config-changed hook fails with virt-type=lxd

[James Page]

The last security update to lxd restricts the permissions on the unix socket to talk with lxd; this has the side effect that the config-changed hook now fails as the nova user at this point in the charm lifecycle is not in the lxd group yet:

2015-11-16 14:19:51 INFO config-changed Generating a client certificate. This may take a minute...
2015-11-16 14:19:58 INFO config-changed If this is your first run, you will need to import images using the 'lxd-images' script.
2015-11-16 14:19:58 INFO config-changed For example: 'lxd-images import ubuntu --alias ubuntu'.
2015-11-16 14:19:58 INFO config-changed error: Get http://unix.socket/1.0: dial unix /var/lib/lxd/unix.socket: connect: permission denied
2015-11-16 14:19:58 INFO juju-log Retrying 'lxc_list' 5 more times (delay=2)
2015-11-16 14:20:00 INFO config-changed error: Get http://unix.socket/1.0: dial unix /var/lib/lxd/unix.socket: connect: permission denied
2015-11-16 14:20:00 INFO juju-log Retrying 'lxc_list' 4 more times (delay=4)
2015-11-16 14:20:04 INFO config-changed error: Get http://unix.socket/1.0: dial unix /var/lib/lxd/unix.socket: connect: permission denied
2015-11-16 14:20:04 INFO juju-log Retrying 'lxc_list' 3 more times (delay=6)
2015-11-16 14:20:10 INFO config-changed error: Get http://unix.socket/1.0: dial unix /var/lib/lxd/unix.socket: connect: permission denied
2015-11-16 14:20:10 INFO juju-log Retrying 'lxc_list' 2 more times (delay=8)
2015-11-16 14:20:18 INFO config-changed error: Get http://unix.socket/1.0: dial unix /var/lib/lxd/unix.socket: connect: permission denied
2015-11-16 14:20:18 INFO juju-log Retrying 'lxc_list' 1 more times (delay=10)
2015-11-16 14:20:28 INFO config-changed error: Get http://unix.socket/1.0: dial unix /var/lib/lxd/unix.socket: connect: permission denied
2015-11-16 14:20:28 INFO config-changed Traceback (most recent call last):
2015-11-16 14:20:28 INFO config-changed File "/var/lib/juju/agents/unit-nova-compute-0/charm/hooks/config-changed", line 421, in <module>
2015-11-16 14:20:28 INFO config-changed main()
2015-11-16 14:20:28 INFO config-changed File "/var/lib/juju/agents/unit-nova-compute-0/charm/hooks/config-changed", line 413, in main
2015-11-16 14:20:28 INFO config-changed hooks.execute(sys.argv)
2015-11-16 14:20:28 INFO config-changed File "/var/lib/juju/agents/unit-nova-compute-0/charm/hooks/charmhelpers/core/hookenv.py", line 704, in execute
2015-11-16 14:20:28 INFO config-changed self._hooks[hook_name]()
2015-11-16 14:20:28 INFO config-changed File "/var/lib/juju/agents/unit-nova-compute-0/charm/hooks/charmhelpers/core/host.py", line 393, in wrapped_f
2015-11-16 14:20:28 INFO config-changed f(*args, **kwargs)
2015-11-16 14:20:28 INFO config-changed File "/var/lib/juju/agents/unit-nova-compute-0/charm/hooks/config-changed", line 149, in config_changed
2015-11-16 14:20:28 INFO config-changed configure_lxd(user='nova')
2015-11-16 14:20:28 INFO config-changed File "/var/lib/juju/agents/unit-nova-compute-0/charm/hooks/nova_compute_utils.py", line 606, in configure_lxd
2015-11-16 14:20:28 INFO config-changed lxc_list(user)
2015-11-16 14:20:28 INFO config-changed File "/var/lib/juju/agents/unit-nova-compute-0/charm/hooks/charmhelpers/core/decorators.py", line 42, in _retry_on_exception_inner_2
2015-11-16 14:20:28 INFO config-changed return f(*args, **kwargs)
2015-11-16 14:20:28 INFO config-changed File "/var/lib/juju/agents/unit-nova-compute-0/charm/hooks/nova_compute_utils.py", line 612, in lxc_list
2015-11-16 14:20:28 INFO config-changed check_call(cmd)
2015-11-16 14:20:28 INFO config-changed File "/usr/lib/python2.7/subprocess.py", line 540, in check_call
2015-11-16 14:20:28 INFO config-changed raise CalledProcessError(retcode, cmd)
2015-11-16 14:20:28 INFO config-changed subprocess.CalledProcessError: Command '['sudo', '-u', 'nova', 'lxc', 'list']' returned non-zero exit status 1
2015-11-16 14:20:28 ERROR juju.worker.uniter.operation runhook.go:107 hook "config-changed" failed: exit status 1

[James Page (james-page)]

Raising a distro task, as adding the nova user to the lxd group should really be done by the packaging on install as this benefits everyone.

[Launchpad Janitor (janitor)]

This bug was fixed in the package nova-compute-lxd - 0.18-0ubuntu4

---------------
nova-compute-lxd (0.18-0ubuntu4) xenial; urgency=medium

  * debian/nova-compute-lxd.postinst: Add the nova user to the LXD group
    in postinstall. (LP: #1516640)

 -- Chuck Short <email address hidden> Mon, 16 Nov 2015 09:41:03 -0500