In Havana neutron, there is a _get_security_groups_on_port(...) which checks that all security groups on port belong to tenant. This method is called every time a port is created. This method calls get_security_groups(...) and with 'service' tenant, this results in getting security groups of all tenants from the database, which is time consuming if there are hundreds of tenants. get_security_groups(...) then applies filter on the security groups returned from db query to select security groups associated with the port. In our environment with around 700 tenants, we saw this method take > 30 seconds and also cause slowdown of other API request processing on this worker instance. This can be made more efficient by supplying 'id' filter so that the database query itself filters on the tenant-id. In our environment, this patch resulted in the method taking 0.1 seconds, down from 30 seconds.
Fix proposed to branch: master
Review: https:/