Recently the ironic-conductor image was modified to load the iscsi_tcp kernel module on startup to resolve bug 1667864. This change was applied to master and back ported to stable/ocata *after* the 4.0.0 release. That change introduced bug 1676466 which affects binary images due to the lack of a sudoers entry for the modprobe.
While the merged fix (https://review.openstack.org/#/c/450274) for bug 1676466 should resolve the issue, it adds unnecessary sudoers entries to the ironic-base image. There are two minor issues here.
1) The change reuses the sudoers file for the source build, which also provides a rootwrap entry referencing the kolla virtualenv which should not exist in the binary image.
2) The modprobe sudoers entry is required only in the ironic-conductor image, and not ironic-base or its other child images.
I think that the correct fix is to separate the modprobe iscsi_tcp bits into a separate sudoers file used by both source and binary builds in the ironic-conductor image (not ironic-base), then move the existing sudoers file in ironic-base back to just the source build.
Fix proposed to branch: master
Review: https:/