)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":23851,"name":"Riccardo Pittau","email":"elfosardo@gmail.com","username":"elfosardo"},"change_message_id":"bb58b4cd1e4530368f6339718f14e344a0a59a43","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":6,"id":"5c0b1954_30132ab3","updated":"2025-08-04 07:26:32.000000000","message":"needs a rebase","commit_id":"84a103a80c9caee4512fece45e1530b22ce4d3fc"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"c6851bcb5a71ac0ead63d62d1c4c9d4540a801c6","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":8,"id":"509bbfe9_972ef63d","updated":"2025-08-17 17:15:12.000000000","message":"Based on the code I think the docs are wrong.","commit_id":"1cca16f81d2f47667d737cd3396e42841d43dc44"},{"author":{"_account_id":10342,"name":"Jay Faulkner","display_name":"JayF","email":"jay@jvf.cc","username":"JayF","status":"youtube.com/@oss-gr / podcast.gr-oss.io"},"change_message_id":"2dc9e082da71e026addf57593bd538adf55feba6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"d1790441_063ac0a1","updated":"2025-08-14 18:02:13.000000000","message":"Only voting +1 due to my general lack of familiarity with security groups. If it becomes absolutely necessary ping me and I can upgrade this.","commit_id":"1cca16f81d2f47667d737cd3396e42841d43dc44"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"67b6c6293355c1d56468393741b1a1f9a9ea3311","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":8,"id":"fd3fb7d1_041486f6","updated":"2025-08-14 13:57:08.000000000","message":"recheck cross node communications issues","commit_id":"1cca16f81d2f47667d737cd3396e42841d43dc44"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"7f8cec97831a28acbaf60cb826139f22139e54a7","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"44c5aa99_42dc091b","updated":"2025-08-27 21:18:56.000000000","message":"recheck ci should be good now","commit_id":"542954364a2457432c00da3d3a7f41442df13874"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"e001617f83997a26994a01f97ca027ec21454576","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"0c6ddd1b_7c2f8740","updated":"2025-08-28 16:37:14.000000000","message":"recheck new flake8 tests suppressed","commit_id":"542954364a2457432c00da3d3a7f41442df13874"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"e8ae045c9bfaef7fc7ba931146954591f75e6865","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":10,"id":"87939fcb_441a53eb","updated":"2025-08-29 13:15:11.000000000","message":"recheck more data needed to identify the root cause","commit_id":"cc259c5f7bb1ce54e413223a2652ab10cb742bde"}],"doc/source/configuration.rst":[{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"c6851bcb5a71ac0ead63d62d1c4c9d4540a801c6","unresolved":true,"context_lines":[{"line_number":266,"context_line":"to the list of ``service_plugins`` (this also needs to be enabled per switch configuration)::"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"    [DEFAULT]"},{"line_number":269,"context_line":"    service_plugins \u003d qos,ovn-router,trunk,segments,port_forwarding,log,genericswitch_security_group"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"(Re)start ``neutron-server`` specifying the additional configuration file"},{"line_number":272,"context_line":"containing switch configuration::"}],"source_content_type":"text/x-rst","patch_set":8,"id":"8f290c20_550dec4d","line":269,"updated":"2025-08-17 17:15:12.000000000","message":"```suggestion\n    service_plugins \u003d qos,ovn-router,trunk,segments,port_forwarding,log,generic_switch_security_group\n```\n\nbased on the value in the actual plugin below","commit_id":"1cca16f81d2f47667d737cd3396e42841d43dc44"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"fdab00c4d931faaec8610cf3b7731ffc96ed7026","unresolved":true,"context_lines":[{"line_number":266,"context_line":"to the list of ``service_plugins`` (this also needs to be enabled per switch configuration)::"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"    [DEFAULT]"},{"line_number":269,"context_line":"    service_plugins \u003d qos,ovn-router,trunk,segments,port_forwarding,log,genericswitch_security_group"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"(Re)start ``neutron-server`` specifying the additional configuration file"},{"line_number":272,"context_line":"containing switch configuration::"}],"source_content_type":"text/x-rst","patch_set":8,"id":"df00757a_a37bb4fc","line":269,"in_reply_to":"8f290c20_550dec4d","updated":"2025-08-22 19:13:36.000000000","message":"So... the actual value is defined: https://review.opendev.org/c/openstack/networking-generic-switch/+/949834/8/setup.cfg#34\n\nI think the issue here is inconsistency.","commit_id":"1cca16f81d2f47667d737cd3396e42841d43dc44"}],"networking_generic_switch/config.py":[{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"c97e16202c12a033eecf560cca9897c3c0cc44bc","unresolved":true,"context_lines":[{"line_number":39,"context_line":"    cfg.BoolOpt(\u0027security_groups_enabled\u0027,"},{"line_number":40,"context_line":"                default\u003dFalse,"},{"line_number":41,"context_line":"                help\u003d\u0027Enable security groups on all switches configured \u0027"},{"line_number":42,"context_line":"                     \u0027for it.\u0027),"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"CONF.register_opts(coordination_opts, group\u003d\u0027ngs_coordination\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"c43fa24d_9851055c","line":42,"updated":"2025-06-03 04:57:35.000000000","message":"Actually given that the service plugin won\u0027t be enabled without setting [DEFAULT]service_plugins\u003d...,genericswitch_security_group I don\u0027t think this option is needed at all. service_plugins already acts as an enabled toggle.","commit_id":"cab270434f022199e3f8c92c7ffa224dbe04472a"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"0d756a72011383e6eb096ced0804547869349f72","unresolved":false,"context_lines":[{"line_number":39,"context_line":"    cfg.BoolOpt(\u0027security_groups_enabled\u0027,"},{"line_number":40,"context_line":"                default\u003dFalse,"},{"line_number":41,"context_line":"                help\u003d\u0027Enable security groups on all switches configured \u0027"},{"line_number":42,"context_line":"                     \u0027for it.\u0027),"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"CONF.register_opts(coordination_opts, group\u003d\u0027ngs_coordination\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"eee1bd7e_5291952a","line":42,"in_reply_to":"1779e0f1_7a4a8006","updated":"2025-06-04 03:22:39.000000000","message":"Done","commit_id":"cab270434f022199e3f8c92c7ffa224dbe04472a"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"a19398cba4a1be7052a98561d930dd81096b7b0d","unresolved":true,"context_lines":[{"line_number":39,"context_line":"    cfg.BoolOpt(\u0027security_groups_enabled\u0027,"},{"line_number":40,"context_line":"                default\u003dFalse,"},{"line_number":41,"context_line":"                help\u003d\u0027Enable security groups on all switches configured \u0027"},{"line_number":42,"context_line":"                     \u0027for it.\u0027),"},{"line_number":43,"context_line":"]"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"CONF.register_opts(coordination_opts, group\u003d\u0027ngs_coordination\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"1779e0f1_7a4a8006","line":42,"in_reply_to":"c43fa24d_9851055c","updated":"2025-06-03 18:52:11.000000000","message":"Yeah, I\u0027d drop it. That being said, it would likely make sense to go ahead and begin to stub out the docs as part of this change, just to highlight the expected pattern and act to set being required.","commit_id":"cab270434f022199e3f8c92c7ffa224dbe04472a"}],"networking_generic_switch/devices/__init__.py":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"da64d4acb568f9fa9816c5f92eaa344376d78271","unresolved":true,"context_lines":[{"line_number":61,"context_line":"    {\u0027name\u0027: \u0027ngs_allowed_vlans\u0027},"},{"line_number":62,"context_line":"    {\u0027name\u0027: \u0027ngs_allowed_ports\u0027},"},{"line_number":63,"context_line":"    # Allow security groups to be disabled on a per-device basis"},{"line_number":64,"context_line":"    {\u0027name\u0027: \u0027ngs_security_groups_enabled\u0027, \u0027default\u0027: True}"},{"line_number":65,"context_line":"]"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"EM_SEMAPHORE \u003d \u0027ngs_device_manager\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"82bf9e21_1818080d","line":64,"updated":"2025-05-19 20:48:46.000000000","message":"So disabled by default, overall, and then enabled on each switch not otherwise configured. Shouldn\u0027t e possibly swap that for switch state. I.e. each driver opt in once it actually supports it?  