Improved Security Group and Rule Creation

[Matt]

It would be nice if Horizon gave more flexibility around security group and rule creation. Adding them one at a time through the UI can be very tedious, and it doesn't seem like there's an easy way to take a security group you set up in one instance and use it in a different instance of OpenStack, other than manually recreating each piece of it. It might be useful to allow importing and exporting rule sets. If there are common sets of ports to open, perhaps we could offer prebuilt sets that users could then extend if needed or pull into existing security groups?

Just seems like there's more we could do in this area to make it easier to get the ports open that you need to, and ensure that those settings are portable. If someone has a test environment they're playing around with, and they then set up production OpenStack, is there a good way for them to pull those security groups they set up and tested from test/dev into prod currently?

I can't speak towards if that's a legitimate use case, but it seems reasonable to me.

[Eugene Nikanorov (enikanorov)]

I think this request doesn't affect neutron directly.
This seems like an improvement for Horizon only.
Removing neutron

[Ana Krivokapić (akrivoka)]

This feature request seems reasonable to me, however I think it makes sense to track it in a blueprint rather than a bug. Matt, would you mind opening a bp for it?

[Matt (mreid)]

Corresponding blueprint is https://blueprints.launchpad.net/horizon/+spec/horizon-improved-security-group-and-rule-creation

[Sean Dague (sdague)]

not a nova feature

[Julie Pichon (jpichon)]

Although it'd be nice to make security group rules creation/re-creation easier on CLI too, I think adding a simple import/export feature only to Horizon would be acceptable and a nice improvement to the user experience in this case, even if there's no direct API for it. It doesn't require Horizon to have storage, we can simply read the existing rules for export (kinda like we do for the CSV Usage Download, which isn't a direct API) and create them one by one using the usual APIs. End users can then share their rules for the common cases if they wish to.

[Rob Cresswell (robcresswell-deactivatedaccount)]

This would need to be a blueprint, not a bug.