)]}'
{"nova/compute/manager.py":[{"author":{"_account_id":10224,"name":"Feodor Tersin","email":"ftersin@hotmail.com","username":"ftersin"},"change_message_id":"39421171a8a408f1e35aac76388ff03b60f75eb6","unresolved":false,"context_lines":[{"line_number":4882,"context_line":"        security_groups \u003d []"},{"line_number":4883,"context_line":"        if self.is_neutron_security_groups:"},{"line_number":4884,"context_line":"            sglist \u003d self.compute_api.security_group_api.\\"},{"line_number":4885,"context_line":"                       get_instance_security_groups(context,"},{"line_number":4886,"context_line":"                                                    instance.uuid)"},{"line_number":4887,"context_line":"            security_groups \u003d [i[\u0027name\u0027] for i in sglist]"},{"line_number":4888,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"7aaa499b_9a093ee0","line":4885,"updated":"2015-04-14 22:50:14.000000000","message":"If an instance has several ports, and each port has its own set of groups, then get_instance_security_groups returns all of them. So the new port will get full set of groups. This doesn\u0027 seem right. Am i wrong?","commit_id":"cbb2cf357a770049fd267e9b8222c75b3a7a081b"},{"author":{"_account_id":10583,"name":"Praveen Yalagandula","email":"ypraveen@gmail.com","username":"ypraveen"},"change_message_id":"5fad28e1bc931e5821689dd247926bc24100d6ce","unresolved":false,"context_lines":[{"line_number":4882,"context_line":"        security_groups \u003d []"},{"line_number":4883,"context_line":"        if self.is_neutron_security_groups:"},{"line_number":4884,"context_line":"            sglist \u003d self.compute_api.security_group_api.\\"},{"line_number":4885,"context_line":"                       get_instance_security_groups(context,"},{"line_number":4886,"context_line":"                                                    instance.uuid)"},{"line_number":4887,"context_line":"            security_groups \u003d [i[\u0027name\u0027] for i in sglist]"},{"line_number":4888,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"3afb71cf_8a53e138","line":4885,"in_reply_to":"7aaa499b_8e2fb9f5","updated":"2015-06-11 01:34:51.000000000","message":"Aaron and Feodor,\nI agree that nova security-group-api and neutron security-group-api don\u0027t lineup propertly. However, I think that if one is purely using nova commands, the behavior should be consistent whether security-groups is implemented by nova or neutron. The expectation with nova is that the security-groups are associated with an instance and so any new interface on a VM should get all security-groups associated with that VM. If it does not get it, then the nova-api is indeed *broken*.\n\nIf someone is using neutron security-groups, then they will anyways explicitly chose the security-groups for each port created. For attach interface call, they will create a port explicitly with needed security-groups and use that port or modify the security-groups of the port created during the attach call after the fact.","commit_id":"cbb2cf357a770049fd267e9b8222c75b3a7a081b"},{"author":{"_account_id":4395,"name":"Aaron Rosen","email":"aaronorosen@gmail.com","username":"arosen"},"change_message_id":"e98d630333b7846fa4cebdccd2a3b6b1dab85c2b","unresolved":false,"context_lines":[{"line_number":4882,"context_line":"        security_groups \u003d []"},{"line_number":4883,"context_line":"        if self.is_neutron_security_groups:"},{"line_number":4884,"context_line":"            sglist \u003d self.compute_api.security_group_api.\\"},{"line_number":4885,"context_line":"                       get_instance_security_groups(context,"},{"line_number":4886,"context_line":"                                                    instance.uuid)"},{"line_number":4887,"context_line":"            security_groups \u003d [i[\u0027name\u0027] for i in sglist]"},{"line_number":4888,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"7aaa499b_8e2fb9f5","line":4885,"in_reply_to":"7aaa499b_9a093ee0","updated":"2015-04-15 03:22:13.000000000","message":"You are right. Personally I like the current behavior that it\u0027s part of the default security group. The nova security group api when using neutron doesn\u0027t perfectly line up one to