Obviously, the c300 driver will never support this, so it seems a little weird way of going forward.","commit_id":"0eae99f796d52ac38393b9c8461fbaeb21e7c021"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"c16326d5fee4094383ad6902dffa697fa6891f20","unresolved":true,"context_lines":[{"line_number":61,"context_line":"    {\u0027name\u0027: \u0027ngs_allowed_vlans\u0027},"},{"line_number":62,"context_line":"    {\u0027name\u0027: \u0027ngs_allowed_ports\u0027},"},{"line_number":63,"context_line":"    # Allow security groups to be disabled on a per-device basis"},{"line_number":64,"context_line":"    {\u0027name\u0027: \u0027ngs_security_groups_enabled\u0027, \u0027default\u0027: True}"},{"line_number":65,"context_line":"]"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"EM_SEMAPHORE \u003d \u0027ngs_device_manager\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"d31d0779_27ecac79","line":64,"in_reply_to":"82bf9e21_1818080d","updated":"2025-05-19 21:02:15.000000000","message":"I think of this as forcing the operator to be aware of exactly what their switches support using config as documentation.\n\nSo if they enable the feature via [ngs]security_groups_enabled\u003dTrue and they have a c300 then creating a security group will raise an error unless they also set ngs_security_groups_enabled\u003dFalse on that switch. They may have other switches which do support security groups.\n\nI\u0027m not against defaulting ngs_security_groups_enabled to False but I do think [ngs]security_groups_enabled will always have to default to False so existing deployments don\u0027t suddenly change behaviour.","commit_id":"0eae99f796d52ac38393b9c8461fbaeb21e7c021"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"ad19b8cf0691d0efe04c9d02b5107924bea7fd2c","unresolved":false,"context_lines":[{"line_number":61,"context_line":"    {\u0027name\u0027: \u0027ngs_allowed_vlans\u0027},"},{"line_number":62,"context_line":"    {\u0027name\u0027: \u0027ngs_allowed_ports\u0027},"},{"line_number":63,"context_line":"    # Allow security groups to be disabled on a per-device basis"},{"line_number":64,"context_line":"    {\u0027name\u0027: \u0027ngs_security_groups_enabled\u0027, \u0027default\u0027: True}"},{"line_number":65,"context_line":"]"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"EM_SEMAPHORE \u003d \u0027ngs_device_manager\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"9a27bc6a_e4df78ec","line":64,"in_reply_to":"c670f73d_51bb3c99","updated":"2025-06-02 22:23:42.000000000","message":"Done","commit_id":"0eae99f796d52ac38393b9c8461fbaeb21e7c021"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"8c0fd22f52ffd21ff7d6e3a0278c468363d6f36a","unresolved":true,"context_lines":[{"line_number":61,"context_line":"    {\u0027name\u0027: \u0027ngs_allowed_vlans\u0027},"},{"line_number":62,"context_line":"    {\u0027name\u0027: \u0027ngs_allowed_ports\u0027},"},{"line_number":63,"context_line":"    # Allow security groups to be disabled on a per-device basis"},{"line_number":64,"context_line":"    {\u0027name\u0027: \u0027ngs_security_groups_enabled\u0027, \u0027default\u0027: True}"},{"line_number":65,"context_line":"]"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"EM_SEMAPHORE \u003d \u0027ngs_device_manager\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"c670f73d_51bb3c99","line":64,"in_reply_to":"d31d0779_27ecac79","updated":"2025-05-19 21:59:49.000000000","message":"I think the overall default of False generally makes sense then because that does line up with the overall idea of operators needing to configure. I guess on a switch or driver level seems weird as