[R2.0-Build 12]: inconsistent behaviour when attach-detach security group from SI

[alok kumar]

when transparent firewall SI is launched then there is no (internal)security group "__no_rule__" attached to the instance.

but when I attach default SG and detach it again from SI, then SI has (internal)security group "__no_rule__" attached.

because of this it blocks all the traffic after detaching the default SG.

[Sachin Bansal (sbansal)]

Now that we can't pass any traffic in the absence of a security group, for transparent SI, we should create an allow-all internal SG and attach to it.

[Rudra Rugge (rrugge)]

This is invalid as it is not expected to attached security groups to transparent services. If the user does attach a security group then the control is with the user to manage the security groups from that point on like other regular VMs.

[Vedamurthy Joshi (vedujoshi)]

Rudra,
if the user attaches and detaches a SG, it should be the same as what he had earlier.

I think it would be incorrect for us to argue that once we attach a SG, all bets are off.

[Nagabhushana R (bhushana)]

Per the email discussion, it was decided that this might not be one of the top order bugs to fix right now, but we need to document this behavior. This still needs to be fixed.

[OpenContrail Admin (ci-admin-f)]

bug update...

[Rudra Rugge (rrugge)]

Service chain V2 does not need this support