[juju-2.0-beta18] bootstrap --config use-default-secgroup=true not followed

[Heather Lanigan]

My bootstrap is failing for other reasons, but though I specified --config use-default-secgroup=true, juju named security groups are being deleted on failure. A default
security group exists and the juju created security groups are not deleted.

heather@ubuntu-maverick:~$ juju --debug bootstrap --metadata-source=/home/heather/simplestreams --config network=ubuntu-net --config use-floating-ip=true --config use-default-secgroup=true openstack maverick-os
17:35:28 INFO juju.cmd supercommand.go:63 running juju [2.0-beta18 gc go1.6.2]
17:35:28 DEBUG juju.cmd supercommand.go:64 args: []string{"juju", "--debug", "bootstrap", "--metadata-source=/home/heather/simplestreams", "--config", "network=ubuntu-net", "--config", "use-floating-ip=true", "--config", "use-default-secgroup=true", "openstack", "maverick-os"}
17:35:28 DEBUG juju.cmd.juju.commands bootstrap.go:477 provider attrs: map[use-default-secgroup:true network:ubuntu-net use-floating-ip:true]
17:35:29 INFO cmd cmd.go:141 Adding contents of "/home/heather/.local/share/juju/ssh/juju_id_rsa.pub" to authorized-keys
17:35:29 INFO cmd cmd.go:141 Adding contents of "/home/heather/.ssh/id_rsa.pub" to authorized-keys
17:35:29 DEBUG juju.cmd.juju.commands bootstrap.go:526 preparing controller with config: map[network:ubuntu-net use-floating-ip:true use-default-secgroup:true authorized-keys:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCaS/O0l3bA26BsQ0omDRZaKGYJ4Ihse+zIBYLIjvgU2ibqdM8lNwinrlbrQHWnh7zZqektRe+n8+Qp4agXqxmlL3IWKGNE81j0m8qalVfcUEV97frI/0WSjXQ8zniiA8GrG4QhgpR3U6J1Tzgy8jTXrw+MlUlK1EXdksP4Ur0Hd/+elS9z0qaUQdRt2fgwC2/cbD9lx7+gQt4i3AvQTlEMz4LKjANW0/E4T4jqYIgbZaBrHY+M5u6eWT+PtNYqXxElHsS898Go7KW4C2cmxiGilwYLs475jzxkExdZOchkjj5SZM6+CFu8JBBUk9EPxXRX1OtfKdJBK7ik1NGBWS8V juju-client-key
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9IwH/Kt/Dv6h+CbcXh1CEGzhlptdP0CCwbohAuhcecdNn8Jh6GnK1jpGUh+RAN2gAIPe+QQRZMlrovDMErqAcJULwfCYoZ70IKPnvyUPbWZKU1DI0GjVZc5QGqFMIdH4w6Mnc/d4eel+bAr+La1FUs2D8Tmef6U8822Tso4zRf0ssS8q928rLFcvXuK65XKFrjVyIbVdecnQNNO34PukxUa5IQH3sMtSjhkFRXMLg1EZcUsznzAL33EGcPcQTFgiFP0YLB8hL9R1k7fGoRVPpNCwAQ8Zm3QVBZennnonTlBNr0O43Ck2E3vm56QFBq1TaSbrUt7YMiztGDpBbWq+/ heather@ubuntu-maverick
 type:openstack name:controller uuid:c8dabce1-ac7e-4708-88fc-60bd4b569dab]
17:35:29 INFO juju.provider.openstack provider.go:76 opening model "controller"
17:35:29 DEBUG juju.provider.openstack cinder.go:484 endpoint "volumev2" not found for "RegionOne" region, trying "volume"
17:35:29 INFO cmd cmd.go:129 Creating Juju controller "openstack" on maverick-os/RegionOne
17:35:30 INFO juju.cmd.juju.commands bootstrap.go:669 combined bootstrap constraints:
17:35:30 DEBUG juju.environs.bootstrap bootstrap.go:185 model "controller" supports service/machine networks: false
17:35:30 DEBUG juju.environs.bootstrap bootstrap.go:187 network management by juju enabled: true
17:35:30 INFO juju.environs.bootstrap bootstrap.go:648 Setting default tools and image metadata sources: /home/heather/simplestreams
17:35:30 DEBUG juju.environs imagemetadata.go:46 new user image datasource registered: bootstrap metadata
17:35:30 INFO juju.environs.bootstrap bootstrap.go:674 custom image metadata added to search path
17:35:30 INFO cmd cmd.go:141 Loading image metadata
17:35:30 DEBUG juju.environs imagemetadata.go:112 obtained image datasource "bootstrap metadata"
17:35:30 DEBUG juju.environs imagemetadata.go:112 obtained image datasource "default cloud images"
17:35:30 DEBUG juju.environs imagemetadata.go:112 obtained image datasource "default ubuntu cloud images"
17:35:30 DEBUG juju.environs.bootstrap bootstrap.go:557 constraints for image metadata lookup &{{{RegionOne http://10.111.24.168:5000/v2.0} [win10 utopic win2008r2 win2012hv win2012r2 win2012hvr2 win2016 win2016nano win7 quantal raring trusty wily xenial win8 centos7 arch win81 yakkety precise saucy vivid win2012] [amd64 i386 armhf arm64 ppc64el s390x] released}}
17:35:30 DEBUG juju.environs.bootstrap bootstrap.go:569 found 1 image metadata in bootstrap metadata
17:35:32 DEBUG juju.environs.bootstrap bootstrap.go:569 found 0 image metadata in default cloud images
17:35:32 DEBUG juju.environs.simplestreams simplestreams.go:454 skipping index "http://cloud-images.ubuntu.com/releases/streams/v1/index.sjson" because of missing information: index file has no data for cloud {RegionOne http://10.111.24.168:5000/v2.0} not found