well, but it can make sense then.","commit_id":"0eae99f796d52ac38393b9c8461fbaeb21e7c021"}],"networking_generic_switch/generic_switch_sg.py":[{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"da64d4acb568f9fa9816c5f92eaa344376d78271","unresolved":true,"context_lines":[{"line_number":197,"context_line":"                 \u0027%(port_id)s\u0027,"},{"line_number":198,"context_line":"                 {\u0027sg_id\u0027: sg_id, \u0027port_id\u0027: port_id})"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"    def subscribe(self):"},{"line_number":201,"context_line":"        # Subscribe to the events related to security groups and rules"},{"line_number":202,"context_line":"        registry.subscribe("},{"line_number":203,"context_line":"            self.create_security_group, resources.SECURITY_GROUP,"}],"source_content_type":"text/x-python","patch_set":1,"id":"b224af29_d23ed5d3","line":200,"updated":"2025-05-19 20:48:46.000000000","message":"Could you elaborate on this a little more, specifically just kind of highlight the reality of what each subscription is for. I think that would help better frame what is going on here so I can give this a proper review.","commit_id":"0eae99f796d52ac38393b9c8461fbaeb21e7c021"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"ad19b8cf0691d0efe04c9d02b5107924bea7fd2c","unresolved":false,"context_lines":[{"line_number":197,"context_line":"                 \u0027%(port_id)s\u0027,"},{"line_number":198,"context_line":"                 {\u0027sg_id\u0027: sg_id, \u0027port_id\u0027: port_id})"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"    def subscribe(self):"},{"line_number":201,"context_line":"        # Subscribe to the events related to security groups and rules"},{"line_number":202,"context_line":"        registry.subscribe("},{"line_number":203,"context_line":"            self.create_security_group, resources.SECURITY_GROUP,"}],"source_content_type":"text/x-python","patch_set":1,"id":"48df981e_4549618c","line":200,"in_reply_to":"b224af29_d23ed5d3","updated":"2025-06-02 22:23:42.000000000","message":"Done","commit_id":"0eae99f796d52ac38393b9c8461fbaeb21e7c021"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"a19398cba4a1be7052a98561d930dd81096b7b0d","unresolved":true,"context_lines":[{"line_number":174,"context_line":"        if not self._valid_baremetal_port(port):"},{"line_number":175,"context_line":"            return"},{"line_number":176,"context_line":"        # _valid_baremetal_port guarantees we have exactly one SG"},{"line_number":177,"context_line":"        sg_id \u003d port.get(\u0027security_groups\u0027)[0]"},{"line_number":178,"context_line":"        switch, port_id \u003d self._get_switch_and_port_id(port)"},{"line_number":179,"context_line":"        if not switch or not port_id:"},{"line_number":180,"context_line":"            return"}],"source_content_type":"text/x-python","patch_set":3,"id":"fc473b4d_61194b8f","line":177,"updated":"2025-06-03 18:52:11.000000000","message":"So, we only apply a singular existence of a security group instead of multiple? Or is it just a weird structural aspect. For some reason I\u0027m thinking it is multiple groups, but I\u0027d need to refresh my memory.","commit_id":"cab270434f022199e3f8c92c7ffa224dbe04472a"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"bbcd7b65dbb03fd834b2e4d91bf427177de86881","unresolved":true,"context_lines":[{"line_number":174,"context_line":"        if not self._valid_baremetal_port(port):"},{"line_number":175,"context_line":"            return"},{"line_number":176,"context_line":"        # _valid_baremetal_port guarantees we have exactly one SG"},{"line_number":177,"context_line":"        sg_id \u003d port.get(\u0027security_groups\u0027)[0]"},{"line_number":178,"context_line":"        switch, port_id \u003d self._get_switch_and_port_id(port)"},{"line_number":179,"context_line":"        if not switch or not port_id:"},{"line_number":180,"context_line":"            return"}],"source_content_type":"text/x-python","patch_set":3,"id":"eeb615dc_7424ad25","line":177,"in_reply_to":"2f46477f_3e19364a","updated":"2025-06-10 