Merge "Rootwrap configuration should be owned by root"

tasks/nova_post_install.yml

@@ -13,12 +13,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- name: Copy nova config
+- name: Generate nova config
   config_template:
     src: "{{ item.src }}"
     dest: "{{ item.dest }}"
-    owner: "{{ nova_system_user_name }}"
-    group: "{{ nova_system_group_name }}"
+    owner: "{{ item.owner|default(nova_system_user_name) }}"
+    group: "{{ item.group|default(nova_system_group_name) }}"
     mode: "0644"
     config_overrides: "{{ item.config_overrides }}"
     config_type: "{{ item.config_type }}"
@@ -29,6 +29,8 @@
       config_type: "ini"
     - src: "rootwrap.conf.j2"
       dest: "/etc/nova/rootwrap.conf"
+      owner: "root"
+      group: "root"
       config_overrides: "{{ nova_rootwrap_conf_overrides }}"
       config_type: "ini"
     - src: "api-paste.ini.j2"
@@ -44,12 +46,12 @@
     - nova-config
     - nova-post-install
 
-- name: Generate nova config
+- name: Copy nova rootwrap filter config
   copy:
     src: "{{ item.src }}"
     dest: "{{ item.dest }}"
-    owner: "{{ nova_system_user_name }}"
-    group: "{{ nova_system_group_name }}"
+    owner: "root"
+    group: "root"
   with_items:
     - { src: "rootwrap.d/api-metadata.filters", dest: "/etc/nova/rootwrap.d/api-metadata.filters" }
     - { src: "rootwrap.d/baremetal-compute-ipmi.filters", dest: "/etc/nova/rootwrap.d/baremetal-compute-ipmi.filters" }

tasks/nova_pre_install.yml

@@ -59,9 +59,9 @@
     group: "{{ item.group|default(nova_system_group_name) }}"
     mode: "{{ item.mode|default('0755') }}"
   with_items:
-    - { path: "/openstack", mode: "0755", owner: "root", group: "root" }
+    - { path: "/openstack", owner: "root", group: "root" }
     - { path: "/etc/nova" }
-    - { path: "/etc/nova/rootwrap.d" }
+    - { path: "/etc/nova/rootwrap.d", owner: "root", group: "root" }
     - { path: "/etc/sudoers.d", mode: "0750", owner: "root", group: "root" }
     - { path: "/var/cache/nova" }
     - { path: "{{ nova_system_home_folder }}" }