<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div>On Apr 22, 2014, at 9:50 PM, sylecn <<a href="mailto:sylecn@gmail.com">sylecn@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Tue, Apr 22, 2014 at 4:57 AM, Aaron Knister <span dir="ltr"><<a href="mailto:aaron.knister@gmail.com" target="_blank">aaron.knister@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div>I just spent a couple hours trying to figure this out so I thought I'd share.<br>
<br></div>I'm
using the stackforge puppet modules and writing my own integration
module to pull the individual modules together. That allows me to
integrate better with our current puppet methodology and with local
security policy. <br>
<br></div><div>One of the things we disallow, by accident actually, is
packages dropping their own sudo rules in /etc/sudoers.d. All sudo rules
must be explicitly specified and managed via puppet resources. As a
side effect of this when I went to start the nova metadata api on the
controller node my logs blew up (as did the inboxes of my coworkers)
with security violations from the nova metadata api attempting to use
the nova root wrapper via sudo. <br>
<br></div><div>I thought it a little odd that the nova metadata api
would need to do anything as root since I'm running the neutron metadata
agents which already run actions as root. I figured out that this was
coming from the nova.api.manager.MetadataManager class which I'm
pretty sure isn't needed for neutron. I changed the value of
metadata_manager in nova.conf to nova.manager.Manager and now the api
service no-longer needs the rootwrap sudo setup.<br>
<br></div>I couldn't find this documented anywhere, so hopefully this helps someone in the future.<div><div><img src="https://mail.google.com/mail/u/0/images/cleardot.gif"><span class=""><font color="#888888"><br>
</font></span></div><span class=""><font color="#888888"><div>-Aaron<br></div></font></span></div></div><br></blockquote></div><br>Aaron, thanks for sharing. Are you using this in production? Do you notice
performance improvements on the metadata service after this change, i.e. when starting
lots of VM at the same time?</div></div></div></blockquote><div><br></div><div><div>It's quasi production. It's operational but it's hosting development machines. I haven't seen any performance changes although I haven't tried to spin up many machines at once. <br><br>Sent from my iPhone</div></div><div><br></div><br><blockquote type="cite"><div><div dir="ltr"><div class="gmail_extra"><br>-- <br><div dir="ltr"><div><i><br>YY Inc. is hiring openstack and python developers. Interested? Check <a href="http://www.nsbeta.info/jobs" target="_blank">http://www.nsbeta.info/jobs</a></i><br>
</div><div><br>--<br>Thanks,<br></div>Yuanle<br></div>
</div></div>
</div></blockquote></body></html>