one so I think keeping the existing behavior here might be best.","commit_id":"cbb2cf357a770049fd267e9b8222c75b3a7a081b"}],"nova/network/api.py":[{"author":{"_account_id":8412,"name":"Mike Durnosvistov","email":"glacierr.dev@gmail.com","username":"mdurnosvistov"},"change_message_id":"2faa647f0db753e81a28ab055a6ac441337c1aca","unresolved":false,"context_lines":[{"line_number":299,"context_line":"    # NOTE(danms): Here for neutron compatibility"},{"line_number":300,"context_line":"    def allocate_port_for_instance(self, context, instance, port_id,"},{"line_number":301,"context_line":"                                   network_id\u003dNone, requested_ip\u003dNone,"},{"line_number":302,"context_line":"                                   security_groups\u003d[]):"},{"line_number":303,"context_line":"        raise NotImplementedError()"},{"line_number":304,"context_line":""},{"line_number":305,"context_line":"    # NOTE(danms): Here for neutron compatibility"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_1aef20b2","line":302,"updated":"2015-03-20 21:39:29.000000000","message":"N322  Method\u0027s default argument shouldn\u0027t be mutable!","commit_id":"8ef0ba19cdb29ab825042460a6f0b7eece085b0a"}],"nova/network/base_api.py":[{"author":{"_account_id":8412,"name":"Mike Durnosvistov","email":"glacierr.dev@gmail.com","username":"mdurnosvistov"},"change_message_id":"2faa647f0db753e81a28ab055a6ac441337c1aca","unresolved":false,"context_lines":[{"line_number":203,"context_line":""},{"line_number":204,"context_line":"    def allocate_port_for_instance(self, context, instance, port_id,"},{"line_number":205,"context_line":"                                   network_id\u003dNone, requested_ip\u003dNone,"},{"line_number":206,"context_line":"                                   security_groups\u003d[]):"},{"line_number":207,"context_line":"        \"\"\"Allocate port for instance.\"\"\""},{"line_number":208,"context_line":"        raise NotImplementedError()"},{"line_number":209,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_9a32305c","line":206,"updated":"2015-03-20 21:39:29.000000000","message":"N322  Method\u0027s default argument shouldn\u0027t be mutable!","commit_id":"8ef0ba19cdb29ab825042460a6f0b7eece085b0a"}],"nova/network/neutronv2/api.py":[{"author":{"_account_id":5754,"name":"Alex Xu","email":"hejie.xu@intel.com","username":"xuhj"},"change_message_id":"72c7ed9bd7ec2374c609122b7c1ee221fce7d379","unresolved":false,"context_lines":[{"line_number":416,"context_line":"        security_groups \u003d kwargs.get(\u0027security_groups\u0027, [])"},{"line_number":417,"context_line":"        if not security_groups:"},{"line_number":418,"context_line":"            instance_sglist \u003d self.security_group_api.get_instance_security_groups(context, instance[\u0027uuid\u0027])"},{"line_number":419,"context_line":"            security_groups \u003d [i[\u0027name\u0027] for i in instance_sglist]"},{"line_number":420,"context_line":"        security_group_ids \u003d []"},{"line_number":421,"context_line":""},{"line_number":422,"context_line":"        # TODO(arosen) Should optimize more to do direct query for security"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a961159_16e16ed0","line":419,"updated":"2014-12-30 02:31:34.000000000","message":"I think we should populate instance\u0027s security group in https://github.com/openstack/nova/blob/master/nova/network/neutronv2/api.py#L644 and passed in this function.\n\nWhen boot new instance will call this function, so we shouldn\u0027t change this directly.","commit_id":"9795a3095772c5406e2001d47493cd6630d3c05f"},{"author":{"_account_id":10583,"name":"Praveen Yalagandula","email":"ypraveen@gmail.com","username":"ypraveen"},"change_message_id":"e6dd7de81c9a0953125872a50647d03ea32d3c24","unresolved":false,"context_lines":[{"line_number":416,"context_line":"        security_groups \u003d kwargs.get(\u0027security_groups\u0027, [])"},{"line_number":417,"context_line":"        if not security_groups:"},{"line_number":418,"context_line":"            instance_sglist \u003d self.security_group_api.get_instance_security_groups(context, instance[\u0027uuid\u0027])"},{"line_number":419,"context_line":"            security_groups \u003d [i[\u0027name\u0027] for