os-collect-config unable to restart neutron-l3-agent

[Gregory Haynes]

The command 'os-collect-config --force --one' fails on overcloud-notcompute with:

+ service neutron-l3-agent restart
neutron-l3-agent stop/waiting
start: Job failed to start
[2014-01-28 23:17:33,155] (os-refresh-config) [ERROR] during post-configure phase. [Command '['dib-run-parts', '/opt/stack/os-config-refresh/post-configure.d']' returned non-zero exit status 1]

And in /var/log/upstart/neutron-l3-agent.log:

Stderr: '/usr/bin/neutron-rootwrap: Unauthorized command: kill -9 11634 (no filter matched)\n'
2014-01-28 23:17:33.073 13463 ERROR neutron.common.legacy [-] Skipping unknown group key: firewall_driver
2014-01-28 23:17:33.133 13463 CRITICAL neutron [req-5f2c30e1-d121-4183-8bb1-109940edc995 None]
Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'kill', '-9', '11634']
Exit code: 99
Stdout: ''
Stderr: '/usr/bin/neutron-rootwrap: Unauthorized command: kill -9 11634 (no filter matched)\n'

Was able to fix by adding filter to /etc/neutron/rootwrap.d/l3.filters:
kill_l3_agent: KillFilter, root, /opt/stack/venvs/neutron/bin/python, -9

[Gregory Haynes (greghaynes)]

This appears to be caused by neutron-ns-metadata-proxy being run out of a venv, rather than root. The rootwrap to kill this service is set to /usr/bin/python, but needs to reference the venv python in order to work.

[Robert Collins (lifeless)]

Ugh, is this something we can make Just Work rather than needing the exact path? e.g. a path list?

[Eugene Nikanorov (enikanorov)]

Can you confirm it is a neutron issue?
It seems like a deployment problem.

[Armando Migliaccio (armando-migliaccio)]

This bug is > 172 days without activity. We are unsetting assignee and milestone and setting status to Incomplete in order to allow its expiry in 60 days.

If the bug is still valid, then update the bug status.

[Ben Nemec (bnemec)]

I believe this is no longer relevant to the current state of tripleo.

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]