Instance Creation Failing: "Could not open backing file"

Problem

• Instance creation is failing with the following error.

Could not open backing file: Could not open '/opt/pf9/data/instances/_base/[UUID]': Permission denied

• AppArmor is installed/enabled on the hypervisor.

Environment

• Platform9 Managed OpenStack - All Versions
• Nova
• Libvirt
• AppArmor

Cause

The default AppArmor profile for Libvirt does not include access to the instance storage path; thus, the I/O request is blocked.

Resolution

1. Append the following lines to the AppArmor configuration at /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper.

/opt/pf9/data/instances/_base/** r,  /opt/pf9/data/instances/** rw,

2. Parse the updated rules.

# apparmor_parser -r /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper

Additional Information

Debian – #892431 AppArmor denies access for libvirt to nova instances directory