metadata/service/file_permissions.yml

parameters:
  nova:
    directories:
      /etc/nova:
        user: 'root'
    files:
      /etc/nova/nova.conf:
        user: 'root'
      /etc/nova/rootwrap.conf:
        mode: '0640'
        group: 'nova'
      /etc/nova/api-paste.ini:
        user: 'root'