metadata/service/file_permissions.yml

parameters:
  cinder:
    directories:
      /etc/cinder:
        user: 'root'
    files:
      /etc/cinder/rootwrap.conf:
        mode: '0640'
        group: 'cinder'
      /etc/cinder/api-paste.ini:
        user: 'root'