nova-compute fails to start when contrail-agent is installed because of apparmor
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Nova Compute Charm |
Triaged
|
Low
|
Unassigned |
Bug Description
When installing the nova-compute charm with contrail-agent as a subordinate charm, the nova-compute service fails to start.
juju status shows the app as blocked with the message: Services not running that should be: nova-compute.
Using journalct for the nova-compute unit, one can find the following traceback:
Traceback (most recent call last):
File "/usr/bin/
from nova.cmd.compute import main
File "/usr/lib/
import eventlet # noqa
File "/usr/lib/
from eventlet import convenience
File "/usr/lib/
from eventlet import greenio
File "/usr/lib/
from eventlet.
File "/usr/lib/
from OpenSSL import SSL
File "/usr/lib/
from OpenSSL import rand, crypto, SSL
File "/usr/lib/
from cryptography.
File "/usr/lib/
from cryptography.
File "/usr/lib/
import pkg_resources
File "/usr/lib/
@_call_aside
File "/usr/lib/
f(*args, **kwargs)
File "/usr/lib/
working_set = WorkingSet.
File "/usr/lib/
ws = cls()
File "/usr/lib/
self.
File "/usr/lib/
for dist in find_distributi
File "/usr/lib/
if len(os.
OSError: [Errno 13] Permission denied: '/usr/local/
After further investigation, it turns out that apparmor is not allowing nova-compute to access the folder.
A work-around to have nova-compute in a good shape it to pass the following config to the app:
aa-profile-mode: disable
Instead of disable, complain could also work.
Changed in charm-nova-compute: | |
status: | New → Triaged |
importance: | Undecided → Low |
I also attached a more than minimal version of the bundle to show the relation between the nova-compute charm and contrail-agent.