialsMaintainer.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/identity/AthenzCredentialsMaintainer.java
@@ -24,7 +24,6 @@ import com.yahoo.vespa.hosted.node.admin.container.ContainerName;
 import com.yahoo.vespa.hosted.node.admin.component.ConfigServerInfo;
 import com.yahoo.vespa.hosted.node.admin.nodeagent.NodeAgentContext;
 import com.yahoo.vespa.hosted.node.admin.nodeagent.NodeAgentTask;
-import com.yahoo.vespa.hosted.node.admin.nodeagent.VespaUser;
 import com.yahoo.vespa.hosted.node.admin.task.util.file.FileFinder;
 import com.yahoo.vespa.hosted.node.admin.task.util.file.UnixPath;
 import com.yahoo.vespa.hosted.node.admin.task.util.fs.ContainerPath;
@@ -207,7 +206,7 @@ public class AthenzCredentialsMaintainer implements CredentialsMaintainer {
                             EntityBindingsMapper.toAttestationData(signedIdentityDocument),
                             csr);
             EntityBindingsMapper.writeSignedIdentityDocumentToFile(identityDocumentFile, signedIdentityDocument);
-            writePrivateKeyAndCertificate(context.vespaUser(),
+            writePrivateKeyAndCertificate(context.userNamespace().vespaUserId(),
                     privateKeyFile, keyPair.getPrivate(), certificateFile, instanceIdentity.certificate());
             context.log(logger, "Instance successfully registered and credentials written to file");
         }
@@ -235,7 +234,7 @@ public class AthenzCredentialsMaintainer implements CredentialsMaintainer {
                                 context.identity(),
                                 identityDocument.providerUniqueId().asDottedString(),
                                 csr);
-                writePrivateKeyAndCertificate(context.vespaUser(),
+                writePrivateKeyAndCertificate(context.userNamespace().vespaUserId(),
                         privateKeyFile, keyPair.getPrivate(), certificateFile, instanceIdentity.certificate());
                 context.log(logger, "Instance successfully refreshed and credentials written to file");
             } catch (ZtsClientException e) {
@@ -252,19 +251,19 @@ public class AthenzCredentialsMaintainer implements CredentialsMaintainer {
     }
 
 
-    private static void writePrivateKeyAndCertificate(VespaUser vespaUser,
+    private static void writePrivateKeyAndCertificate(int vespaUid,
                                                       ContainerPath privateKeyFile,
                                                       PrivateKey privateKey,
                                                       ContainerPath certificateFile,
                                                       X509Certificate certificate) {
-        writeFile(privateKeyFile, vespaUser, KeyUtils.toPem(privateKey));
-        writeFile(certificateFile, vespaUser, X509CertificateUtils.toPem(certificate));
+        writeFile(privateKeyFile, vespaUid, KeyUtils.toPem(privateKey));
+        writeFile(certificateFile, vespaUid, X509CertificateUtils.toPem(certificate));
     }
 
-    private static void writeFile(ContainerPath path, VespaUser vespaUser, String utf8Content) {
+    private static void writeFile(ContainerPath path, int vespaUid, String utf8Content) {
         new UnixPath(path.resolveSibling(path.getFileName() + ".tmp"))
                 .writeUtf8File(utf8Content, "r--------")
-                .setOwnerId(vespaUser.uid())
+                .setOwnerId(vespaUid)
                 .atomicMove(path);
     }
 
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/servicedump/VespaServiceDumperImpl.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/servicedump/VespaServiceDumperImpl.java
index b299e1f3f0d..0a9496be0a6 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/servicedump/VespaServiceDumperImpl.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/maintenance/servicedump/VespaServiceDumperImpl.java
@@ -101,8 +101,8 @@ public class VespaServiceDumperImpl implements VespaServiceDumper {
             }
             context.log(log, Level.INFO, "Creating '" + unixPathDirectory +"'.");
             unixPathDirectory.createDirectory("rwxr-x---")
-                    .setOwner(context.vespaUser().name())
-                    .setGroup(context.vespaUser().group());
+                    .setOwner(context.userNamespace().vespaUser())
+                    .setGroup(context.userNamespace().vespaGroup());
             URI destination = serviceDumpDestination(nodeSpec, createDumpId(request));
             ProducerContext producerCtx = new ProducerContext(context, directory, request);
             List<Artifact> producedArtifacts = new ArrayList<>();
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeadmin/NodeAdminStateUpdater.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeadmin/NodeAdminStateUpdater.java
index dda404797d9..53c9e741f59 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeadmin/NodeAdminStateUpdater.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeadmin/NodeAdminStateUpdater.java
@@ -3,6 +3,7 @@ package com.yahoo.vespa.hosted.node.admin.nodeadmin;
 