i in instance_sglist]"},{"line_number":420,"context_line":"        security_group_ids \u003d []"},{"line_number":421,"context_line":""},{"line_number":422,"context_line":"        # TODO(arosen) Should optimize more to do direct query for security"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a961159_d767e0b5","line":419,"in_reply_to":"3a961159_16e16ed0","updated":"2014-12-30 08:03:57.000000000","message":"Alex, can you explain why we should not be doing this during \"boot\" of a new instance?","commit_id":"9795a3095772c5406e2001d47493cd6630d3c05f"},{"author":{"_account_id":2750,"name":"Sean Dague","email":"sean@dague.net","username":"sdague"},"change_message_id":"544da72e836bbd2f07ec904e729b1bba923e2b58","unresolved":false,"context_lines":[{"line_number":642,"context_line":"                                            port_id\u003dport_id,"},{"line_number":643,"context_line":"                                            pci_request_id\u003dNone)])"},{"line_number":644,"context_line":"        security_groups \u003d []"},{"line_number":645,"context_line":"        if hasattr(self, \"security_group_api\"):"},{"line_number":646,"context_line":"            sgapi \u003d self.security_group_api"},{"line_number":647,"context_line":"            sglist \u003d sgapi.get_instance_security_groups(context,"},{"line_number":648,"context_line":"                                                        instance[\u0027uuid\u0027])"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_bec1ea81","line":645,"updated":"2015-03-03 14:29:23.000000000","message":"in what circumstances is there not a security group api?","commit_id":"ca6489febecb8ff8509a49cd6a90289843a1ef40"},{"author":{"_account_id":10583,"name":"Praveen Yalagandula","email":"ypraveen@gmail.com","username":"ypraveen"},"change_message_id":"0d6cfa1616ad8c1f95e46afba881ccb2dcb3b54c","unresolved":false,"context_lines":[{"line_number":642,"context_line":"                                            port_id\u003dport_id,"},{"line_number":643,"context_line":"                                            pci_request_id\u003dNone)])"},{"line_number":644,"context_line":"        security_groups \u003d []"},{"line_number":645,"context_line":"        if hasattr(self, \"security_group_api\"):"},{"line_number":646,"context_line":"            sgapi \u003d self.security_group_api"},{"line_number":647,"context_line":"            sglist \u003d sgapi.get_instance_security_groups(context,"},{"line_number":648,"context_line":"                                                        instance[\u0027uuid\u0027])"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba7be1f8_2031375a","line":645,"in_reply_to":"ba7be1f8_bec1ea81","updated":"2015-03-04 02:12:45.000000000","message":"Probably only in unittests :)\n\nSince security groups related API is an extension in v2.0 compute API, it seemed appropriate to not assume the presence of it always. Do you agree?","commit_id":"ca6489febecb8ff8509a49cd6a90289843a1ef40"},{"author":{"_account_id":10583,"name":"Praveen Yalagandula","email":"ypraveen@gmail.com","username":"ypraveen"},"change_message_id":"12f9c9d90ede5e74169202de8ee5a85f94070d08","unresolved":false,"context_lines":[{"line_number":642,"context_line":"                                            port_id\u003dport_id,"},{"line_number":643,"context_line":"                                            pci_request_id\u003dNone)])"},{"line_number":644,"context_line":"        security_groups \u003d []"},{"line_number":645,"context_line":"        if hasattr(self, \"security_group_api\"):"},{"line_number":646,"context_line":"            sgapi \u003d self.security_group_api"},{"line_number":647,"context_line":"            sglist \u003d sgapi.get_instance_security_groups(context,"},{"line_number":648,"context_line":"                                                        instance[\u0027uuid\u0027])"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a80dd14_d4613d3a","line":645,"updated":"2015-03-12 23:16:11.000000000","message":"Sean,\nDo you agree that security_group_api is an extension and hence we need to do this check here?","commit_id":"094e3cd7aa95beb14cc277c8bb382f53e21298d4"},{"author":{"_account_id":6681,"name":"Brent