cinder backup fails with nfs volume + nfs backup

[Vladislav Belogrudov]

When using nfs backends for volumes and backups cinder fails in some situations because of permission issues. One example of such situation is running an instance from Horizon and making it a cinder volume at the same time (default). This leads to a volume file with qemu ownership. Cinder backup runs as cinder user and cannot do anything with such volume:

2017-10-24 12:20:09.259 1 ERROR oslo_messaging.rpc.server Command: chown --reference=/var/lib/cinder/mnt/75d4bb544027c280d7cca6c8cabc8e88/volume-e2ac9405-d813-4286-ab63-d07134ead79f /var/lib/cinder/mnt/75d4bb544027c280d7cca6c8cabc8e88/volume-e2ac9405-d813-4286-ab63-d07134ead79f.tmp-snap-e2ac9405-d813-4286-ab63-d07134ead79f
2017-10-24 12:20:09.259 1 ERROR oslo_messaging.rpc.server Exit code: 1
2017-10-24 12:20:09.259 1 ERROR oslo_messaging.rpc.server Stdout: u''
2017-10-24 12:20:09.259 1 ERROR oslo_messaging.rpc.server Stderr: u"chown: changing ownership of '/var/lib/cinder/mnt/75d4bb544027c280d7cca6c8cabc8e88/volume-e2ac9405-d813-4286-ab63-d07134ead79f.tmp-snap-e2ac9405-d813-4286-ab63-d07134ead79f': Operation not permitted\n"

This is due to recent default NFS backend settings:

nas_secure_file_permissions=auto
nas_secure_file_operations=auto

There is a similar bug @ RedHat - https://bugzilla.redhat.com/show_bug.cgi?id=1433404
https://access.redhat.com/errata/RHBA-2017:2654

"""
     Cause: The NFS backend driver for Cinder implements enhanced NAS security features that default to being enabled. However, the features require non-standard configuration changes in Nova's libvirt, and without those changes some cinder volume operations fail.

Consequence: Some cinder volume operations fail when using the NFS backend.

Fix: Add TripleO settings to control the NFS driver's NAS secure features, and disable the features by default.
"""

Also these features enabled actually disable possibility to use snapshots.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/514639

[Vladislav Belogrudov (vlad-belogrudov)]

as of Queens cinder volume refuses to work with both snapshots/backups and secure nas feature:

/var/lib/docker/volumes/kolla_logs/_data/cinder/cinder-volume.log:2018-05-23 11:32:27.632 37 ERROR cinder.volume.drivers.nfs [req-4dd2d20c-7673-40d8-880f-c1c1578790b9 - - - - -] Snapshots are not supported with nas_secure_file_operations enabled ('true' or 'auto'). Please set it to 'false' if you intend to have it enabled.

Choosing the former until secure nas feature works in all environments

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/514639
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=b830fa145c8a47e8b501e2ecd51c4eadc00aebf8
Submitter: Zuul
Branch: master

commit b830fa145c8a47e8b501e2ecd51c4eadc00aebf8
Author: Vladislav Belogrudov <email address hidden>
Date: Tue Oct 24 15:40:38 2017 +0300

    Cinder fails to run because snapshots are not compatible with secure NAS

    Cinder cannot run with both snapshots or backups of volumes and
    secure NAS feature. Choosing the former as the latter does not function
    well everywhere.

    Change-Id: Iba3783b2acb79dd0e765862ef972a568c96ec108
    Closes-Bug: #1726836

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 7.0.0.0b3 development milestone.