yahoo-eng-team team mailing list archive

[ding bo <longddropt@xxxxxxx>]

Public bug reported:

For some mechanism drivers, it is important to know the full information
of a newly created security group in pre commit message including
security group id and default rules. The reason is that, some mechanism
drivers should write every operations on a journal table to sync neutron
operations to their own south-bound controller. In order to ensure ACID,
they must sync into journal table in the pre commit phase instead post
commit phase. However, the whole information only can be known in post
commit message of security group creation. So, we should enrich such
information in the pre commit message.

Related code:
    def create_security_group(self, context, security_group, default_sg=False):
        """Create security group.
        If default_sg is true that means we are a default security group for
        a given tenant if it does not exist.
        """
        s = security_group['security_group']
        kwargs = {
            'context': context,
            'security_group': s,
            'is_default': default_sg,
        }

        self._registry_notify(resources.SECURITY_GROUP, events.BEFORE_CREATE,
                              exc_cls=ext_sg.SecurityGroupConflict, **kwargs)

        tenant_id = s['tenant_id']

        if not default_sg:
            self._ensure_default_security_group(context, tenant_id)

        with db_api.autonested_transaction(context.session):
            security_group_db = sg_models.SecurityGroup(id=s.get('id') or (
                                              uuidutils.generate_uuid()),
                                              description=s['description'],
                                              tenant_id=tenant_id,
                                              name=s['name'])
            context.session.add(security_group_db)
            if default_sg:
                context.session.add(sg_models.DefaultSecurityGroup(
                    security_group=security_group_db,
                    tenant_id=security_group_db['tenant_id']))
            for ethertype in ext_sg.sg_supported_ethertypes:
                if default_sg:
                    # Allow intercommunication
                    ingress_rule = sg_models.SecurityGroupRule(
                        id=uuidutils.generate_uuid(), tenant_id=tenant_id,
                        security_group=security_group_db,
                        direction='ingress',
                        ethertype=ethertype,
                        source_group=security_group_db)
                    context.session.add(ingress_rule)

                egress_rule = sg_models.SecurityGroupRule(
                    id=uuidutils.generate_uuid(), tenant_id=tenant_id,
                    security_group=security_group_db,
                    direction='egress',
                    ethertype=ethertype)
                context.session.add(egress_rule)

            self._registry_notify(resources.SECURITY_GROUP,
                                  events.PRECOMMIT_CREATE,
                                  exc_cls=ext_sg.SecurityGroupConflict,
                                  **kwargs)

        secgroup_dict =
self._make_security_group_dict(security_group_db)

        kwargs['security_group'] = secgroup_dict
        registry.notify(resources.SECURITY_GROUP, events.AFTER_CREATE, self,
                        **kwargs)
        return secgroup_dict

https://github.com/openstack/neutron/blob/master/neutron/db/securitygroups_db.py#L121

** Affects: neutron
     Importance: Undecided
     Assignee: ding bo (longddropt)
         Status: New

** Changed in: neutron
     Assignee: (unassigned) => ding bo (longddropt)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1614340

Title:
  DB consistency: lack of  full security group information when notify
  precommit message of security group creating

Status in neutron:
  New

Bug description:
  For some mechanism drivers, it is important to know the full
  information of a newly created security group in pre commit message
  including security group id and default rules. The reason is that,
  some mechanism drivers should write every operations on a journal
  table to sync neutron operations to their own south-bound controller.
  In order to ensure ACID, they must sync into journal table in the pre
  commit phase instead post commit phase. However, the whole information
  only can be known in post commit message of security group creation.
  So, we should enrich such information in the pre commit message.

  Related code:
      def create_security_group(self, context, security_group, default_sg=False):
          """Create security group.
          If default_sg is true that means we are a default security group for
          a given tenant if it does not exist.
          """
          s = security_group['security_group']
          kwargs = {
              'context': context,
              'security_group': s,
              'is_default': default_sg,
          }

          self._registry_notify(resources.SECURITY_GROUP, events.BEFORE_CREATE,
                                exc_cls=ext_sg.SecurityGroupConflict, **kwargs)

          tenant_id = s['tenant_id']

          if not default_sg:
              self._ensure_default_security_group(context, tenant_id)

          with db_api.autonested_transaction(context.session):
              security_group_db = sg_models.SecurityGroup(id=s.get('id') or (
                                                uuidutils.generate_uuid()),
                                                description=s['description'],
                                                tenant_id=tenant_id,
                                                name=s['name'])
              context.session.add(security_group_db)
              if default_sg:
                  context.session.add(sg_models.DefaultSecurityGroup(
                      security_group=security_group_db,
                      tenant_id=security_group_db['tenant_id']))
              for ethertype in ext_sg.sg_supported_ethertypes:
                  if default_sg:
                      # Allow intercommunication
                      ingress_rule = sg_models.SecurityGroupRule(
                          id=uuidutils.generate_uuid(), tenant_id=tenant_id,
                          security_group=security_group_db,
                          direction='ingress',
                          ethertype=ethertype,
                          source_group=security_group_db)
                      context.session.add(ingress_rule)

                  egress_rule = sg_models.SecurityGroupRule(
                      id=uuidutils.generate_uuid(), tenant_id=tenant_id,
                      security_group=security_group_db,
                      direction='egress',
                      ethertype=ethertype)
                  context.session.add(egress_rule)

              self._registry_notify(resources.SECURITY_GROUP,
                                    events.PRECOMMIT_CREATE,
                                    exc_cls=ext_sg.SecurityGroupConflict,
                                    **kwargs)

          secgroup_dict =
  self._make_security_group_dict(security_group_db)

          kwargs['security_group'] = secgroup_dict
          registry.notify(resources.SECURITY_GROUP, events.AFTER_CREATE, self,
                          **kwargs)
          return secgroup_dict

  https://github.com/openstack/neutron/blob/master/neutron/db/securitygroups_db.py#L121

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1614340/+subscriptions