 import com.yahoo.concurrent.ThreadFactoryFactory;
 import com.yahoo.config.provision.HostName;
+import com.yahoo.vespa.flags.FlagSource;
 import com.yahoo.vespa.hosted.node.admin.configserver.noderepository.Acl;
 import com.yahoo.vespa.hosted.node.admin.configserver.noderepository.NodeRepository;
 import com.yahoo.vespa.hosted.node.admin.configserver.noderepository.NodeSpec;
@@ -12,6 +13,7 @@ import com.yahoo.vespa.hosted.node.admin.nodeagent.NodeAgentContext;
 import com.yahoo.vespa.hosted.node.admin.nodeagent.NodeAgentContextFactory;
 import com.yahoo.yolean.Exceptions;
 
+import java.time.Clock;
 import java.time.Duration;
 import java.util.ArrayList;
 import java.util.EnumSet;
@@ -57,7 +59,9 @@ public class NodeAdminStateUpdater {
             NodeRepository nodeRepository,
             Orchestrator orchestrator,
             NodeAdmin nodeAdmin,
-            HostName hostHostname) {
+            HostName hostHostname,
+            Clock clock,
+            FlagSource flagSource) {
         this.nodeAgentContextFactory = nodeAgentContextFactory;
         this.nodeRepository = nodeRepository;
         this.orchestrator = orchestrator;
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentContext.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentContext.java
index f3148cc7859..8cf8553bc34 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentContext.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentContext.java
@@ -42,8 +42,7 @@ public interface NodeAgentContext extends TaskContext {
 
     ZoneApi zone();
 
-    /** @return information about the Vespa user inside the container */
-    VespaUser vespaUser();
+    UserNamespace userNamespace();
 
     default boolean isDisabled(NodeAgentTask task) {
         return false;
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentContextImpl.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentContextImpl.java
index 771528324e0..9bcf5d58d6e 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentContextImpl.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/NodeAgentContextImpl.java
@@ -42,14 +42,16 @@ public class NodeAgentContextImpl implements NodeAgentContext {
     private final ZoneApi zone;
     private final ContainerFileSystem containerFs;
     private final ContainerPath pathToVespaHome;
+    private final UserNamespace userNamespace;
     private final double cpuSpeedup;
     private final Set<NodeAgentTask> disabledNodeAgentTasks;
     private final Optional<ApplicationId> hostExclusiveTo;
 
     public NodeAgentContextImpl(NodeSpec node, Acl acl, AthenzIdentity identity,
                                 ContainerNetworkMode containerNetworkMode, ZoneApi zone,
-                                FlagSource flagSource, ContainerFileSystem containerFs, String pathToVespaHome,
-                                double cpuSpeedup, Optional<ApplicationId> hostExclusiveTo) {
+                                FlagSource flagSource, Path pathToContainerStorage, String pathToVespaHome,
+                                UserNamespace userNamespace, double cpuSpeedup,
+                                Optional<ApplicationId> hostExclusiveTo) {
         if (cpuSpeedup <= 0)
             throw new IllegalArgumentException("cpuSpeedUp must be positive, was: " + cpuSpeedup);
 
@@ -59,9 +61,10 @@ public class NodeAgentContextImpl implements NodeAgentContext {
         this.identity = Objects.requireNonNull(identity);
         this.containerNetworkMode = Objects.requireNonNull(containerNetworkMode);
         this.zone = Objects.requireNonNull(zone);
-        this.containerFs = Objects.requireNonNull(containerFs);
+        this.containerFs = ContainerFileSystem.create(pathToContainerStorage.resolve(containerName.asString()), userNamespace);
         this.pathToVespaHome = containerFs.getPath(pathToVespaHome);
         this.logPrefix = containerName.asString() + ": ";
+        this.userNamespace = Objects.requireNonNull(userNamespace);
         this.cpuSpeedup = cpuSpeedup;
         this.disabledNodeAgentTasks = NodeAgentTask.fromString(
                 PermanentFlags.DISABLED_HOST_ADMIN_TASKS.bindTo(flagSource).with(FetchVector.Dimension.HOSTNAME, node.hostname()).value());
@@ -99,8 +102,8 @@ public class NodeAgentContextImpl implements NodeAgentContext {
     }
 
