ingress DHCP traffic to instances blocked without tenant secgroup rule

[Adam Gandelman]

Ingress traffic to tenant VMs from the router appliance is blocked by default by the tenant's security group. This also blocks DHCP traffic, causing tenant VMs failing to get their addresses. Our devstack plugin adds a security group rule [1] to deal with this, but its unrealistic to expect real world users to add these rules just to get a functional network setup. We need to open this traffic up automatically, either via astara-orchestrator or astara-neutron.

[1] https://git.openstack.org/cgit/openstack/astara/tree/devstack/plugin.sh#n325

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/266586

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/266586
Committed: https://git.openstack.org/cgit/openstack/astara-neutron/commit/?id=a1b3e6dd1a5336009c274083c2a25c2285d379e6
Submitter: Jenkins
Branch: master

commit a1b3e6dd1a5336009c274083c2a25c2285d379e6
Author: Mark McClain <email address hidden>
Date: Tue Jan 12 16:48:50 2016 -0500

    allow DHCP from router interfaces

    This fix adds the router interfaces as allowed source addresses for
    DHCP. This supports the Astara appliance case where DHCP is running
    within the same appliance providing routing.

    Change-Id: Ic4db49dc39a524b6c1557b9423496a1eb5d87843
    Closes-Bug:1531967

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/liberty
Review: https://review.openstack.org/272269

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/272269
Committed: https://git.openstack.org/cgit/openstack/astara-neutron/commit/?id=811a7e1467f74684b6e3dc6283a1d89cd101da85
Submitter: Jenkins
Branch: stable/liberty

commit 811a7e1467f74684b6e3dc6283a1d89cd101da85
Author: Adam Gandelman <email address hidden>
Date: Mon Jan 25 13:00:02 2016 -0800

    allow DHCP from router interfaces

    This fix adds the router interfaces as allowed source addresses for
    DHCP. This supports the Astara appliance case where DHCP is running
    within the same appliance providing routing.

    Backported from commit 1b3e6dd1a5336009c274083c2a25c2285d379e6

    Change-Id: Ic4db49dc39a524b6c1557b9423496a1eb5d87843
    Closes-Bug:1531967