19:19:12.000000000","message":"Furthermore, I\u0027m working on the NX-OS driver and Cisco 9000s only allow one IP ACL per interface, so that is a hard limitation","commit_id":"cab270434f022199e3f8c92c7ffa224dbe04472a"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"74e88adaa26812c5447c2eb4838f302c1c30ba2e","unresolved":true,"context_lines":[{"line_number":174,"context_line":"        if not self._valid_baremetal_port(port):"},{"line_number":175,"context_line":"            return"},{"line_number":176,"context_line":"        # _valid_baremetal_port guarantees we have exactly one SG"},{"line_number":177,"context_line":"        sg_id \u003d port.get(\u0027security_groups\u0027)[0]"},{"line_number":178,"context_line":"        switch, port_id \u003d self._get_switch_and_port_id(port)"},{"line_number":179,"context_line":"        if not switch or not port_id:"},{"line_number":180,"context_line":"            return"}],"source_content_type":"text/x-python","patch_set":3,"id":"b6e8c9ba_6b73a02d","line":177,"in_reply_to":"eeb615dc_7424ad25","updated":"2025-08-14 13:56:54.000000000","message":"Fair enough, lets just make sure we explicitly document it because we\u0027ve seen cases over the years where folks have tried to apply numerous access lists to VMs.","commit_id":"cab270434f022199e3f8c92c7ffa224dbe04472a"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"10e6ec0930719de7f8ded3c3afe709af22576fee","unresolved":true,"context_lines":[{"line_number":174,"context_line":"        if not self._valid_baremetal_port(port):"},{"line_number":175,"context_line":"            return"},{"line_number":176,"context_line":"        # _valid_baremetal_port guarantees we have exactly one SG"},{"line_number":177,"context_line":"        sg_id \u003d port.get(\u0027security_groups\u0027)[0]"},{"line_number":178,"context_line":"        switch, port_id \u003d self._get_switch_and_port_id(port)"},{"line_number":179,"context_line":"        if not switch or not port_id:"},{"line_number":180,"context_line":"            return"}],"source_content_type":"text/x-python","patch_set":3,"id":"2f46477f_3e19364a","line":177,"in_reply_to":"fc473b4d_61194b8f","updated":"2025-06-03 21:11:58.000000000","message":"networking-arista has made the design choice of a port only allowing one security group to be bound, and I\u0027m proposing we enforce that as a limitation for ngs for now.\n\nOne reason is it makes the implementation simpler. But also anecdotally some switches have significant performance degradation with multiple security groups on a port.\n\nSo I\u0027m proposing that initially we only support a port being bound to one security group, with the option of raising this limit when we have a better understanding of switch behaviour. And I think this limitation still provides end users with a useful feature.","commit_id":"cab270434f022199e3f8c92c7ffa224dbe04472a"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"bbcd7b65dbb03fd834b2e4d91bf427177de86881","unresolved":true,"context_lines":[{"line_number":220,"context_line":"        # Apply SG rules on AFTER_UPDATE, remove them on AFTER_DELETE."},{"line_number":221,"context_line":"        # Binds a security group to a port."},{"line_number":222,"context_line":"        registry.subscribe("},{"line_number":223,"context_line":"            self.apply_security_group, resources.PORT, events.AFTER_UPDATE)"},{"line_number":224,"context_line":"        # Unbinds a security group from a port."},{"line_number":225,"context_line":"        registry.subscribe("},{"line_number":226,"context_line":"            self.remove_security_group, resources.PORT, events.AFTER_DELETE)"}],"source_content_type":"text/x-python","patch_set":4,"id":"5cdd0fd7_8d0d79db","line":223,"updated":"2025-06-10 19:19:12.000000000","message":"This isn\u0027t quite right, an update event could add or remove a security group so apply_security_group needs to compare payload.state[0] with payload.state[1]. I\u0027ll post a follow-up for this","commit_id":"5affc26f2edbb028892ccb74a9766f1f30e9a3ea"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"d216ea0b091d0c0b26f9c10464faad1300bc09ad","unresolved":false,"context_lines":[{"line_number":220,"context_line":"        # Apply SG rules on AFTER_UPDATE, remove them on AFTER_DELETE."