17:35:32 DEBUG juju.environs.bootstrap bootstrap.go:565 ignoring image metadata in default ubuntu cloud images: index file has no data for cloud {RegionOne http://10.111.24.168:5000/v2.0} not found
17:35:32 DEBUG juju.environs.bootstrap bootstrap.go:573 found 1 image metadata from all image data sources
17:35:33 INFO cmd cmd.go:129 Looking for packaged Juju agent version 2.0-beta18 for amd64
17:35:33 INFO juju.environs.bootstrap tools.go:72 looking for bootstrap agent binaries: version=2.0-beta18
17:35:33 INFO juju.environs.tools tools.go:101 finding agent binaries in stream "devel"
17:35:33 INFO juju.environs.tools tools.go:103 reading agent binaries with major.minor version 2.0
17:35:33 INFO juju.environs.tools tools.go:111 filtering agent binaries by version: 2.0-beta18
17:35:33 INFO juju.environs.tools tools.go:117 filtering agent binaries by architecture: amd64
17:35:33 DEBUG juju.environs.tools urls.go:109 trying datasource "keystone catalog"
17:35:33 INFO juju.environs.bootstrap tools.go:74 found 0 packaged agent binaries
17:35:33 INFO cmd cmd.go:129 No packaged binary found, preparing local Juju agent binary
17:35:33 DEBUG juju.environs.sync sync.go:302 Making agent binary tarball
17:35:33 DEBUG juju.environs.tools build.go:126 looking for: juju
17:35:33 DEBUG juju.environs.tools build.go:165 checking: /usr/bin/jujud
17:35:33 INFO juju.environs.tools build.go:171 Found agent binary to upload (/usr/bin/jujud)
17:35:33 INFO juju.environs.tools build.go:181 target: /tmp/juju-tools267934498/jujud
17:35:33 DEBUG juju.environs.tools build.go:254 forcing version to 2.0-beta18.1
17:35:33 DEBUG juju.environs.tools build.go:42 adding entry: &tar.Header{Name:"FORCE-VERSION", Mode:436, Uid:0, Gid:0, Size:12, ModTime:time.Time{sec:63610004133, nsec:213160892, loc:(*time.Location)(0x39e38c0)}, Typeflag:0x30, Linkname:"", Uname:"ubuntu", Gname:"ubuntu", Devmajor:0, Devminor:0, AccessTime:time.Time{sec:63610004133, nsec:213160892, loc:(*time.Location)(0x39e38c0)}, ChangeTime:time.Time{sec:63610004133, nsec:213160892, loc:(*time.Location)(0x39e38c0)}, Xattrs:map[string]string(nil)}
17:35:33 DEBUG juju.environs.tools build.go:42 adding entry: &tar.Header{Name:"jujud", Mode:493, Uid:0, Gid:0, Size:105673576, ModTime:time.Time{sec:63610004133, nsec:169161676, loc:(*time.Location)(0x39e38c0)}, Typeflag:0x30, Linkname:"", Uname:"ubuntu", Gname:"ubuntu", Devmajor:0, Devminor:0, AccessTime:time.Time{sec:63610004133, nsec:169161676, loc:(*time.Location)(0x39e38c0)}, ChangeTime:time.Time{sec:63610004133, nsec:169161676, loc:(*time.Location)(0x39e38c0)}, Xattrs:map[string]string(nil)}
17:35:41 INFO juju.environs.sync sync.go:333 using agent binary 2.0-beta18-xenial-amd64 aliased to 2.0-beta18.1-xenial-amd64 (21375kB)
17:35:41 DEBUG juju.provider.openstack cinder.go:484 endpoint "volumev2" not found for "RegionOne" region, trying "volume"
17:35:41 INFO cmd cmd.go:141 Starting new instance for initial controller
Launching controller instance(s) on maverick-os/RegionOne...
17:35:42 DEBUG juju.environs.instances image.go:64 instance constraints {region: RegionOne, series: xenial, arches: [amd64], constraints: , storage: []}
17:35:42 DEBUG juju.environs.instances image.go:70 matching constraints {region: RegionOne, series: xenial, arches: [amd64], constraints: , storage: []} against possible image metadata [{Id:498d85cb-6fd2-402b-a678-9dde561ffd26 Arch:amd64 VirtType:}]
17:35:42 INFO juju.environs.instances image.go:106 find instance - using image with id: 498d85cb-6fd2-402b-a678-9dde561ffd26
17:35:42 DEBUG juju.cloudconfig.instancecfg instancecfg.go:782 Setting numa ctl preference to false
17:35:42 DEBUG juju.service discovery.go:62 discovered init system "systemd" from series "xenial"
17:35:42 DEBUG juju.provider.openstack provider.go:893 openstack user data; 1154 bytes
17:35:43 DEBUG juju.provider.openstack provider.go:902 using network id "f181bea7-d967-42c0-b31e-bf01d0831291"
17:35:43 DEBUG juju.provider.openstack provider.go:908 allocating public IP address for openstack node
17:35:43 DEBUG juju.provider.openstack provider.go:767 found unassigned public ip: 10.99.0.7
17:35:43 INFO juju.provider.openstack provider.go:913 allocated public IP 10.99.0.7
17:35:47 INFO juju.provider.openstack provider.go:1001 started instance "c229b1d1-3877-488b-8113-c97fe1a2fb7e"
