<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:none;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Malgun Gothic";
panose-1:2 11 5 3 2 0 0 2 0 4;}
@font-face
{font-family:"\@Malgun Gothic";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
span.n
{mso-style-name:n;}
span.m
{mso-style-name:m;}
span.E-MailFormatvorlage24
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Sorry, no idea about that, for us the group also has write permissions<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">--<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Felix Huettner<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> <span style="font-family:"Malgun Gothic",sans-serif">
박경원</span> <park0kyung0won@dgist.ac.kr> <br>
<b>Sent:</b> Monday, October 24, 2022 9:24 AM<br>
<b>To:</b> Felix Hüttner <felix.huettner@mail.schwarz>; openstack-discuss@lists.openstack.org<br>
<b>Subject:</b> RE: RE: [yoga][cinder] Cinder NFS backend: Compute service cannot access volume file (UID/GID problem)<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><img width="1" height="1" style="width:.0104in;height:.0104in" id="_x0000_i1026" src="https://mail.dgist.ac.kr:443/mail/dsn/LmStE+Sxuhd1wvrwoe98A2jqQVovKX_R_oV927BXuVPIAGSDd_1JsG3hsFZy2LbC0yYRoiPjqY9eK3pI3IDsn2KcIFDg"><o:p></o:p></p>
<div>
<p><span style="font-family:"none",serif">Hello Felix<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"><o:p> </o:p></span></p>
<p><span style="font-family:"none",serif">Thank you very much for kind reply<o:p></o:p></span></p>
<p><span style="font-family:"none",serif">Do I also need to change permission setting of volume file in /var/lib/nova/mnt/... ?<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"><o:p> </o:p></span></p>
<p><span style="font-family:"none",serif">By default its:<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"><o:p> </o:p></span></p>
<p><span style="font-family:"none",serif">drwxr-x--- 2 64061 64061 11 Oct 24 04:19 99c4f7e8b15983b65e20cb7d37db899f<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"><o:p> </o:p></span></p>
<p><span style="font-family:"none",serif">group has only read and execute permission, no write permission<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"><o:p> </o:p></span></p>
<p><span style="font-family:"none",serif"><o:p> </o:p></span></p>
<blockquote style="border:none;border-left:solid black 1.5pt;padding:0cm 0cm 0cm 4.0pt;margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-family:"none",serif">---------- </span><b><span style="font-family:"Malgun Gothic",sans-serif">원본</span></b><b><span style="font-family:"none",serif">
</span></b><b><span style="font-family:"Malgun Gothic",sans-serif">메일</span></b><span style="font-family:"none",serif"> ----------<br>
</span><b><span style="font-family:"Malgun Gothic",sans-serif">보낸사람</span></b><span style="font-family:"none",serif">: "Felix Hüttner" <<a href="mailto:felix.huettner@mail.schwarz">felix.huettner@mail.schwarz</a>><br>
</span><b><span style="font-family:"Malgun Gothic",sans-serif">받는사람</span></b><span style="font-family:"none",serif">: "<a href="mailto:park0kyung0won@dgist.ac.kr">park0kyung0won@dgist.ac.kr</a>" <<a href="mailto:park0kyung0won@dgist.ac.kr">park0kyung0won@dgist.ac.kr</a>>,
"<a href="mailto:openstack-discuss@lists.openstack.org">openstack-discuss@lists.openstack.org</a>" <<a href="mailto:openstack-discuss@lists.openstack.org">openstack-discuss@lists.openstack.org</a>><br>
</span><b><span style="font-family:"Malgun Gothic",sans-serif">날짜</span></b><span style="font-family:"none",serif">: 2022-10-24 (</span><span style="font-family:"Malgun Gothic",sans-serif">월</span><span style="font-family:"none",serif">) 16:12:48<br>
</span><b><span style="font-family:"Malgun Gothic",sans-serif">제목</span></b><span style="font-family:"none",serif">: RE: [yoga][cinder] Cinder NFS backend: Compute service cannot access volume file (UID/GID problem)<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"none",serif">Hi,<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"none",serif">we are solving this issue for us by creating a “cinder” group on all hypervisors with the same gid (64061 in your case).<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"none",serif">Then we add the nova user to the cinder group and we are fine afterwards.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"none",serif">You might need set “</span><span class="n"><span style="font-size:10.0pt;font-family:"Courier New"">dynamic_ownership</span></span><code><span style="font-size:10.0pt">
= </span></code><span class="m"><span style="font-size:10.0pt;font-family:"Courier New"">0" In your libvirt qemu.conf</span></span><span style="font-family:"none",serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"none",serif">--<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"none",serif">Felix Huettner<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-family:"none",serif">From:</span></b><span style="font-family:"none",serif">
</span><span style="font-family:"Malgun Gothic",sans-serif">박경원</span><span style="font-family:"none",serif"> <<a href="mailto:park0kyung0won@dgist.ac.kr">park0kyung0won@dgist.ac.kr</a>>