},{"line_number":221,"context_line":"        # Binds a security group to a port."},{"line_number":222,"context_line":"        registry.subscribe("},{"line_number":223,"context_line":"            self.apply_security_group, resources.PORT, events.AFTER_UPDATE)"},{"line_number":224,"context_line":"        # Unbinds a security group from a port."},{"line_number":225,"context_line":"        registry.subscribe("},{"line_number":226,"context_line":"            self.remove_security_group, resources.PORT, events.AFTER_DELETE)"}],"source_content_type":"text/x-python","patch_set":4,"id":"ef7ed66d_aee82170","line":223,"in_reply_to":"5cdd0fd7_8d0d79db","updated":"2025-06-16 03:17:06.000000000","message":"Done","commit_id":"5affc26f2edbb028892ccb74a9766f1f30e9a3ea"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"1359019e62286322013872e22e762aa379482ad4","unresolved":true,"context_lines":[{"line_number":226,"context_line":"        registry.subscribe("},{"line_number":227,"context_line":"            self.delete_security_group, resources.SECURITY_GROUP,"},{"line_number":228,"context_line":"            events.AFTER_DELETE)"},{"line_number":229,"context_line":"        # Adds one rule to an existing security group."},{"line_number":230,"context_line":"        registry.subscribe("},{"line_number":231,"context_line":"            self.create_security_group_rule, resources.SECURITY_GROUP_RULE,"},{"line_number":232,"context_line":"            events.AFTER_CREATE)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"        # Deletes one rule from an existing security group"},{"line_number":235,"context_line":"        # We need to handle SG rules in before delete to be able to query."},{"line_number":236,"context_line":"        # the db for the rule details."},{"line_number":237,"context_line":"        registry.subscribe("},{"line_number":238,"context_line":"            self.delete_security_group_rule, resources.SECURITY_GROUP_RULE,"},{"line_number":239,"context_line":"            events.BEFORE_DELETE)"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"        # Apply/remove SG rules on AFTER_UPDATE."},{"line_number":242,"context_line":"        # Binds or unbinds a security group to a port."}],"source_content_type":"text/x-python","patch_set":5,"id":"20b934e3_6e74efb4","line":239,"range":{"start_line":229,"start_character":0,"end_line":239,"end_character":33},"updated":"2025-06-26 01:07:00.000000000","message":"SONiC cannot add or remove entries from an existing ACL, it can only define an ACL with all known rules. This means there needs to be a mode which provides the driver with all security group rules when any rule changes.\n\nI\u0027m actually now thinking that all drivers should work this way. When a rule in an sg changes, then look up the sg and all rules in this service plugin, and the driver will be called to replace all existing rules with the provided rules.\n\nThis has the further advantage of ensuring switches don\u0027t drift out of state for whatever reason. Any rule change will result in a security group being correct on all switches.","commit_id":"662d04243b884f5bb8bdd761970b3ff2f5b89e7e"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"1fc5cc690625e7cdf05629a289bc2b398e3ed018","unresolved":false,"context_lines":[{"line_number":226,"context_line":"        registry.subscribe("},{"line_number":227,"context_line":"            self.delete_security_group, resources.SECURITY_GROUP,"},{"line_number":228,"context_line":"            events.AFTER_DELETE)"},{"line_number":229,"context_line":"        # Adds one rule to an existing security group."},{"line_number":230,"context_line":"        registry.subscribe("},{"line_number":231,"context_line":"            self.create_security_group_rule, resources.SECURITY_GROUP_RULE,"},{"line_number":232,"context_line":"            events.AFTER_CREATE)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"        # Deletes one rule from an existing security group"},{"line_number":235,"context_line":"        # We need to handle SG rules in before delete to be able to query."