17:35:50 INFO juju.provider.openstack provider.go:1011 assigned public IP 10.99.0.7 to "c229b1d1-3877-488b-8113-c97fe1a2fb7e"
 - c229b1d1-3877-488b-8113-c97fe1a2fb7e
17:35:50 INFO juju.environs.bootstrap bootstrap.go:587 newest version: 2.0-beta18.1
17:35:50 INFO juju.environs.bootstrap bootstrap.go:602 picked bootstrap tools version: 2.0-beta18.1
17:35:50 DEBUG juju.provider.openstack cinder.go:484 endpoint "volumev2" not found for "RegionOne" region, trying "volume"
17:35:50 INFO juju.environs.bootstrap bootstrap.go:378 Installing Juju agent on bootstrap instance
17:35:52 INFO cmd cmd.go:129 Fetching Juju GUI 2.1.10
17:35:52 DEBUG juju.cloudconfig.instancecfg instancecfg.go:782 Setting numa ctl preference to false
Waiting for address
17:36:07 INFO juju.provider.common destroy.go:20 destroying model "controller"
17:36:07 INFO juju.provider.common destroy.go:31 destroying instances
17:36:08 DEBUG juju.provider.openstack provider.go:1037 terminating instances []
17:36:08 INFO juju.provider.common destroy.go:51 destroying storage
17:36:08 DEBUG juju.provider.openstack firewaller.go:282 deleting security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:36:11 DEBUG juju.provider.openstack firewaller.go:293 waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:36:15 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:36:19 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:36:23 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:36:27 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:36:31 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:36:35 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:36:37 WARN juju.provider.openstack firewaller.go:305 cannot delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab". Used by another model?
17:36:37 DEBUG juju.provider.openstack firewaller.go:282 deleting security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:36:40 DEBUG juju.provider.openstack firewaller.go:293 waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:36:44 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:36:48 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:36:52 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:36:56 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:37:00 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:37:04 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:37:06 WARN juju.provider.openstack firewaller.go:305 cannot delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0". Used by another model?
17:37:07 DEBUG juju.provider.openstack firewaller.go:282 deleting security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:37:10 DEBUG juju.provider.openstack firewaller.go:293 waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:37:14 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:37:18 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:37:22 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:37:26 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:37:30 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:37:34 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab"
17:37:36 WARN juju.provider.openstack firewaller.go:305 cannot delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab". Used by another model?
17:37:36 DEBUG juju.provider.openstack firewaller.go:282 deleting security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:37:39 DEBUG juju.provider.openstack firewaller.go:293 waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:37:43 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:37:47 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:37:51 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:37:55 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:37:59 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:38:03 DEBUG juju.provider.openstack firewaller.go:293 still waiting to delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0"
17:38:05 WARN juju.provider.openstack firewaller.go:305 cannot delete security group "juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0". Used by another model?
17:38:05 ERROR cmd supercommand.go:458 failed to bootstrap model: refreshing addresses: instances not found
17:38:05 DEBUG cmd supercommand.go:459 (error details: [{github.com/juju/juju/cmd/juju/commands/bootstrap.go:738: failed to bootstrap model} {refreshing addresses: instances not found}])

