In the context of my work, I'm looking to "enforce" some security groups settings onto all ports of a Network.
For a bit more context, we're configuring a network as external, so that it may provide network access to a service which is not managed by Openstack. We wanted, through this network, to allow only specific projects to access said service, with the following specificities:
- Open access to said service by default (behind a VIP, so essentially allowing traffic for a specific CIDR/mask)
- Prevent Each VM on this network from seeing each other, so that "exposing" the service to the VM does not inadvertently provide connectivity between the VMs (see RFE https://bugs.launchpad.net/neutron/+bug/2075958)
Opening traffic by default means that we need to somehow enforce the association of a SecurityGroup with all ports from a Network. As there is currently no such concept in Neutron, we thought of creating a SecurityGroupNetworkBinding, which would be included in all security-group related operations affecting a port (such as listing rules, listing security groups, etc); but could not be removed through the port.
As we have no existing mastery of the neutron code, from a bit of reading, we can surmise that this would invovle at least:
- Adding a new DB model and object for this new concept: SecurityGroupNetworkBinding
- Adding a new API to allow creating such binding
- Updating existing network APIs, where relevant for updates/removal of the SecurityGroupNetworkBindings
- Updating the ports APIs to include resolution of the network's bound SecurityGroups wherever useful (for listing security groups, rules, etc.; as we imagine that some of these are used by the agents to apply the flow controls reflecting the security group rules)
- Updating the client Libraries to expose new APIs
- Updating the client CLI plugin to expose new commands for this additional feature
- Updating whatever plugin which exposes the security-group and network bindings onto Horizon, and allows to control them
Of course, we're going to put in the work for this, as it's part of our priority items, hopefully as part of a neutron contribution, if we find a solution to this issue we can agree on.
Hi David,
Are you able to come to tomorrow's Neutron Drivers meeting to discuss this further? [0]
If so please add an item to the agenda.
My initial question was, "so this is like an admin setting a network SG that cannot be removed by tenants?"
[0] https:/