     @Override
-    public VespaUser vespaUser() {
-        return containerFs.getUserPrincipalLookupService().vespaUser();
+    public UserNamespace userNamespace() {
+        return userNamespace;
     }
 
     @Override
@@ -188,7 +191,6 @@ public class NodeAgentContextImpl implements NodeAgentContext {
         private ContainerNetworkMode containerNetworkMode;
         private ZoneApi zone;
         private UserNamespace userNamespace;
-        private VespaUser vespaUser;
         private Path containerStorage;
         private FlagSource flagSource;
         private double cpuSpeedUp = 1;
@@ -228,12 +230,6 @@ public class NodeAgentContextImpl implements NodeAgentContext {
             return this;
         }
 
-        public Builder vespaUser(VespaUser vespaUser) {
-            this.vespaUser = vespaUser;
-            return this;
-        }
-
-
         /** Sets the file system to use for paths. */
         public Builder fileSystem(FileSystem fileSystem) {
             return containerStorage(fileSystem.getPath(DEFAULT_CONTAINER_STORAGE.toString()));
@@ -262,13 +258,6 @@ public class NodeAgentContextImpl implements NodeAgentContext {
         public NodeAgentContextImpl build() {
             Objects.requireNonNull(containerStorage, "Must set one of containerStorage or fileSystem");
 
-            UserNamespace userNamespace = Optional.ofNullable(this.userNamespace)
-                    .orElseGet(() -> new UserNamespace(100000, 100000));
-            VespaUser vespaUser = Optional.ofNullable(this.vespaUser)
-                    .orElseGet(() -> new VespaUser("vespa", "vespa", 1000, 100));
-            ContainerFileSystem containerFs = ContainerFileSystem.create(containerStorage
-                    .resolve(nodeSpecBuilder.hostname().split("\\.")[0]), userNamespace, vespaUser);
-
             return new NodeAgentContextImpl(
                     nodeSpecBuilder.build(),
                     Optional.ofNullable(acl).orElse(Acl.EMPTY),
@@ -296,8 +285,9 @@ public class NodeAgentContextImpl implements NodeAgentContext {
                         }
                     }),
                     Optional.ofNullable(flagSource).orElseGet(InMemoryFlagSource::new),
-                    containerFs,
+                    containerStorage,
                     "/opt/vespa",
+                    Optional.ofNullable(userNamespace).orElseGet(() -> new UserNamespace(100000, 100000, "vespa", "vespa", 1000, 100)),
                     cpuSpeedUp, hostExclusiveTo);
         }
     }
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/UserNamespace.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/UserNamespace.java
index 005452411bd..1a25b5c3c5e 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/UserNamespace.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/UserNamespace.java
@@ -1,6 +1,8 @@
 // Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 package com.yahoo.vespa.hosted.node.admin.nodeagent;
 
+import java.util.Objects;
+
 /**
  * @author valerijf
  */
@@ -14,12 +16,20 @@ public class UserNamespace {
      * https://github.com/torvalds/linux/blob/5bfc75d92efd494db37f5c4c173d3639d4772966/Documentation/admin-guide/sysctl/fs.rst#overflowgid--overflowuid */
     private static final int OVERFLOW_ID = 65_534;
 
-    private volatile int uidOffset;
-    private volatile int gidOffset;
+    private final int uidOffset;
+    private final int gidOffset;
+    private final String vespaUser;
+    private final String vespaGroup;
+    private final int vespaUserId;
+    private final int vespaGroupId;
 
-    public UserNamespace(int uidOffset, int gidOffset) {
+    public UserNamespace(int uidOffset, int gidOffset, String vespaUser, String vespaGroup, int vespaUserId, int vespaGroupId) {
         this.uidOffset = uidOffset;
         this.gidOffset = gidOffset;
+        this.vespaUser = Objects.requireNonNull(vespaUser);
+        this.vespaGroup = Objects.requireNonNull(vespaGroup);
+        this.vespaUserId = vespaUserId;
+        this.vespaGroupId = vespaGroupId;
     }
 
     public int userIdOnHost(int containerUid) { return toHostId(containerUid, uidOffset); }
@@ -27,15 +37,14 @@ public class UserNamespace {
     public int userIdInContainer(int hostUid) { return toContainerId(hostUid, uidOffset); }
     public int groupIdInContainer(int hostGid) { return toContainerId(hostGid, gidOffset); }
 