heather@ubuntu-maverick:~$ juju version
2.0-beta18-xenial-amd64

(openstack) security group list
+--------------------------------------+----------------------------------------------------------------------------------+------------------------+----------------------------------+
| ID | Name | Description | Project |
+--------------------------------------+----------------------------------------------------------------------------------+------------------------+----------------------------------+
| 0b23b3ff-af46-488a-b281-2bfad21693c5 | juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab-0 | juju group | 85236882e12f47b2aae5914e3ffb6736 |
| 37c9c46c-28c4-40a5-832c-9b834c6f5013 | juju-44581449-7145-447f-8760-7ea921218da8-c8dabce1-ac7e-4708-88fc-60bd4b569dab | juju group | 85236882e12f47b2aae5914e3ffb6736 |
| 686fbb04-001d-4055-a2fe-e2c6a79c9535 | default | Default security group | 85236882e12f47b2aae5914e3ffb6736 |
+--------------------------------------+----------------------------------------------------------------------------------+------------------------+----------------------------------+

[Anastasia (anastasia-macmood)]

This may affect rackspace provider too as 'use-default-secgroup' exists in rackspace provider code as well.

[Anastasia (anastasia-macmood)]

Marking as Won't Fix for 2.0.x as no further 2.0.x releases are planned.

[Heather Lanigan (hmlanigan)]

Looking at this bug with more experience, I'm wondering if this is a case of not fully understanding what the flag is used for. Or, it's been fixed.

I recently did a bootstrap with juju 2.2-beta2 using --config use-default-secgroup=true and the
default security group was added to the nova instance along with the security groups for the juju model and the juju machine.

$ juju bootstrap --config use-default-secgroup=true --metadata-source /home/heather/simplestreams --config network=ubuntu-net --config use-floating-ip=true local-openstack bug-check
Creating Juju controller "bug-check" on local-openstack/RegionOne
Looking for packaged Juju agent version 2.2-beta2 for amd64
No packaged binary found, preparing local Juju agent binary
Launching controller instance(s) on local-openstack/RegionOne...
 - c8e26745-76b5-419f-a927-7e58e8afc1f3 (arch=amd64 mem=4G cores=2)
....
$ nova show c8e26745-76b5-419f-a927-7e58e8afc1f3
...
| security_groups | default, juju-72deb1dc-207d-443f-80b4-af60eb3d8564-9eb3caae-5490-4e84-882b-efd5c6209f53, juju-72deb1dc-207d-443f-80b4-af60eb3d8564-9eb3caae-5490-4e84-882b-efd5c6209f53-0 |
...

[Bruno Carvalho (brunowcs)]

Hi Heather!

I had the same behavior in my environment, how should it work?

[John A Meinel (jameinel)]

Use default means to include the default group. Not use it instead of a per
model group.

John
=:->

On May 4, 2017 09:59, "Bruno Carvalho" <email address hidden> wrote:

> Hi Heather!
>
> I had the same behavior in my environment, how should it work?
>
> --
> You received this bug notification because you are subscribed to juju.
> Matching subscriptions: juju bugs
> https://bugs.launchpad.net/bugs/1625830
>
> Title:
> [juju-2.0-beta18] bootstrap --config use-default-secgroup=true not
> followed
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/charm-test-infra/+bug/1625830/+subscriptions
>

[Heather Lanigan (hmlanigan)]

Perhaps we can update the current description of the flag:
`Whether new machine instances should have the "default" Openstack security group assigned.`
to clarify.

Suggestion:
`Whether new machine instances should have the "default" Openstack security group assigned in addition to juju defined security groups.`

[Bruno Carvalho (brunowcs)]

I agree with Healther!

[Heather Lanigan (hmlanigan)]

https://github.com/juju/juju/pull/7307

[Heather Lanigan (hmlanigan)]

the PR has been merged.

[Heather Lanigan (hmlanigan)]

Closing this bug as invalid.

The PR to update the use-default-secgroup has been merged. Plans are in place to add details to the juju documentation as well as find a place in the juju cli to display the provider specific configuration options.