kolla-ansible

libvirt: qemu cannot access ceph.conf

Bug #1861513 reported by Radosław Piliszek
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
kolla-ansible
Fix Released
Low
Radosław Piliszek
kolla-ansible 10.0.0 "ussuri"
Rocky
Fix Released
Low
Radosław Piliszek
kolla-ansible 7.2.1 "rocky"
Stein
Fix Released
Low
Radosław Piliszek
kolla-ansible 8.1.1 "stein"
Train
Fix Released
Low
Radosław Piliszek
kolla-ansible 9.1.0 "Train"
Ussuri
Fix Released
Low
Radosław Piliszek
kolla-ansible 10.0.0 "ussuri"

Bug Description

Since qemu is run as nova and not root (like libvirt), it needs relaxed permissions on ceph.conf in nova_libvirt container.

The following message appears in logs (a warning):
 2019-12-10 21:25:35.536879 7f3934f3b500 -1 parse_file: cannot open /etc/ceph/ceph.conf: (13) Permission denied

No proof of effect on operation, especially on kolla ceph.

Tags: ceph libvirt qemu
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to kolla-ansible (master)

Reviewed: https://review.opendev.org/680740
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=91910d2a455f66e5f014a04bedf132fe0cab55ea
Submitter: Zuul
Branch: master

commit 91910d2a455f66e5f014a04bedf132fe0cab55ea
Author: Ning Yao <email address hidden>
Date: Fri Sep 6 23:54:06 2019 +0800

    Fix qemu loading of ceph.conf (permission error)

    ceph.conf is loaded by qemu, not libvirt.
    Since qemu runs as the nova user, ceph.conf owned by root
    causes a permission error. The logs in
    /var/log/libvirt/qemu/instance-*.log reveal the error.

    This change fixes the issue by changing the ownership of ceph.conf
    in nova-libvirt to the nova user.

    Closes-Bug: #1861513
    Change-Id: I1881f51a6c8508f0f186a5623443343dc1df41d4
    Signed-off-by: Ning Yao <email address hidden>

Changed in kolla-ansible:
status: In Progress → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to kolla-ansible (stable/train)

Fix proposed to branch: stable/train
Review: https://review.opendev.org/705329

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to kolla-ansible (stable/train)

Reviewed: https://review.opendev.org/705329
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=e2c600d9a1317422acd95f460f726201f84d4187
Submitter: Zuul
Branch: stable/train

commit e2c600d9a1317422acd95f460f726201f84d4187
Author: Ning Yao <email address hidden>
Date: Fri Sep 6 23:54:06 2019 +0800

    Fix qemu loading of ceph.conf (permission error)

    ceph.conf is loaded by qemu, not libvirt.
    Since qemu runs as the nova user, ceph.conf owned by root
    causes a permission error. The logs in
    /var/log/libvirt/qemu/instance-*.log reveal the error.

    This change fixes the issue by changing the ownership of ceph.conf
    in nova-libvirt to the nova user.

    Closes-Bug: #1861513
    Change-Id: I1881f51a6c8508f0f186a5623443343dc1df41d4
    Signed-off-by: Ning Yao <email address hidden>
    (cherry picked from commit 91910d2a455f66e5f014a04bedf132fe0cab55ea)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to kolla-ansible (stable/stein)

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/706072

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to kolla-ansible (stable/rocky)

Fix proposed to branch: stable/rocky
Review: https://review.opendev.org/706073

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to kolla-ansible (stable/rocky)

Reviewed: https://review.opendev.org/706073
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=dc36a163b869c93cd3d9510d9435762c3d9a3c84
Submitter: Zuul
Branch: stable/rocky

commit dc36a163b869c93cd3d9510d9435762c3d9a3c84
Author: Ning Yao <email address hidden>
Date: Fri Sep 6 23:54:06 2019 +0800

    Fix qemu loading of ceph.conf (permission error)

    ceph.conf is loaded by qemu, not libvirt.
    Since qemu runs as the nova user, ceph.conf owned by root
    causes a permission error. The logs in
    /var/log/libvirt/qemu/instance-*.log reveal the error.

    This change fixes the issue by changing the ownership of ceph.conf
    in nova-libvirt to the nova user.

    Adapted for Stein and below by amending paths (no cells).

    Closes-Bug: #1861513
    Change-Id: I1881f51a6c8508f0f186a5623443343dc1df41d4
    Signed-off-by: Ning Yao <email address hidden>
    (cherry picked from commit 91910d2a455f66e5f014a04bedf132fe0cab55ea)
    (cherry picked from commit e2c600d9a1317422acd95f460f726201f84d4187)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to kolla-ansible (stable/stein)

Reviewed: https://review.opendev.org/706072
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=6c950d842d50d2919f6e1a88313dbe494ab9c6e4
Submitter: Zuul
Branch: stable/stein

commit 6c950d842d50d2919f6e1a88313dbe494ab9c6e4
Author: Ning Yao <email address hidden>
Date: Fri Sep 6 23:54:06 2019 +0800

    Fix qemu loading of ceph.conf (permission error)

    ceph.conf is loaded by qemu, not libvirt.
    Since qemu runs as the nova user, ceph.conf owned by root
    causes a permission error. The logs in
    /var/log/libvirt/qemu/instance-*.log reveal the error.

    This change fixes the issue by changing the ownership of ceph.conf
    in nova-libvirt to the nova user.

    Adapted for Stein and below by amending paths (no cells).

    Closes-Bug: #1861513
    Change-Id: I1881f51a6c8508f0f186a5623443343dc1df41d4
    Signed-off-by: Ning Yao <email address hidden>
    (cherry picked from commit 91910d2a455f66e5f014a04bedf132fe0cab55ea)
    (cherry picked from commit e2c600d9a1317422acd95f460f726201f84d4187)

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix included in openstack/kolla-ansible 7.2.1

This issue was fixed in the openstack/kolla-ansible 7.2.1 release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.