+    public String vespaUser() { return vespaUser; }
+    public String vespaGroup() { return vespaGroup; }
+    public int vespaUserId() { return vespaUserId; }
+    public int vespaGroupId() { return vespaGroupId; }
+
     public int idRange() { return ID_RANGE; }
     public int overflowId() { return OVERFLOW_ID; }
 
-    // Remove after migration to mapped namespaces is complete, make fields final
-    public void setOffsets(int idOffset) {
-        this.uidOffset = idOffset;
-        this.gidOffset = idOffset;
-    }
-
     private static int toHostId(int containerId, int idOffset) {
         if (containerId < 0 || containerId > ID_RANGE)
             throw new IllegalArgumentException("Invalid container id: " + containerId);
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/VespaUser.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/VespaUser.java
deleted file mode 100644
index 78ccca80beb..00000000000
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/nodeagent/VespaUser.java
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
-package com.yahoo.vespa.hosted.node.admin.nodeagent;
-
-import java.util.Objects;
-
-/**
- * Describes Vespa user inside the container user namespace.
- * 
- * @author valerijf
- */
-public class VespaUser {
-
-    private final String name;
-    private final String group;
-    private final int uid;
-    private final int gid;
-
-    public VespaUser(String name, String group, int uid, int gid) {
-        this.name = Objects.requireNonNull(name);
-        this.group = Objects.requireNonNull(group);
-        this.uid = uid;
-        this.gid = gid;
-    }
-
-    public String name() { return name; }
-    public String group() { return group; }
-    public int uid() { return uid; }
-    public int gid() { return gid; }
-}
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystem.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystem.java
index cda806f533a..078a60ba7a5 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystem.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystem.java
@@ -2,7 +2,6 @@
 package com.yahoo.vespa.hosted.node.admin.task.util.fs;
 
 import com.yahoo.vespa.hosted.node.admin.nodeagent.UserNamespace;
-import com.yahoo.vespa.hosted.node.admin.nodeagent.VespaUser;
 
 import java.io.IOException;
 import java.nio.file.FileStore;
@@ -11,6 +10,7 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.PathMatcher;
 import java.nio.file.WatchService;
+import java.nio.file.attribute.UserPrincipalLookupService;
 import java.util.Set;
 
 import static com.yahoo.yolean.Exceptions.uncheck;
@@ -52,7 +52,7 @@ public class ContainerFileSystem extends FileSystem {
     }
 
     @Override
-    public ContainerUserPrincipalLookupService getUserPrincipalLookupService() {
+    public UserPrincipalLookupService getUserPrincipalLookupService() {
         return containerFsProvider.userPrincipalLookupService();
     }
 
@@ -86,8 +86,8 @@ public class ContainerFileSystem extends FileSystem {
         throw new UnsupportedOperationException();
     }
 
-    public static ContainerFileSystem create(Path containerStorageRoot, UserNamespace userNamespace, VespaUser vespaUser) {
+    public static ContainerFileSystem create(Path containerStorageRoot, UserNamespace userNamespace) {
         uncheck(() -> Files.createDirectories(containerStorageRoot));
-        return new ContainerFileSystemProvider(containerStorageRoot, userNamespace, vespaUser).getFileSystem(null);
+        return new ContainerFileSystemProvider(containerStorageRoot, userNamespace).getFileSystem(null);
     }
 }
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystemProvider.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystemProvider.java
index bcc35426d25..909c6c9cbc1 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystemProvider.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystemProvider.java
@@ -2,7 +2,6 @@
 package com.yahoo.vespa.hosted.node.admin.task.util.fs;
 
 import com.yahoo.vespa.hosted.node.admin.nodeagent.UserNamespace;
-import com.yahoo.vespa.hosted.node.admin.nodeagent.VespaUser;
 
 import java.io.IOException;
 import java.net.URI;
@@ -46,10 +45,10 @@ class ContainerFileSystemProvider extends FileSystemProvider {
     private final ContainerUserPrincipalLookupService userPrincipalLookupService;
     private final Path containerRootOnHost;
 