},{"line_number":236,"context_line":"        # the db for the rule details."},{"line_number":237,"context_line":"        registry.subscribe("},{"line_number":238,"context_line":"            self.delete_security_group_rule, resources.SECURITY_GROUP_RULE,"},{"line_number":239,"context_line":"            events.BEFORE_DELETE)"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"        # Apply/remove SG rules on AFTER_UPDATE."},{"line_number":242,"context_line":"        # Binds or unbinds a security group to a port."}],"source_content_type":"text/x-python","patch_set":5,"id":"4dd60ab2_5e8d052a","line":239,"range":{"start_line":229,"start_character":0,"end_line":239,"end_character":33},"in_reply_to":"20b934e3_6e74efb4","updated":"2025-07-29 03:05:58.000000000","message":"Done","commit_id":"662d04243b884f5bb8bdd761970b3ff2f5b89e7e"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"1359019e62286322013872e22e762aa379482ad4","unresolved":true,"context_lines":[{"line_number":238,"context_line":"            self.delete_security_group_rule, resources.SECURITY_GROUP_RULE,"},{"line_number":239,"context_line":"            events.BEFORE_DELETE)"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"        # Apply/remove SG rules on AFTER_UPDATE."},{"line_number":242,"context_line":"        # Binds or unbinds a security group to a port."},{"line_number":243,"context_line":"        registry.subscribe("},{"line_number":244,"context_line":"            self.update_port_security_group, resources.PORT,"},{"line_number":245,"context_line":"            events.AFTER_UPDATE)"},{"line_number":246,"context_line":"        # Unbinds a security group from a port as part of port delete."},{"line_number":247,"context_line":"        registry.subscribe("},{"line_number":248,"context_line":"            self.remove_port_security_group, resources.PORT,"},{"line_number":249,"context_line":"            events.AFTER_DELETE)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5215595f_57600a67","line":249,"range":{"start_line":241,"start_character":0,"end_line":249,"end_character":32},"updated":"2025-06-26 01:07:00.000000000","message":"SONiC also has a requirement that binding happens by specifying a list of ports and one security group. I\u0027ll need to think how this can be done for all switches in a way which is efficient and improves the current risk of switch state drifting.","commit_id":"662d04243b884f5bb8bdd761970b3ff2f5b89e7e"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"1fc5cc690625e7cdf05629a289bc2b398e3ed018","unresolved":false,"context_lines":[{"line_number":238,"context_line":"            self.delete_security_group_rule, resources.SECURITY_GROUP_RULE,"},{"line_number":239,"context_line":"            events.BEFORE_DELETE)"},{"line_number":240,"context_line":""},{"line_number":241,"context_line":"        # Apply/remove SG rules on AFTER_UPDATE."},{"line_number":242,"context_line":"        # Binds or unbinds a security group to a port."},{"line_number":243,"context_line":"        registry.subscribe("},{"line_number":244,"context_line":"            self.update_port_security_group, resources.PORT,"},{"line_number":245,"context_line":"            events.AFTER_UPDATE)"},{"line_number":246,"context_line":"        # Unbinds a security group from a port as part of port delete."},{"line_number":247,"context_line":"        registry.subscribe("},{"line_number":248,"context_line":"            self.remove_port_security_group, resources.PORT,"},{"line_number":249,"context_line":"            events.AFTER_DELETE)"}],"source_content_type":"text/x-python","patch_set":5,"id":"d9b6b6f6_7504e4fb","line":249,"range":{"start_line":241,"start_character":0,"end_line":249,"end_character":32},"in_reply_to":"5215595f_57600a67","updated":"2025-07-29 03:05:58.000000000","message":"Done","commit_id":"662d04243b884f5bb8bdd761970b3ff2f5b89e7e"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"0ee2997ec9e49e32020b2446df29c920b081eef2","unresolved":true,"context_lines":[{"line_number":54,"context_line":"        LOG.info(\u0027Devices %s have been loaded\u0027, self.switches.keys())"},{"line_number":55,"context_line":"        