lbaas security group

[Kevin Fox]

There seems to be no way of specifying which security group a lbaas vip gets. It looks to default to 'default' in Havana. When you place a load balancer on a backend private neutron network, it gets the security group member rules from 'default' which are for the wrong subnet.

Manually drilling down to find the port neutron port id, and then fixing the security_group on the vip port does seem to work.

There needs to be a way to specify the security groups when you create the vip.

[Michał Jastrzębski (inc007)]

Affects https://bugs.launchpad.net/heat/+bug/1295425

[Michał Jastrzębski (inc007)]

Any work is going on in this bug?

[Ethan Lynn (ethanlynn)]

Is there any patch for this ?

[P Ingle (pingle)]

This is observed in Kilo with LBaas V2 as well. Workaround of opening the default group works, but it may not be desired by the customer. This is a hole from security perspective.

[P Ingle (pingle)]

any work being done on this actively?

[German Eichberger (german-eichberger)]

We are looking to the community to propose patches...

[Jaume Devesa (devvesa)]

Sorry but no. I don't have too much time to dedicate to it... so feel free to assign yourself if you are interested.

[Dean Daskalantonakis (ddaskal)]

Hey Tyler, have you been able to make any progress on this defect? It's been plaguing our system lately as well even on Mitaka release.

[Tyler Britten (9-me-9)]

Not recently. Do you want to take a shot at it?

[Launchpad Janitor (janitor)]

[Expired for octavia because there has been no activity for 60 days.]