glance-api unauthorized command with cinder backend

[sofyan]

Still related with these bugs:
https://bugs.launchpad.net/kolla-ansible/+bug/1855695
https://bugs.launchpad.net/bugs/1869072

when i try to upload image from openstack command, it return this log from glance-api.log:

2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi [req-71767f12-251b-43de-bbc0-42e990420d8e 976a6717db394130a06cc7fb4ac5eb72 d39ec491324c4aecae9981e51944efae - default default] Caught error: Unexpected error while running command.
Command: sudo glance-rootwrap /etc/glance/rootwrap.conf mount -t nfs 172.20.12.21:/vol_replica /var/lib/glance/mnt/nfs/bff00a0dbc101c63c992efe7f3eb5ef3c2a5fbeddf720b952072c13bbc9ab92b
Exit code: 99
Stdout: ''
Stderr: '/var/lib/kolla/venv/bin/glance-rootwrap: Unauthorized command: mount -t nfs 172.20.12.21:/vol_replica /var/lib/glance/mnt/nfs/bff00a0dbc101c63c992efe7f3eb5ef3c2a5fbeddf720b952072c13bbc9ab92b (no filter matched)\
n': oslo_concurrency.processutils.ProcessExecutionError: Unexpected error while running command.
Command: sudo glance-rootwrap /etc/glance/rootwrap.conf mount -t nfs 172.20.12.21:/vol_replica /var/lib/glance/mnt/nfs/bff00a0dbc101c63c992efe7f3eb5ef3c2a5fbeddf720b952072c13bbc9ab92b
Exit code: 99
Stdout: ''
Stderr: '/var/lib/kolla/venv/bin/glance-rootwrap: Unauthorized command: mount -t nfs 172.20.12.21:/vol_replica /var/lib/glance/mnt/nfs/bff00a0dbc101c63c992efe7f3eb5ef3c2a5fbeddf720b952072c13bbc9ab92b (no filter matched)\n'
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi Traceback (most recent call last):
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/common/wsgi.py", line 1355, in __call__
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi request, **action_args)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/common/wsgi.py", line 1398, in dispatch
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi return method(*args, **kwargs)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/common/utils.py", line 416, in wrapped
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi return func(self, req, *args, **kwargs)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/api/v2/image_data.py", line 299, in upload
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi self._restore(image_repo, image)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/oslo_utils/excutils.py", line 220, in __exit__
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi self.force_reraise()
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/oslo_utils/excutils.py", line 196, in force_reraise
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi six.reraise(self.type_, self.value, self.tb)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/usr/local/lib/python3.6/dist-packages/six.py", line 703, in reraise
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi raise value
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/api/v2/image_data.py", line 164, in upload
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi image.set_data(data, size, backend=backend)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/domain/proxy.py", line 208, in set_data
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi self.base.set_data(data, size, backend=backend, set_active=set_active)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/notifier.py", line 501, in set_data
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi _send_notification(notify_error, 'image.upload', msg)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/oslo_utils/excutils.py", line 220, in __exit__
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi self.force_reraise()
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/oslo_utils/excutils.py", line 196, in force_reraise
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi six.reraise(self.type_, self.value, self.tb)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/usr/local/lib/python3.6/dist-packages/six.py", line 703, in reraise
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi raise value
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/notifier.py", line 448, in set_data
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi set_active=set_active)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/api/policy.py", line 204, in set_data
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi return self.image.set_data(*args, **kwargs)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/quota/__init__.py", line 319, in set_data
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi set_active=set_active)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/location.py", line 559, in set_data
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi self._upload_to_store(data, verifier, backend, size)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance/location.py", line 472, in _upload_to_store
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi verifier=verifier)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance_store/multi_backend.py", line 396, in add_with_multihash
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi image_id, data, size, hashing_algo, store, context, verifier)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance_store/multi_backend.py", line 478, in store_add_to_backend_with_multihash
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi image_id, data, size, hashing_algo, context=context, verifier=verifier)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance_store/driver.py", line 279, in add_adapter
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi metadata_dict) = store_add_fun(*args, **kwargs)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance_store/capabilities.py", line 176, in op_checker
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi return store_op_fun(store, *args, **kwargs)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance_store/_drivers/cinder.py", line 795, in add
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi with self._open_cinder_volume(client, volume, 'wb') as f:
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/usr/lib/python3.6/contextlib.py", line 81, in __enter__
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi return next(self.gen)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance_store/_drivers/cinder.py", line 597, in _open_cinder_volume
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi device = connect_volume_nfs()
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/oslo_concurrency/lockutils.py", line 359, in inner
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi return f(*args, **kwargs)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance_store/_drivers/cinder.py", line 595, in connect_volume_nfs
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi root_helper, options)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance_store/common/fs_mount.py", line 359, in mount
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi rootwrap_helper, options)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/glance_store/common/fs_mount.py", line 256, in mount
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi root_helper=rootwrap_helper)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi File "/var/lib/kolla/venv/lib/python3.6/site-packages/oslo_concurrency/processutils.py", line 431, in execute
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi cmd=sanitized_cmd)
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi oslo_concurrency.processutils.ProcessExecutionError: Unexpected error while running command.
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi Command: sudo glance-rootwrap /etc/glance/rootwrap.conf mount -t nfs 172.20.12.21:/vol_replica /var/lib/glance/mnt/nfs/bff00a0dbc101c63c992efe7f3eb5ef3c2a5fbeddf720b952
072c13bbc9ab92b
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi Exit code: 99
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi Stdout: ''
2022-01-24 00:29:45.861 22 ERROR glance.common.wsgi Stderr: '/var/lib/kolla/venv/bin/glance-rootwrap: Unauthorized command: mount -t nfs 172.20.12.21:/vol_replica /var/lib/glance/mnt/nfs/bff00a0dbc101c63c992efe7f3eb5ef3c
2a5fbeddf720b952072c13bbc9ab92b (no filter matched)\n'

Reproduce:
- deploy cinder with nfs and iscsi enabled (to achieve Privileged glance container)
- set glance_api default_store to cinder
- restart glance_api container
- try to upload openstack image using: openstack image create --disk-format qcow2 --container-format bare --public --property os_type=linux --file ./cirros-0.5.2-x86_64-disk.img cirros

** Environment**:
- Ubuntu 18.04
- Kolla version: 10.2.0
- Openstack Ussuri