if not self.switches:"},{"line_number":56,"context_line":"            LOG.error(\u0027No devices have been loaded\u0027)"},{"line_number":57,"context_line":"        # self.add_worker(security_group_sync.GenericSwitchSecurityGroupSyncWorker())"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    def get_plugin_description(self):"},{"line_number":60,"context_line":"        return \"Generic switch baremetal security group service plugin\""}],"source_content_type":"text/x-python","patch_set":6,"id":"f6a2938c_22da9f9b","line":57,"range":{"start_line":57,"start_character":0,"end_line":57,"end_character":10},"updated":"2025-07-29 21:56:55.000000000","message":"I\u0027m good with this, but we should highlight what the idea here is for.","commit_id":"84a103a80c9caee4512fece45e1530b22ce4d3fc"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"f48e067755eefb34cf75ad28d74344410b1a3c6c","unresolved":true,"context_lines":[{"line_number":54,"context_line":"        LOG.info(\u0027Devices %s have been loaded\u0027, self.switches.keys())"},{"line_number":55,"context_line":"        if not self.switches:"},{"line_number":56,"context_line":"            LOG.error(\u0027No devices have been loaded\u0027)"},{"line_number":57,"context_line":"        # self.add_worker(security_group_sync.GenericSwitchSecurityGroupSyncWorker())"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    def get_plugin_description(self):"},{"line_number":60,"context_line":"        return \"Generic switch baremetal security group service plugin\""}],"source_content_type":"text/x-python","patch_set":6,"id":"67eea531_3f57d30c","line":57,"range":{"start_line":57,"start_character":0,"end_line":57,"end_character":10},"in_reply_to":"f6a2938c_22da9f9b","updated":"2025-07-31 23:43:34.000000000","message":"I\u0027ll replace this with a TODO","commit_id":"84a103a80c9caee4512fece45e1530b22ce4d3fc"}],"setup.cfg":[{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"4d1fdaa4df729686d76bc6616ec1a452fc10773e","unresolved":true,"context_lines":[{"line_number":31,"context_line":"neutron.ml2.mechanism_drivers \u003d"},{"line_number":32,"context_line":"    genericswitch \u003d networking_generic_switch.generic_switch_mech:GenericSwitchDriver"},{"line_number":33,"context_line":"neutron.service_plugins \u003d"},{"line_number":34,"context_line":"    genericswitch_security_group \u003d networking_generic_switch.generic_switch_sg.GenericSwitchSecurityGroupHandler"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"generic_switch.devices \u003d"},{"line_number":37,"context_line":"    netmiko_ovs_linux \u003d networking_generic_switch.devices.netmiko_devices.ovs:OvsLinux"}],"source_content_type":"text/x-ttcn-cfg","patch_set":3,"id":"1af77cbf_0b920b9d","line":34,"range":{"start_line":34,"start_character":78,"end_line":34,"end_character":80},"updated":"2025-06-04 02:37:10.000000000","message":"This should be a colon, not a period","commit_id":"cab270434f022199e3f8c92c7ffa224dbe04472a"},{"author":{"_account_id":4571,"name":"Steve Baker","email":"sbaker@redhat.com","username":"steve-stevebaker"},"change_message_id":"0d756a72011383e6eb096ced0804547869349f72","unresolved":false,"context_lines":[{"line_number":31,"context_line":"neutron.ml2.mechanism_drivers \u003d"},{"line_number":32,"context_line":"    genericswitch \u003d networking_generic_switch.generic_switch_mech:GenericSwitchDriver"},{"line_number":33,"context_line":"neutron.service_plugins \u003d"},{"line_number":34,"context_line":"    genericswitch_security_group \u003d networking_generic_switch.generic_switch_sg.GenericSwitchSecurityGroupHandler"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"generic_switch.devices \u003d"},{"line_number":37,"context_line":"    netmiko_ovs_linux \u003d networking_generic_switch.devices.netmiko_devices.ovs:OvsLinux"}],"source_content_type":"text/x-ttcn-cfg","patch_set":3,"id":"a433320f_d0347905","line":34,"range":{"start_line":34,"start_character":78,"end_line":34,"end_character":80},"in_reply_to":"1af77cbf_0b920b9d","updated":"2025-06-04 03:22:39.000000000","message":"Done","commit_id":"cab270434f022199e3f8c92c7ffa224dbe04472a"}]}