The "Default" Security Group Is a Confusing Name

um. The default group is applied by default afaik.

John, if you can reproduce instances being created without the default security group, please provide instructions

The relevant code in nova/compute/api.py is:

 # Use 'default' security_group if none specified.
        if security_groups is None:
            security_groups = ['default']
        elif not isinstance(security_groups, list):
            security_groups = [security_groups]
        instance['security_groups'] = security_groups

and in _create_instance:

        if not security_group:
            security_group = 'default'

Sorry guys, I filed this with the wrong information... This is invalid. You are both correct, it IS indeed applied by default.