I am moving this bug back to assign because we found out that selinux prevents reading /run/libvirt. See the log bellow. A new fix would add "z" option to the original "ro". type=AVC msg=audit(1661320143.727:562520): avc: denied { write } for pid=669402 comm="ceilometer-poll" name="virtqemud-sock-ro" dev="tmpfs" ino=93846 scontext=system_u:system_r:container_t:s0:c526,c1012 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=sock_file permissive=0
Upstream change after further testing by Yadnesh, Leonid, and myself has been proposed at https://review.opendev.org/c/openstack/tripleo-heat-templates/+/854421 Once merged, will begin the backport process for both upstream and downstream. New target to have this resolved is now RHOSP 17.0 z1 with a Known Issue release note being added here to inform others of this issue. Once merged to master upstream is completed, I will begin the process of backporting the fix to 17.0, 16.2, and 16.1 for their next respective releases.
Per discussion on IRC with Takashi and others, it looks like there is some work that would happen outside of ceilometer-agent-compute itself to allow the proper SELinux permissions and access to the files required without triggering a full relabel of the path via the 'z' flag for the bind mount of the containers volume. Tracking dependency for this issue is now at https://bugzilla.redhat.com/show_bug.cgi?id=2122656 and I will likely abandon my change request. I will likely want to revert the change upstream from 'shared' to 'ro' but I will check with others before proposing.
No permission denied errors. from ceilometer-agent-compute-container-puppet.yaml - /run/libvirt:/run/libvirt:shared,z
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Red Hat OpenStack Platform 17.0.1 bug fix and enhancement advisory), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:0271