Custom system test [1] failed at OSTF phase on tests where volumes were involved. Looking into logs and env we found that it's because 'privsep' command failed to run, because of lack of permissions for nova user:
---
/var/log/nova/nova-compute.log: 2016-08-16 09:34:58.801 28203 INFO oslo.privsep.daemon [req-77f31146-b81c-4588-957c-6db8e09b4ebf 920c09eadcb84bdf9fb78a4cdf44acb3 65141265cab0494a84d1a2eea507086d - - -] Running privsep helper: ['sudo', 'privsep-helper', '--config-file', '/etc/nova/nova-compute.conf', '--config-file', '/etc/nova/nova.conf', '--privsep_context', 'os_brick.privileged.default', '--privsep_sock_path', '/tmp/tmp6_SrBA/privsep.sock']
---
---
/var/log/sudo.log:142:<81>Aug 16 09:34:59 node-3 sudo: nova : command not allowed ; TTY=unknown ; PWD=/var/lib/nova ; USER=root ; COMMAND=/usr/bin/privsep-helper --config-file /etc/nova/nova-compute.conf --config-file /etc/nova/nova.conf --privsep_context os_brick.privileged.default --privsep_sock_path /tmp/tmp6_SrBA/privsep.sock
---
---
/var/log/nova/nova-compute.log: 2016-08-16 09:34:59.080 28203 CRITICAL oslo.privsep.daemon [req-77f31146-b81c-4588-957c-6db8e09b4ebf 920c09eadcb84bdf9fb78a4cdf44acb3 65141265cab0494a84d1a2eea507086d - - -] privsep helper command exited non-zero (1)
---
Adding section privsep_osbrick (see below) to /etc/nova/nova.conf and restarting nova-compute service on every compute node fixed the issue:
---
[privsep_osbrick]
helper_command=sudo nova-rootwrap /etc/nova/rootwrap.conf privsep-helper --config-file /etc/nova/nova.conf
---
[1] https://custom-ci.infra.mirantis.net/job/10.0.custom.system_test/1075
It looks like the same should be done for cinder.conf, at least there are two similar commits in devstack [1], [2]
[1] https:/
[2] https:/