[RFE] Implement migration from iptables-based security groups to ovsfw

[John Schwarz]

When switching an ovs-agent from iptables to ovsfw, new instances will be created using the ovsfw, but old instances will stick with iptables. In fact, there isn't a way to migrate an instance from iptables to ovsfw, and one should be provided.

Considerations:
a. It isn't enough to just remove the qvo/qvb/qbr interfaces and then attach the tap device directly to the integration bridge - we should also change the domain xml of the instance itself, so that when migrating an instance from one compute node to the other, nova won't depend on non-existent devices. Should this be done in Nova or in Neutron? Should Nova be notified?
b. On Neutron side, we should also change the Port table to indicate a change. This might require a new RPC call from the agent side.

[Kevin Benton (kevinbenton)]

This bug has had a related patch abandoned and has been automatically un-assigned due to inactivity. Please re-assign yourself if you are continuing work or adjust the state as appropriate if it is no longer valid.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Kevin Benton (<email address hidden>) on branch: master
Review: https://review.openstack.org/413082
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Armando Migliaccio (armando-migliaccio)]

I suppose if we are ever going to mark OVS Firewall as the default firewall in the future, we need to come to an agreement on what we're going to do for existing deployments.

[Kevin Benton (kevinbenton)]

Marking this as postponed for now. Let's focus on getting live migration between firewall types to work.

[Kevin Benton (kevinbenton)]

We can revisit once we want to deprecate the hybrid driver.