[RFE] Add ability to see what devices use a certain security group

[Sam Morrison]

Given a security group ID I would like an API to determine which devices (nova instances) use this security group.

Currently the only way to do this is by looking in the database and doing some SQL on the securitygroupportbindings table.

[Armando Migliaccio (armando-migliaccio)]

Looking at the DB is not strictly needed. You could perform this query:

neutron port-list --device_owner compute:None -c device_id -c security_groups

e.g.

+--------------------------------------+-------------------------------------------+
| device_id | security_groups |
+--------------------------------------+-------------------------------------------+
| fac356fd-1ead-4601-98c8-dd1e5dd026a2 | [u'4a3a6c03-463c-4f1e-89e6-758a8ce2d18d'] |
| 6cbb2ee1-78bf-4c30-ac8b-f4567768b0ed | [u'325dee58-4a20-404e-9c45-1c1e9d22b3af'] |
| 62d647d0-ed91-4013-8339-bc0ff03ba14d | [u'4a3a6c03-463c-4f1e-89e6-758a8ce2d18d'] |
+--------------------------------------+-------------------------------------------+

And then filter client side by the security groups you care about.

Would that suffice?

[Armando Migliaccio (armando-migliaccio)]

Waiting for feedback from the submitter. Filtering by security groups via the API should be possible by adding security_group_id, but it doesn't seem to work for me so we possibly have to track it as a bug rather than an RFE.

[Armando Migliaccio (armando-migliaccio)]

BTW that's the bug I was referring to in #2:

https://bugs.launchpad.net/neutron/+bug/1405057

[Sam Morrison (sorrison)]

We have over 10,000 ports so filtering on client side is pretty hard

[Armando Migliaccio (armando-migliaccio)]

Then we need to reopen bug 1405057 and close this one as duplicate. Would you agree?