security groups are not attached to an instance if port-id is specified during boot

[Oleg Bondarev]

Creation of server with command
‘nova boot --image <image> --flavor m1.medium --nic port-id=<port-id> --security-groups <sec_grp> <name>’
fails to attach the security group to the port/instance. The response payload has the security group added but only default security group is attached to the instance.
Separate action has to be performed on the instance to add sec_grp, and it is successful. Supplying the same with ‘--nic net-id=<net-id>’ works as expected

[Sean Dague (sdague)]

Oleg, do you know if this if is falling down in novaclient or on the nova side? I see you have assigned it to yourself, so I'm assuming you are going to dive deeper into this one.

[Oleg Bondarev (obondarev)]

Sean, this is a nova side issue. I have a fix, will add a unit test and submit the fix later today

[Simon Pasquier (simon-pasquier)]

This "behavior" exists for a long time. It was already spotted in the Heat project (see http://git.openstack.org/cgit/openstack/heat/commit/?id=5c5e36de3737a85bec5023c94265e6bbaf6ad78e). At that time, it was decided to take a defensive approach in Heat and let Nova intact.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/124059

[Phil Day (philip-day)]

I think the expectation is that if a user is already interaction with Neutron to create ports then they should do the security group assignment in Neutron as well.

The trouble I see with supporting this way of assigning security groups is what should the correct behavior be if the user passes more than one port into the Nova boot command ? In the case where Nova is creating the ports it kind of feels (just) Ok to assign the security groups to all the ports. In the case where the ports have already been created then it doesn’t feel right to me that Nova modifies them.

[Oleg Bondarev (obondarev)]

Link to the ML discussion: http://lists.openstack.org/pipermail/openstack-dev/2014-September/047225.html

[OpenStack Infra (hudson-openstack)]

Change abandoned by Sean Dague (<email address hidden>) on branch: master
Review: https://review.openstack.org/124059
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/124059
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=d8cafb9a6efb95b78609aca8fcb3532c33a1788f
Submitter: Jenkins
Branch: master

commit d8cafb9a6efb95b78609aca8fcb3532c33a1788f
Author: Oleg Bondarev <email address hidden>
Date: Thu Sep 25 13:32:53 2014 +0400

    Raise if sec-groups and port id are provided on boot

    Currently in case port_id is provided on instance boot
    security groups parameter is ignored. Need to clearly state
    that specifying both parameters is not allowed and that Neutron
    should be used for configuring security groups on port

    Closes-bug: #1373774

    Change-Id: I701faba1b37a7106cf86f7abf8e55f7289e1ff3b

[Matt Riedemann (mriedem)]

Note that this was reverted:

https://review.openstack.org/#/c/151184/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/154068

[OpenStack Infra (hudson-openstack)]

Change abandoned by Michael Still (<email address hidden>) on branch: master
Review: https://review.openstack.org/154068
Reason: This patch has been stalled for quite a while, so I am going to abandon it to keep the code review queue sane. Please restore the change when it is ready for review.