Eagles","email":"beagles@redhat.com","username":"beagles"},"change_message_id":"c69c44adab742dd84834befbe29aae3302a25439","unresolved":false,"context_lines":[{"line_number":642,"context_line":"                                            port_id\u003dport_id,"},{"line_number":643,"context_line":"                                            pci_request_id\u003dNone)])"},{"line_number":644,"context_line":"        security_groups \u003d []"},{"line_number":645,"context_line":"        if hasattr(self, \"security_group_api\"):"},{"line_number":646,"context_line":"            sgapi \u003d self.security_group_api"},{"line_number":647,"context_line":"            sglist \u003d sgapi.get_instance_security_groups(context,"},{"line_number":648,"context_line":"                                                        instance[\u0027uuid\u0027])"}],"source_content_type":"text/x-python","patch_set":3,"id":"9a80dd14_dab10890","line":645,"in_reply_to":"9a80dd14_d4613d3a","updated":"2015-03-16 10:25:16.000000000","message":"Just a sanity check, but can you verify where this attribute is actually set on the API instance?","commit_id":"094e3cd7aa95beb14cc277c8bb382f53e21298d4"},{"author":{"_account_id":8412,"name":"Mike Durnosvistov","email":"glacierr.dev@gmail.com","username":"mdurnosvistov"},"change_message_id":"d83ec2ebf845d0fc1598666a5ea97a953fe8b548","unresolved":false,"context_lines":[{"line_number":678,"context_line":"                                            port_id\u003dport_id,"},{"line_number":679,"context_line":"                                            pci_request_id\u003dNone)])"},{"line_number":680,"context_line":"        sglist \u003d self.security_group_api.get_instance_security_groups(context,"},{"line_number":681,"context_line":"                                                    instance[\u0027uuid\u0027])"},{"line_number":682,"context_line":"        security_groups \u003d [i[\u0027name\u0027] for i in sglist]"},{"line_number":683,"context_line":"        return self.allocate_for_instance(context, instance,"},{"line_number":684,"context_line":"                requested_networks\u003drequested_networks,"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a80dd14_fbdbe91e","line":681,"range":{"start_line":681,"start_character":52,"end_line":681,"end_character":68},"updated":"2015-03-17 14:54:21.000000000","message":"Please use `instance` like an object -\u003e instance.uuid","commit_id":"a961ae9b39a6052da7ad38c015f6ea958d8e8cbe"},{"author":{"_account_id":8412,"name":"Mike Durnosvistov","email":"glacierr.dev@gmail.com","username":"mdurnosvistov"},"change_message_id":"2faa647f0db753e81a28ab055a6ac441337c1aca","unresolved":false,"context_lines":[{"line_number":671,"context_line":""},{"line_number":672,"context_line":"    def allocate_port_for_instance(self, context, instance, port_id,"},{"line_number":673,"context_line":"                                   network_id\u003dNone, requested_ip\u003dNone,"},{"line_number":674,"context_line":"                                   security_groups\u003d[]):"},{"line_number":675,"context_line":"        \"\"\"Allocate a port for the instance.\"\"\""},{"line_number":676,"context_line":"        requested_networks \u003d objects.NetworkRequestList("},{"line_number":677,"context_line":"            objects\u003d[objects.NetworkRequest(network_id\u003dnetwork_id,"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_7a2f3cf6","line":674,"updated":"2015-03-20 21:39:29.000000000","message":"N322  Method\u0027s default argument shouldn\u0027t be mutable!","commit_id":"8ef0ba19cdb29ab825042460a6f0b7eece085b0a"},{"author":{"_account_id":10224,"name":"Feodor Tersin","email":"ftersin@hotmail.com","username":"ftersin"},"change_message_id":"39421171a8a408f1e35aac76388ff03b60f75eb6","unresolved":false,"context_lines":[{"line_number":522,"context_line":"            if (security_groups and not ("},{"line_number":523,"context_line":"                    network[\u0027subnets\u0027]"},{"line_number":524,"context_line":"                    and network.get(\u0027port_security_enabled\u0027, True))):"},{"line_number":525,"context_line":"                port_security_group_ids \u003d None"},{"line_number":526,"context_line":"            request.network_id \u003d network[\u0027id\u0027]"},{"line_number":527,"context_line":"            zone \u003d \u0027compute:%s\u0027 % instance.availability_zone"},{"line_number":528,"context_line":"            port_req_body \u003d {\u0027port\u0027: {\u0027device_id\u0027: instance.uuid,"}],"source_content_type":"text/x-python","patch_set":7,"id":"7aaa499b_d5755798","line":525,"updated":"2015-04-14 22:50:14.000000000","message":"nova boot --security-groups ... --nic net_id\u003dxxx ...