Couldn't run instance with existing port when default security group is absent

[Feodor Tersin]

If default security group in tenant is deleted (admin has appropriate permissions) then launching an instance with Neutron port fails at allocate network resources stage:

ERROR nova.compute.manager [-] Instance failed network setup after 1 attempt(s)
TRACE nova.compute.manager Traceback (most recent call last):
TRACE nova.compute.manager File "/opt/stack/nova/nova/compute/manager.py", line 1528, in _allocate_network_async
TRACE nova.compute.manager dhcp_options=dhcp_options)
TRACE nova.compute.manager File "/opt/stack/nova/nova/network/neutronv2/api.py", line 294, in allocate_for_instance
TRACE nova.compute.manager security_group_id=security_group)
TRACE nova.compute.manager SecurityGroupNotFound: Security group default not found.

Steps to reproduce:
0. Delete the default security group with admin account.
1. Create custom security group
2. Create a network and a subnet
3. Create a port in the subnet with the custom security group
4. Launch an instance with the port (and don't specify any security group)

Launch command is accepted successfully, but 'nova show' command returns the instance in error state.

[ugvddm (271025598-9)]

Hi Feodor,

I can't reproduce your issue in my devstack , what's your openstack version?

[Feodor Tersin (ftersin)]

Hi

I got it in Icehouse. Now i've not reproduced it in my local devstack (between juno-3 and juno-rc1).

Though some features in source code still lead to the error (_create_instance in compute/api.py still adds 'default' group if no group s passed, and allocate_for_instance in network/newtronv2/api.py still raise the exception if any of passed groups doesn't exist), the steps mentioned above don't lead to the error. An instance is launched successfully.

The reason is that a new default group is created at once when existed one is deleted.
Try to list security groups after deleting default group. You'll find a new one.

Thus this bug isn't actual for modern OS versions.

[ugvddm (271025598-9)]

yes it is, I have found your said that we can't delete the defualt group, thus we should change it to "invalid".