-    ContainerFileSystemProvider(Path containerRootOnHost, UserNamespace userNamespace, VespaUser vespaUser) {
+    ContainerFileSystemProvider(Path containerRootOnHost, UserNamespace userNamespace) {
         this.containerFs = new ContainerFileSystem(this);
         this.userPrincipalLookupService = new ContainerUserPrincipalLookupService(
-                containerRootOnHost.getFileSystem().getUserPrincipalLookupService(), userNamespace, vespaUser);
+                containerRootOnHost.getFileSystem().getUserPrincipalLookupService(), userNamespace);
         this.containerRootOnHost = containerRootOnHost;
     }
 
diff --git a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerUserPrincipalLookupService.java b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerUserPrincipalLookupService.java
index 8e35bdccc23..ae65f6a7f7f 100644
--- a/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerUserPrincipalLookupService.java
+++ b/node-admin/src/main/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerUserPrincipalLookupService.java
@@ -2,7 +2,6 @@
 package com.yahoo.vespa.hosted.node.admin.task.util.fs;
 
 import com.yahoo.vespa.hosted.node.admin.nodeagent.UserNamespace;
-import com.yahoo.vespa.hosted.node.admin.nodeagent.VespaUser;
 
 import java.io.IOException;
 import java.nio.file.attribute.GroupPrincipal;
@@ -14,22 +13,16 @@ import java.util.Objects;
 /**
  * @author valerijf
  */
-public class ContainerUserPrincipalLookupService extends UserPrincipalLookupService {
+class ContainerUserPrincipalLookupService extends UserPrincipalLookupService {
 
     private final UserPrincipalLookupService baseFsUserPrincipalLookupService;
     private final UserNamespace userNamespace;
-    private final VespaUser vespaUser;
 
-    ContainerUserPrincipalLookupService(
-            UserPrincipalLookupService baseFsUserPrincipalLookupService, UserNamespace userNamespace, VespaUser vespaUser) {
+    ContainerUserPrincipalLookupService(UserPrincipalLookupService baseFsUserPrincipalLookupService, UserNamespace userNamespace) {
         this.baseFsUserPrincipalLookupService = Objects.requireNonNull(baseFsUserPrincipalLookupService);
         this.userNamespace = Objects.requireNonNull(userNamespace);
-        this.vespaUser = Objects.requireNonNull(vespaUser);
     }
 
-    public UserNamespace userNamespace() { return userNamespace; }
-    public VespaUser vespaUser() { return vespaUser; }
-
     public int userIdOnHost(int containerUid)  { return userNamespace.userIdOnHost(containerUid); }
     public int groupIdOnHost(int containerGid) { return userNamespace.groupIdOnHost(containerGid); }
     public int userIdInContainer(int hostUid)  { return userNamespace.userIdInContainer(hostUid); }
@@ -37,27 +30,27 @@ public class ContainerUserPrincipalLookupService extends UserPrincipalLookupServ
 
     @Override
     public ContainerUserPrincipal lookupPrincipalByName(String name) throws IOException {
-        int containerUid = resolveName(name, vespaUser.name(), vespaUser.uid());
-        String user = resolveId(containerUid, vespaUser.name(), vespaUser.uid());
+        int containerUid = resolveName(name, userNamespace.vespaUser(), userNamespace.vespaUserId());
+        String user = resolveId(containerUid, userNamespace.vespaUser(), userNamespace.vespaUserId());
         String hostUid = String.valueOf(userIdOnHost(containerUid));
         return new ContainerUserPrincipal(containerUid, user, baseFsUserPrincipalLookupService.lookupPrincipalByName(hostUid));
     }
 
