Lack of documentation for rootwrap and privsep in nova docs

[Matt Riedemann]

Regarding rootwrap, this is the only mention in the nova docs:

https://docs.openstack.org/nova/stein/cli/nova-rootwrap.html

And privsep isn't much better:

https://docs.openstack.org/nova/stein/search.html?q=privsep

There is no documentation really about how rootwrap should be deployed during an install, what compute.filters is or what's in it, there is no links to privsep documentation or how rootwrap is configured with the privsep-helper (which is necessary during deployment if you want nova-compute to work).

At the very least we should have something in the compute service install guide about deploying the privsep files (maybe this is missing because deployment packages take care of this for us and we don't have dedicated docs on installing nova from source packages).

It would probably also be worth noting the known issue with bug 1715374 where SIGHUP'ing the nova-compute service makes nova-compute unusable because the privsep-helper child processes are gone so anything that needs root access after that (which is most things when you're creating a VM with the libvirt driver) will fail.

[Matt Riedemann (mriedem)]

Apparently the search function isn't great, but I found this in the nova admin docs:

https://docs.openstack.org/nova/stein/admin/root-wrap-reference.html

That doesn't mention anything about privsep though and it probably should.

[Eric Fried (efried)]

Whatever happens here can point to the docs being worked in oslo.privsep https://review.openstack.org/#/c/649997/