Unable to apply a single security group to port

[Ben Nemec]

When I try to apply a single security group to a port, Quantum returns an error from the request. This is because the client passes a single security group as a string instead of a list, and Quantum tries to treat the string as a list. I have a fix for this, which will be submitted soon.

Example:

ubuntu@quantum:/opt/stack/quantum$ quantum port-update efdffe3c-c64c-466e-9f51-b70f3c9e95e6 --security_groups 057337f8-ea28-4aa8-b5d0-c35f9007d66f
Namespace(id='efdffe3c-c64c-466e-9f51-b70f3c9e95e6', no_security_groups=False, request_format='json')
Invalid input for operation: '0' is not an integer or uuid.

[Nachi Ueno (nati-ueno)]

Could you try this one? list=true is needed
quantum port-update efdffe3c-c64c-466e-9f51-b70f3c9e95e6 --security_groups list=true 057337f8-ea28-4aa8-b5d0-c35f9007d66f

[dan wendlandt (danwent)]

from a usability perspective, having to specify list=true is pretty crappy.

I like the approach take by nova when you specify nics, which is that if you need multiple nics, you specify --nic multiple times.

[Ben Nemec (bnemec)]

Yes, list=true does fix the problem. Passing the security group id twice (e.g. --security_groups 057337f8-ea28-4aa8-b5d0-c35f9007d66f 057337f8-ea28-4aa8-b5d0-c35f9007d66f) also works around the problem.

However, a simple change will allow Quantum to handle it without any fuss. I'm just not cleared to submit it by our legal department so I have to find someone else here to do it for me. :-)

[Nachi Ueno (nati-ueno)]

+1 for that usability change

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/25644

[Mark McClain (markmcclain)]

This is a bug in the client and not in the server. Adding the client project and dropping the server from the bug.

[Akihiro Motoki (amotoki)]

I think it is better to add an "--security-group" option to the client.
This option can be specified multiple times if you want to associate multiple security groups with the port.

$ quantum port-update --security-group sg1 $port_id
$ quantum port-update --security-group sg1 --security-group sg2 $port_id

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/25716

[Ben Nemec (bnemec)]

Hi Akihiro,

Would you be willing to restore this change? Hopefully it will get more love from the core reviewers now that the summit is over. :-)

Thanks.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/25716
Committed: http://github.com/openstack/python-neutronclient/commit/bc99eca8cd30e9224d98df2b47a89941fd959aae
Submitter: Jenkins
Branch: master

commit bc99eca8cd30e9224d98df2b47a89941fd959aae
Author: Akihiro MOTOKI <email address hidden>
Date: Fri Mar 29 23:33:38 2013 +0900

    Add --security-group option to port-update

    port-update --security_groups list=true ... is not user-friendly.

    bug 1161078

    This commit also changes the followings:
    - Add --no-security-groups options to port-create for consistency.
    - Make --security-group and --no-security-groups mutual-exclusive
      to prevent both options specified at the same time.

    Change-Id: Ibfe165a0cbdfb0eb582784c80a3371de33108fdb