Add PowerFlex connector configuration support via system-files plug

[jproque-dell]

Add PowerFlex connector configuration support via system-files plug

Summary

Add a system-files plug to allow the nova-compute service to read the Dell PowerFlex connector configuration file required for legacy PowerFlex volume attachments in Sunbeam deployments.

Problem

Legacy versions of Dell PowerFlex (prior to OpenStack 2025.2) require the Nova compute service to read connector credentials from a fixed path on each compute host: /opt/emc/scaleio/openstack/connector.conf

The strictly confined openstack-hypervisor snap does not currently expose this host path, preventing PowerFlex volume attachments from working with Sunbeam deployments.

Solution

Add a narrowly scoped system-files plug that grants read-only access to the specific configuration file and assign it to the nova-compute application.

Changes

Add system-files plug declaration

After the existing etc-driverctl plug in the plugs: section:

  powerflex-connector-config:
    interface: system-files
    read:
    - /opt/emc/scaleio/openstack/connector.conf

Assign plug to nova-compute

Add the new plug to the nova-compute application's plugs list:

nova-compute:
  command: 'bin/nova-compute-service'
  after: [libvirtd]
  daemon: simple
  plugs:
    - network
    - network-bind
    - network-control
    - ovn-chassis
    - firewall-control
    - hardware-observe
    - kvm
    - microstack-support
    - block-devices
    - iscsi-initiator
    - dm-multipath
    - process-control
    - mount-observe
    - nvme-control
    - powerflex-connector-config

Security Considerations

• Read-only access: The plug only grants read permission, not write access
• Specific file: Access is restricted to the exact file path, not the entire directory
• Minimal scope: The plug is only assigned to nova-compute, not globally to all snap applications
• Sensitive data: The file contains PowerFlex credentials, so host administrators should ensure proper file permissions (chmod 600)

Additional Notes

This change is required for PowerFlex versions prior to OpenStack 2025.2

• Starting with OpenStack 2025.2, the connector configuration file is no longer required for new attachments
• The file must still be retained for legacy attached volumes until they are fully detached
• This follows the same pattern as the existing etc-driverctl system-files plug in the snap
• The system-files interface may require Snap Store approval for the /opt/emc/scaleio/openstack/connector.conf path in production deployments

Assisted-by: Devin (Claude)