<br>
<b>Sent:</b> Monday, October 24, 2022 7:21 AM<br>
<b>To:</b> <a href="mailto:openstack-discuss@lists.openstack.org">openstack-discuss@lists.openstack.org</a><br>
<b>Subject:</b> [yoga][cinder] Cinder NFS backend: Compute service cannot access volume file (UID/GID problem)<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p><span style="font-family:"none",serif"><img border="0" width="1" height="1" style="width:.0104in;height:.0104in" id="_x0000_i1025" src="https://mail.dgist.ac.kr:443/mail/dsn/LmM-Y+wKuIyIHc2mE3IIg60jNRguyJhXioNX_986bVghElqlA5o1jtdRCwW4quU3K6CEyRYAoh_MrV8sRBVU8i0jsGBQ"></span><span style="font-family:"none",serif"><o:p></o:p></span></p>
<div>
<p><span style="font-family:"none",serif">Hi<o:p></o:p></span></p>
<p><span style="font-family:"none",serif">I'm trying to setup cinder-volume service with NFS backend<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p><span style="font-family:"none",serif">When I create a new VM instance with a volume from web UI, cinder-volume service on storage node creates volume file just fine<o:p></o:p></span></p>
<p><span style="font-family:"none",serif">But I get the following error on compute node and instance fails to spawn.<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p><span style="font-family:"none",serif">2022-10-24 02:14:25.347 402789 ERROR nova.compute.manager [req-47ec9fb1-9daa-4c24-8673-538797a217cc 8769cfaf608349bd9fbb36f92b188fe3 e1e8e8397cde49899b00d09dec76b29e - default default] [instance: 5acb1dc3-0685-4980-977b-b6dfff6dfb45]
Instance failed to spawn: libvirt.libvirtError: internal error: process exited while connecting to monitor: 2022-10-24T02:14:24.819644Z qemu-system-x86_64: -blockdev {"driver":"file","filename":"/var/lib/nova/mnt/99c4f7e8b15983b65e20cb7d37db899f/volume-8f478992-dde3-4c20-9005-61cd34eacf30","aio":"native","node-name":"libvirt-2-storage","cache":{"direct":true,"no-flush":false},"auto-read-only":true,"discard":"unmap"}:
Could not open '/var/lib/nova/mnt/99c4f7e8b15983b65e20cb7d37db899f/volume-8f478992-dde3-4c20-9005-61cd34eacf30': Permission denied<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p><span style="font-family:"none",serif">I've added appropriate configs to apparmor profile. (Using Ubuntu 22.04) Apparmor isn't blocking this access.<o:p></o:p></span></p>
<p><span style="font-family:"none",serif">While the instance is spawning, I've checked ownership of the volume file on compute node:<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p><span style="font-family:"none",serif">root@compute-node:/var/lib/nova/mnt$ ls -al<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p><span style="font-family:"none",serif">total 17<o:p></o:p></span></p>
<p><span style="font-family:"none",serif">drwxr-xr-x 3 nova nova 4096 Oct 24 04:19 .<o:p></o:p></span></p>
<p><span style="font-family:"none",serif">drwxr-xr-x 12 nova nova 4096 Oct 24 02:14 ..<o:p></o:p></span></p>
<p><span style="font-family:"none",serif">drwxr-x--- 2 64061 64061 11 Oct 24 04:19 99c4f7e8b15983b65e20cb7d37db899f<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p><span style="font-family:"none",serif">It seems like cinder user on storage node creates volume file with UID/GID of 64061 (cinder user's UID/GID)<o:p></o:p></span></p>
<p><span style="font-family:"none",serif">But nova user on compute node has UID/GID of 64060, therefore cannot open volume file(/var/lib/nova/mnt/99c4f7e8b15983b65e20cb7d37db899f/volume-8f478992-dde3-4c20-9005-61cd34eacf30)<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p><span style="font-family:"none",serif">Should I manually set the UID/GID of nova user on compute node to 64061, so both nova user on compute node and cinder user on storage node would have the same UID/GID?<o:p></o:p></span></p>
<p><span style="font-family:"none",serif">Feels like this duct taping isn't a proper solution. Did I miss something?<o:p></o:p></span></p>
<p><span style="font-family:"none",serif"> <o:p></o:p></span></p>
<p><span style="font-family:"none",serif">Thank you<o:p></o:p></span></p>
</div>
</div>
</div>
<p>Diese E Mail enthält möglicherweise vertrauliche Inhalte und ist nur für die Verwertung durch den vorgesehenen Empfänger bestimmt. Sollten Sie nicht der vorgesehene Empfänger sein, setzen Sie den Absender bitte unverzüglich in Kenntnis und löschen diese
E Mail. Hinweise zum Datenschutz finden Sie <a href="https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.datenschutz.schwarz%2F&data=05%7C01%7C%7Cdbcc4147df274982baff08dab590c98d%7Cd04f47175a6e4b98b3f96918e0385f4c%7C0%7C0%7C638021930711150089%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=eKucCbqueUYdNQXN4I9yy8eZIJqT5ajX8Yyvejoxf6o%3D&reserved=0" target="_blank">
hier</a>.<o:p></o:p></p>
</blockquote>
</div>
</div>
</div>
<p style="font-family:Calibri;font-size:11pt">Diese E Mail enthält möglicherweise vertrauliche Inhalte und ist nur für die Verwertung durch den vorgesehenen Empfänger bestimmt. Sollten Sie nicht der vorgesehene Empfänger sein, setzen Sie den Absender bitte
unverzüglich in Kenntnis und löschen diese E Mail. Hinweise zum Datenschutz finden Sie
<a href="https://www.datenschutz.schwarz">hier</a>.</p>
</body>
</html>