Comment 14 for bug 1824435

I've proposed a different fix for this after investigating locally in devstack using Iain's repro steps. I found that our code for "get or create default security group" is creating a duplicate default group for project_id=NULL (this works despite a unique constraint on project_id because unique constraints are only enforced on non-NULL values, as mentioned in earlier comments on this bug [1]) because the group create happens in a separate database transaction but a later read happens in the same/current database transaction. The current transaction cannot "see" the earlier inserted security group record because of transaction isolation [2]. The bug is not reproducible with SQLite because SQLite provides no isolation between transactions on the same database connection (which will always be the case if the insert and later read are happening in the same instance_create method call [3].

Based on all this, the fix I propose is to do the read in a separate transaction, similar to how the create is done. I am attempting to do the test coverage in our post test hook, for lack of a better idea.

[1] https://dev.mysql.com/doc/refman/8.0/en/create-index.html#create-index-unique
[2] http://eavesdrop.openstack.org/irclogs/%23openstack-nova/%23openstack-nova.2019-10-11.log.html#t2019-10-11T19:05:21
[3] https://www.sqlite.org/isolation.html