     @Override
     public ContainerGroupPrincipal lookupPrincipalByGroupName(String group) throws IOException {
-        int containerGid = resolveName(group, vespaUser.group(), vespaUser.gid());
-        String name = resolveId(containerGid, vespaUser.group(), vespaUser.gid());
+        int containerGid = resolveName(group, userNamespace.vespaGroup(), userNamespace.vespaGroupId());
+        String name = resolveId(containerGid, userNamespace.vespaGroup(), userNamespace.vespaGroupId());
         String hostGid = String.valueOf(groupIdOnHost(containerGid));
         return new ContainerGroupPrincipal(containerGid, name, baseFsUserPrincipalLookupService.lookupPrincipalByGroupName(hostGid));
     }
 
     public ContainerUserPrincipal userPrincipal(int uid, UserPrincipal baseFsPrincipal) {
-        String name = resolveId(uid, vespaUser.name(), vespaUser.uid());
+        String name = resolveId(uid, userNamespace.vespaUser(), userNamespace.vespaUserId());
         return new ContainerUserPrincipal(uid, name, baseFsPrincipal);
     }
     
     public ContainerGroupPrincipal groupPrincipal(int gid, GroupPrincipal baseFsPrincipal) {
-        String name = resolveId(gid, vespaUser.group(), vespaUser.gid());
+        String name = resolveId(gid, userNamespace.vespaGroup(), userNamespace.vespaGroupId());
         return new ContainerGroupPrincipal(gid, name, baseFsPrincipal);
     }
 
diff --git a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/integration/ContainerTester.java b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/integration/ContainerTester.java
index 4a26195dd3a..08e335f188a 100644
--- a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/integration/ContainerTester.java
+++ b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/integration/ContainerTester.java
@@ -93,7 +93,7 @@ public class ContainerTester implements AutoCloseable {
         NodeAgentContextFactory nodeAgentContextFactory = (nodeSpec, acl) ->
                 NodeAgentContextImpl.builder(nodeSpec).acl(acl).fileSystem(fileSystem).build();
         nodeAdminStateUpdater = new NodeAdminStateUpdater(nodeAgentContextFactory, nodeRepository, orchestrator,
-                nodeAdmin, HOST_HOSTNAME);
+                nodeAdmin, HOST_HOSTNAME, clock, flagSource);
 
         loopThread = new Thread(() -> {
             nodeAdminStateUpdater.start();
diff --git a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/nodeadmin/NodeAdminStateUpdaterTest.java b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/nodeadmin/NodeAdminStateUpdaterTest.java
index 5436f84f467..f9b0070a3d6 100644
--- a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/nodeadmin/NodeAdminStateUpdaterTest.java
+++ b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/nodeadmin/NodeAdminStateUpdaterTest.java
@@ -3,6 +3,8 @@ package com.yahoo.vespa.hosted.node.admin.nodeadmin;
 
 import com.yahoo.config.provision.HostName;
 import com.yahoo.config.provision.NodeType;
+import com.yahoo.test.ManualClock;
+import com.yahoo.vespa.flags.InMemoryFlagSource;
 import com.yahoo.vespa.hosted.node.admin.configserver.noderepository.Acl;
 import com.yahoo.vespa.hosted.node.admin.configserver.noderepository.NodeSpec;
 import com.yahoo.vespa.hosted.node.admin.configserver.noderepository.NodeState;
@@ -48,9 +50,11 @@ public class NodeAdminStateUpdaterTest {
     private final Orchestrator orchestrator = mock(Orchestrator.class);
     private final NodeAdmin nodeAdmin = mock(NodeAdmin.class);
     private final HostName hostHostname = HostName.from("basehost1.test.yahoo.com");
+    private final ManualClock clock = new ManualClock();
+    private final InMemoryFlagSource flagSource = new InMemoryFlagSource();
 
     private final NodeAdminStateUpdater updater = spy(new NodeAdminStateUpdater(
-            nodeAgentContextFactory, nodeRepository, orchestrator, nodeAdmin, hostHostname));
+            nodeAgentContextFactory, nodeRepository, orchestrator, nodeAdmin, hostHostname, clock, flagSource));
 
 
     @Test
diff --git a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/nodeagent/UserNamespaceTest.java b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/nodeagent/UserNamespaceTest.java
index bb02667a550..73b59a17c37 100644
--- a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/nodeagent/UserNamespaceTest.java
+++ b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/nodeagent/UserNamespaceTest.java
@@ -11,7 +11,7 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
  */
 class UserNamespaceTest {
 
-    private final UserNamespace userNamespace = new UserNamespace(1000, 2000);
+    private final UserNamespace userNamespace = new UserNamespace(1000, 2000, "vespa", "users", 1000, 100);
 
