security-groups sometimes don't get applied

[Andreas Hasenack]

This is a placeholder bug against odl-controller with not many details yet.

When doing OpenStack deployments with ODL, we have observed that sometimes the specified security group rules do not take effect. The groups show as applied in the nova show output, but their rules not.

For example, I launched two instances with the same security groups that allowed SSH in, but I could connect only to one of them.

In another case, I launched 10 instances, and I could connect to all of them.

I could login on the console and reach out to the internet, though, so it wasn't a general networking problem.

I tried with both odl 0.2.3 and 0.2.4. The 0.3.x series was not attempted as that needs charm work.

[James Page (james-page)]

I've dug into this a bit with the latest SR release for Helium; right now Lithium is non-functional with OpenStack Liberty, so I've parked a major version upgrade for now.

Whether security-groups are functional or not in ODL appears to be a little grey AFAICT - I've asked an upstream contact to confirm what the current state of this feature is and then we can make a decision on whether this can be fixed or not.

[James Page (james-page)]

/next now how support for lithium using a new profile, but still seeing problems with security groups.

[James Page (james-page)]

Updates:

Tried with new BE release on trusty - secgroups still not being applied.

Also tried with mitaka on xenial - still no secgroup application for instances.