neutron-l3-agent failing to start with rootwrap error

[Robert Collins]

2014-01-25 23:01:50.774 9092 ERROR neutron.common.legacy [-] Skipping unknown group key: firewall_driver
2014-01-25 23:01:50.867 9092 CRITICAL neutron [req-fa963a49-8b87-4b3e-9068-f7d1db7936a0 None]
Command: ['sudo', '/usr/bin/neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'kill', '-9', '4957']
Exit code: 99
Stdout: ''
Stderr: '/usr/bin/neutron-rootwrap: Unauthorized command: kill -9 4957 (no filter matched)\n'

One undesirable workaround is to use sudo without rootwrap.

[Robert Collins (lifeless)]

This doesn't show up on initial deploy, just after some situation where a prior agent is running/expected/something.

[Erik Colnick (erikcolnick)]

This issue also affects the ability of the l3-agent to kill ns-metadata-proxy processes when routers are deleted, and as a result qrouter namespaces won't be cleaned up even if the agent is configured to delete router namespaces. It appears that the problem is due to the fact that the l3.filters file sets the kill filters to expect that the processes are running python from /usr/bin/python when, in fact, python is running from /opt/stack/venvs/neutron/bin/python.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/97887

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/97887
Committed: https://git.openstack.org/cgit/openstack/tripleo-image-elements/commit/?id=6a2f87c1694392258f574562ac609cd0ee70fde7
Submitter: Jenkins
Branch: master

commit 6a2f87c1694392258f574562ac609cd0ee70fde7
Author: Erik Colnick <email address hidden>
Date: Wed Jun 4 13:27:53 2014 -0600

    Fix l3.filters and dhcp.filters file for tripleo installations

    This change addresses a rootwrap filter issue specific to the l3-agent
    and dhcp-agent in a tripleo deployment. The location of the python
    executable used in starting processes within a tripleo deployment
    may be different than the /usr/bin/python location that is used
    for the KillFilter in l3.filters and dhcp.filters.

    Closes-Bug: #1272816

    Change-Id: I4c78b074e298f49eae559c7ca451fa7f9fec5970