nova show output should display sec-group id instead of name

[rampradeep]

As nova security-group-create allowing more than one group with the same name. showing security-group name in nova show is not correct

I have two security groups with name default.

ram@ubuntu:~$ neutron security-group-list
+--------------------------------------+---------+-------------+
| id | name | description |
+--------------------------------------+---------+-------------+
| 2d3d1914-32d1-451f-b4bc-ed5eeda398ee | default | default |
| c2d19dea-0863-40d5-872c-543f97b00bd4 | default | default |
+--------------------------------------+---------+-------------+

In this case, I did not specify any security group while spawning the instance. I do not know how nova boot picks the default security group but nova show displays "default" in the security group.

ram@ubuntu:~$ nova show first
+--------------------------------------+----------------------------------------------------------------+
| Property | Value |
+--------------------------------------+----------------------------------------------------------------+
| OS-DCF:diskConfig | MANUAL |
| OS-EXT-AZ:availability_zone | nova |
| OS-EXT-SRV-ATTR:host | ubuntu |
| OS-EXT-SRV-ATTR:hypervisor_hostname | ubuntu |
| OS-EXT-SRV-ATTR:instance_name | instance-00000001 |
| OS-EXT-STS:power_state | 1 |
| OS-EXT-STS:task_state | - |
| OS-EXT-STS:vm_state | active |
| OS-SRV-USG:launched_at | 2014-11-19T18:42:00.000000 |
| OS-SRV-USG:terminated_at | - |
| accessIPv4 | |
| accessIPv6 | |
| config_drive | |
| created | 2014-11-19T18:41:15Z |
| flavor | m1.tiny (1) |
| hostId | 4ac39bb970bb90f0aca2efaca1f43cc2997f6550a1449f08ade677af |
| id | 8f7eb319-8f5d-46c2-bb1f-6a16838ef7b1 |
| image | cirros-0.3.2-x86_64-uec (90aa74a4-138a-4a1a-a530-aa1cd4ee5e05) |
| key_name | - |
| metadata | {} |
| name | first |
| os-extended-volumes:volumes_attached | [] |
| private network | 10.0.0.2 |
| progress | 0 |
| security_groups | default | ---------------------------> security group
| status | ACTIVE |
| tenant_id | e747bc1a96ea4d88a0ddf7b2df8e0ad8 |
| updated | 2014-11-19T18:42:01Z |
| user_id | 31a22dcf6b0a437294cb6c10f2996e08 |
+--------------------------------------+----------------------------------------------------------------+

It leads to confusion in getting the security group id used by the instance..

[Sai Kiran (saikiran)]

I am unable to reproduce the issue in my environment.

Nova is not allowing us to create two security groups with the same name "default".

Also I tried on multiple tenants, even in that case each tenant has its own security groups and its own rules.

[rampradeep (ram-nalluri)]

Sai,

Try as an admin, you can see default security groups of all the tenants, as shown below.

root@icontroller:~# neutron security-group-list

+--------------------------------------+---------+-------------+
| id | name | description |
+--------------------------------------+---------+-------------+
| 4b349b5e-cf24-43ff-8930-4bb595f93fd2 | default | default |
| 78b3d735-950e-49b8-85e4-1fdb1ebdd241 | default | default |
| 9ca75d7c-eafa-4580-9d22-ba71701b7f90 | default | default |
+--------------------------------------+---------+-------------+

[Sushma Korati (sushma-korati)]

I guess updating nova show's output to display security group uuid, intsead of name will be sufficient?

Although neutron security-group-list displays all the available security groups for all user,
nova client shows details of security group created by that user only.

Cmd output:
----------
root@controller:~# nova secgroup-list
+--------------------------------------+---------+-------------+
| Id | Name | Description |
+--------------------------------------+---------+-------------+
| 8e5c53c3-bba4-4a86-a80a-fe178425a8d6 | default | default |
+--------------------------------------+---------+-------------+

root@controller:~# neutron security-group-list
+--------------------------------------+---------------+--------------------+
| id | name | description |
+--------------------------------------+---------------+--------------------+
| 028e0670-362d-43c8-b8b1-cf4d8d4c1b9d | default | default |
| 8e5c53c3-bba4-4a86-a80a-fe178425a8d6 | default | default | ------------------> default security group of current user
| 0f5728c1-5bc5-49d1-942f-68aa3ace4748 | naresh-puppet | for gui |
| 127ecf8c-61a9-4825-a639-bb67bb84c776 | default | default |
| 285f4df5-3ec6-4922-962f-f9ba0b925b00 | default | default |
| 2fac4340-820a-4556-a984-8e5424d83c01 | default | default |

So updating the nova client to display the UUID would be helpful here.

[melanie witt (melwitt)]

Nova-network doesn't allow duplicate security group names, but neutron does. That's why only names are returned (precedent by nova-network). In the future, we should change/add to the api to include ids in nova, maybe via the microversioning capability.

[melanie witt (melwitt)]

Adding novaclient as a workaround can be included there, to make an extra api call to the security groups api to get ids to show with the server.

[melanie witt (melwitt)]

I opened https://bugs.launchpad.net/nova/+bug/1438338 for the nova wishlist piece.

[Park (jianlonghei)]

novaclient should cooperate with nova api to display "name" or "id" when the nova show, at this moment, nova api returns "name" only to novaclient. So I think nova api should be involved.

[melanie witt (melwitt)]

Hi Park,

I agree it's ideal if Nova API would return ids instead of names. But doing so is an API change, so we'd have to use the microversioning to change it. That said, I don't know the details about how to bump a microversion and change API behavior. This is the documentation: http://docs.openstack.org/developer/nova/devref/api_microversions.html

Feel free to ask questions on the openstack-dev mailing list for guidance if you would like to pursue this.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Kevin L. Mitchell (<email address hidden>) on branch: master
Review: https://review.openstack.org/157383
Reason: In merge conflict and idle for 3 months. Feel free to re-open if you get time to fix it up.

[Markus Zoeller (markus_z) (mzoeller)]

This wishlist bug has been open a year without any activity. I'm going
to move it to "Opinion / Wishlist", which is an easily-obtainable queue
of older requests that have come on. If you decide to work on this
consider using a blueprint [1] (maybe with a spec [2]). I'll recommend to
read [3] if not yet done.

References:
[1] https://blueprints.launchpad.net/nova/
[2] https://github.com/openstack/nova-specs
[3] https://wiki.openstack.org/wiki/Blueprints