OpenStack Compute (nova)

SecurityGroup exception when there are no subnets

Bug #1252410 reported by Brent Eagles
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Fix Released
High
Aaron Rosen
OpenStack Compute (nova) 2014.1 "icehouse"

Bug Description

When booting an instance with a network that has no defined subnets (i.e. you want the instance to have a network interface but not to have the address range managed by neutron), the nova/neutron integration code throws a SecurityGroupCannotBeApplied exception. At the moment, nova does not have the ability to indicate that no SecurityGroup is required (omitting it results in the default group being assumed).

To reproduce:

1. create a network -- do not create a subnet!
2. boot a vm a-la "nova boot --image foo --nic net-id=[uuid for aforementioned network] foovm"

Result:
VM fails to boot, enters ERROR state

Tags: network
Revision history for this message
Armando Migliaccio (armando-migliaccio) wrote :

As you said, Nova does not have the ability to disable security groups for an instance. From the code that raises the fault, it looks like this is by design. Furthermore I don't think this is a Neutron bug.

Changed in neutron:
status: New → Invalid
Changed in nova:
status: New → Confirmed
Sahid Orentino (sahid-ferdjaoui)
Changed in nova:
assignee: nobody → sahid (sahid-ferdjaoui)
Aaron Rosen (arosen)
no longer affects: neutron
Changed in nova:
assignee: sahid (sahid-ferdjaoui) → Aaron Rosen (arosen)
importance: Undecided → High
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to nova (master)

Fix proposed to branch: master
Review: https://review.openstack.org/79801

Changed in nova:
status: Confirmed → In Progress
Aaron Rosen (arosen)
tags: added: icehouse-rc-potential network
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to nova (master)

Reviewed: https://review.openstack.org/79801
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=00fca51036ac377f083613c03a25c3e8e5b077db
Submitter: Jenkins
Branch: master

commit 00fca51036ac377f083613c03a25c3e8e5b077db
Author: Aaron Rosen <email address hidden>
Date: Tue Mar 11 16:12:33 2014 -0700

    Raise error on nova-api if missing subnets/fixed_ips on networks/port

    Previously, if one would launch an instance on a network that did not contain
    any subnets or on a port that did not have a fixedip the instance would fail
    to boot resulting in a SecurityGroupCannotBeApplied on the nova-compute node.
    This patch adds checks to validate networks so it fails on nova-api and
    the user will be able to see why from the response.

    Note: a patch to fix the neutron port-security-enabled extension will
    follow which allows one to boot instances on networks without subnets
    and ports without fixedips.

    Change-Id: I104d5234b34726e5f5819fc2a81eef55e3c70f42
    Closes-bug: 1252410

Changed in nova:
status: In Progress → Fix Committed
Russell Bryant (russellb)
Changed in nova:
milestone: none → icehouse-rc1
Thierry Carrez (ttx)
Changed in nova:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in nova:
milestone: icehouse-rc1 → 2014.1
Matt Riedemann (mriedem)
tags: removed: icehouse-rc-potential
Stephen Gordon (sgordon)
tags: added: nfv
Revision history for this message
Aaron Rosen (arosen) wrote :

I don't think adding a new tag of nfv helps us here.

tags: removed: nfv
Revision history for this message
Stephen Gordon (sgordon) wrote :

The intent is to enable tracking by the recently formed NFV subteam. I'm open to suggestions as to how to better track related LP entries though.

tags: added: nfv
Revision history for this message
Stephen Gordon (sgordon) wrote :

Nevermind, I have tagged the outstanding bug/change instead:

https://bugs.launchpad.net/nova/+bug/1175464

tags: removed: nfv
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.