\n\nwhere xxx has port_security_enabled\u003dFalse, it will launch an instance with no warning, return an instance object with specified security groups, but the instance ports will not have security groups. This behavior doesn\u0027t look correct for me.","commit_id":"cbb2cf357a770049fd267e9b8222c75b3a7a081b"},{"author":{"_account_id":10583,"name":"Praveen Yalagandula","email":"ypraveen@gmail.com","username":"ypraveen"},"change_message_id":"5fad28e1bc931e5821689dd247926bc24100d6ce","unresolved":false,"context_lines":[{"line_number":522,"context_line":"            if (security_groups and not ("},{"line_number":523,"context_line":"                    network[\u0027subnets\u0027]"},{"line_number":524,"context_line":"                    and network.get(\u0027port_security_enabled\u0027, True))):"},{"line_number":525,"context_line":"                port_security_group_ids \u003d None"},{"line_number":526,"context_line":"            request.network_id \u003d network[\u0027id\u0027]"},{"line_number":527,"context_line":"            zone \u003d \u0027compute:%s\u0027 % instance.availability_zone"},{"line_number":528,"context_line":"            port_req_body \u003d {\u0027port\u0027: {\u0027device_id\u0027: instance.uuid,"}],"source_content_type":"text/x-python","patch_set":7,"id":"3afb71cf_e7d255d0","line":525,"in_reply_to":"7aaa499b_d5755798","updated":"2015-06-11 01:34:51.000000000","message":"Once someone uses neutron commands to modify the security-related parameters (port-security-enabled flag on network or explicitly adding/deleting security-groups from ports), then all bets are off from the nova perspective. So, I don\u0027t think either behavior (either throwing error or not throwing error) is incorrect.\n\nTo give one more example, suppose someone creates a port P1, modifies the security-group of port P1 to S1, and then performs the following:\nnova boot --security-groups S2,S3 --nic port-id\u003dP1 ...\nShould we disallow that operation? If we indeed allow that, we will either need to change port P1\u0027s security groups or not apply S2 and S3 to P1 -- either of those options will be incorrect.\n\nMy argument is that as long as someone is using only nova commands for setting up their vms, we should guarantee a consistent behavior. Once they know that they have neutron for security groups and start using neutron commands for fudging the network/port security properties, then nova security-group semantics don\u0027t need to be applied.","commit_id":"cbb2cf357a770049fd267e9b8222c75b3a7a081b"}],"nova/tests/unit/network/test_neutronv2.py":[{"author":{"_account_id":8412,"name":"Mike Durnosvistov","email":"glacierr.dev@gmail.com","username":"mdurnosvistov"},"change_message_id":"d83ec2ebf845d0fc1598666a5ea97a953fe8b548","unresolved":false,"context_lines":[{"line_number":398,"context_line":"              openstack_driver.get_openstack_security_group_driver())"},{"line_number":399,"context_line":"        security_groups \u003d []"},{"line_number":400,"context_line":"        if \u0027security_groups\u0027 in kwargs:"},{"line_number":401,"context_line":"            security_groups \u003d ([{\u0027name\u0027: sg, \u0027id\u0027: (sg + \u0027-uuid\u0027)}"},{"line_number":402,"context_line":"                                  for sg in kwargs[\u0027security_groups\u0027]])"},{"line_number":403,"context_line":"            self.mox.StubOutWithMock(api.security_group_api,"},{"line_number":404,"context_line":"                                     \u0027get_instance_security_groups\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a80dd14_5bba356f","line":401,"range":{"start_line":401,"start_character":30,"end_line":401,"end_character":31},"updated":"2015-03-17 14:54:21.000000000","message":"Please get rid of these redundant brackets `(...)`","commit_id":"a961ae9b39a6052da7ad38c015f6ea958d8e8cbe"}]}