     @Test
     public void translates_between_ids() {
diff --git a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystemTest.java b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystemTest.java
index 242a2458f07..4e85052a176 100644
--- a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystemTest.java
+++ b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerFileSystemTest.java
@@ -2,7 +2,6 @@
 package com.yahoo.vespa.hosted.node.admin.task.util.fs;
 
 import com.yahoo.vespa.hosted.node.admin.nodeagent.UserNamespace;
-import com.yahoo.vespa.hosted.node.admin.nodeagent.VespaUser;
 import com.yahoo.vespa.hosted.node.admin.task.util.file.UnixPath;
 import com.yahoo.vespa.test.file.TestFileSystem;
 import org.junit.jupiter.api.Test;
@@ -25,10 +24,8 @@ class ContainerFileSystemTest {
 
     private final FileSystem fileSystem = TestFileSystem.create();
     private final UnixPath containerRootOnHost = new UnixPath(fileSystem.getPath("/data/storage/ctr1"));
-    private final UserNamespace userNamespace = new UserNamespace(10_000, 11_000);
-    private final VespaUser vespaUser = new VespaUser("vespa", "users", 1000, 100);
-    private final ContainerFileSystem containerFs = ContainerFileSystem.create(
-            containerRootOnHost.createDirectories().toPath(), userNamespace, vespaUser);
+    private final UserNamespace userNamespace = new UserNamespace(10_000, 11_000, "vespa", "users", 1000, 100);
+    private final ContainerFileSystem containerFs = ContainerFileSystem.create(containerRootOnHost.createDirectories().toPath(), userNamespace);
 
     @Test
     public void creates_files_and_directories_with_container_root_as_owner() throws IOException {
diff --git a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerPathTest.java b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerPathTest.java
index a2a036008bc..6bca8c2f0b1 100644
--- a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerPathTest.java
+++ b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerPathTest.java
@@ -2,7 +2,6 @@
 package com.yahoo.vespa.hosted.node.admin.task.util.fs;
 
 import com.yahoo.vespa.hosted.node.admin.nodeagent.UserNamespace;
-import com.yahoo.vespa.hosted.node.admin.nodeagent.VespaUser;
 import com.yahoo.vespa.test.file.TestFileSystem;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
@@ -28,7 +27,7 @@ import java.nio.file.Path;
 class ContainerPathTest {
 
     private final FileSystem baseFs = TestFileSystem.create();
-    private final ContainerFileSystem containerFs = ContainerFileSystem.create(baseFs.getPath("/data/storage/ctr1"), mock(UserNamespace.class), mock(VespaUser.class));
+    private final ContainerFileSystem containerFs = ContainerFileSystem.create(baseFs.getPath("/data/storage/ctr1"), mock(UserNamespace.class));
 
     @Test
     public void create_new_container_path() {
diff --git a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerUserPrincipalLookupServiceTest.java b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerUserPrincipalLookupServiceTest.java
index 70c837e6fb2..bc26cfa73f3 100644
--- a/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerUserPrincipalLookupServiceTest.java
+++ b/node-admin/src/test/java/com/yahoo/vespa/hosted/node/admin/task/util/fs/ContainerUserPrincipalLookupServiceTest.java
@@ -2,7 +2,6 @@
 package com.yahoo.vespa.hosted.node.admin.task.util.fs;
 
 import com.yahoo.vespa.hosted.node.admin.nodeagent.UserNamespace;
-import com.yahoo.vespa.hosted.node.admin.nodeagent.VespaUser;
 import com.yahoo.vespa.test.file.TestFileSystem;
 import org.junit.jupiter.api.Test;
 
@@ -19,10 +18,9 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
  */
 class ContainerUserPrincipalLookupServiceTest {
 
-    private final UserNamespace userNamespace = new UserNamespace(10_000, 11_000);
-    private final VespaUser vespaUser = new VespaUser("vespa", "users", 1000, 100);
+    private final UserNamespace userNamespace = new UserNamespace(10_000, 11_000, "vespa", "users", 1000, 100);
     private final ContainerUserPrincipalLookupService userPrincipalLookupService =
-            new ContainerUserPrincipalLookupService(TestFileSystem.create().getUserPrincipalLookupService(), userNamespace, vespaUser);
+            new ContainerUserPrincipalLookupService(TestFileSystem.create().getUserPrincipalLookupService(), userNamespace);
 
     @Test
     public void correctly_resolves_ids() throws IOException {