USE_NAMESPACES requires sahara be run as root

[Matthew Farrellee]

The USE_NAMESPACES code, which tells savanna-api to setup a proxy into a tenant netns for communication w/ instances, uses 'ip netns exec' as part of its implementation.

root (superuser) privileges are required to successfully run 'ip netns exec', which means savanna-api must be run with such privs instead of a preferred lower-priv daemon account.

[Matthew Farrellee (mattf)]

RDO workaround: sed -i 's/daemon --user savanna/daemon --user root/' /etc/init.d/openstack-savanna-api

[Sergey Lukjanov (slukjanov)]

It looks like a note in docs.

[Matthew Farrellee (mattf)]

it would be better to use https://wiki.openstack.org/wiki/Rootwrap

[Jonathan Maron (jmaron)]

Do you mean something akin to "sudo quantum-rootwrap /etc/quantum/rootwrap.conf ip netns exec..."?

[Matthew Farrellee (mattf)]

pretty much, via https://pypi.python.org/pypi/oslo.rootwrap

[Sergey Lukjanov (slukjanov)]

yup, looks like it should be used for the case when namespaces enabled.

[Jonathan Maron (jmaron)]

Maybe this will play a role: https://wiki.openstack.org/wiki/Rootwrap#IpNetnsExecFilter ;)

[Jonathan Maron (jmaron)]

I can put in the code to support rootwrap functionality, but it appears that we'll need to document the sudoers configuration for the user running the savanna server, correct?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/73396

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/125518

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: proposed/juno
Review: https://review.openstack.org/126431

[OpenStack Infra (hudson-openstack)]

Change abandoned by Sergey Lukjanov (<email address hidden>) on branch: proposed/juno
Review: https://review.openstack.org/126431
Reason: It couldn't be back ported to juno due to the dep addition.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/125518
Committed: https://git.openstack.org/cgit/openstack/sahara/commit/?id=04502de481bb79345adc3053dfc08e2b909f2af3
Submitter: Jenkins
Branch: master

commit 04502de481bb79345adc3053dfc08e2b909f2af3
Author: Michael McCune <email address hidden>
Date: Wed Oct 1 17:57:52 2014 -0400

    Adding support for oslo.rootwrap to namespace access

    Changes
    * adding configuration options for rootwrap
    * refactoring ssh connection to use rootwrap as a proxy when requested
    * adding documentation for rootwrap configuration
    * adding default rootwrap filters file
    * adding default sudoers conf file for sahara user
    * adding default rootwrap conf file for sahara-rootwrap
    * adding sahara-rootwrap cli script
    * adding requirement for oslo.rootwrap

    Change-Id: I7871400b2342a4cd1a8910ae5121b1bfdc46078d
    Closes-Bug: #1271349