{"action":"created","issue":{"url":"https://api.github.com/repos/Metaswitch/calico/issues/652","labels_url":"https://api.github.com/repos/Metaswitch/calico/issues/652/labels{/name}","comments_url":"https://api.github.com/repos/Metaswitch/calico/issues/652/comments","events_url":"https://api.github.com/repos/Metaswitch/calico/issues/652/events","html_url":"https://github.com/Metaswitch/calico/issues/652","id":88347075,"number":652,"title":"Properly consume Neutron security group updates","user":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Metaswitch/calico/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/Metaswitch/calico/labels/neutron%20driver","name":"neutron driver","color":"009800"}],"state":"open","locked":false,"assignee":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/Metaswitch/calico/milestones/3","html_url":"https://github.com/Metaswitch/calico/milestones/1.0","labels_url":"https://api.github.com/repos/Metaswitch/calico/milestones/3/labels","id":1074686,"number":3,"title":"1.0","description":"","creator":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":34,"state":"open","created_at":"2015-04-20T07:33:48Z","updated_at":"2015-07-06T08:22:06Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2015-06-15T07:38:12Z","updated_at":"2015-07-08T08:35:08Z","closed_at":null,"body":"Assuming #641 is merged, we'll be relying on a fairly brittle monkeypatch to get hold of security group updates on Neutron. This is fundamentally because the ML2 model takes control out of our hands, assuming that the mechanism driver does not want access to security group rule changes.\r\n\r\nWe should aim to write code that does this properly. There are a few ways I can see of doing it:\r\n\r\n1. Become a fully-fledged Neutron plugin. My understanding is that proper plugins get access to the full set of data, which means we can properly handle SG calls.\r\n2. Write an 'agent' (may be an extension to the ML2 Mechanism Driver) that can run as a Firewall Driver. Neutron expects this to run as a proper agent, which doesn't really suit us, because we'd need to run one per machine. Painful.\r\n3. Attempt to lie to Neutron by consuming the security group AMQP RPC mechanism ourselves. This is also probably quite painful, and additionally will require us to write quite a lot of backing code.\r\n\r\nI'm not really sure what the best approach here would be. It'd be good if @neiljerram could consider this problem a little bit: @fasaxc as well.\r\n\r\n**Edit**: For clarity, I want to add a bit more explanation about what's going on here.\r\n\r\nCurrently what we have in our code is a bit of code that monkeypatches Neutron on import. This changes Neutron code on the fly whenever Calico is imported.\r\n\r\nDoing this essentially pins us to an unstable interface, because the Neutron folks will rightly consider themselves able to change this code at any time without telling us. This runs the very real risk of breaking us down the road with absolutely no warning. Customers will believe they can take patches that they cannot safely take. Additionally, the maintenance burden of maintaining several *different* monkeypatches will be tricky.\r\n\r\nThis interface *has* been stable for our three currently-supported releases (Icehouse, Juno, Kilo), but there is no guarantee that it will remain stable, even within patch releases of those versions. This makes this code essentially a ticking time-bomb, waiting to make our lives difficult at a time we don't control.\r\n\r\nTo do this right we really need to find a supported interface. Right now the only appropriate supported interface for security groups is an RPC-based one that expects an agent, which is a bit annoying, but we can handle that. We're interested in whether we can get a better option, or whether we have to write an agent to consume that interface."},"comment":{"url":"https://api.github.com/repos/Metaswitch/calico/issues/comments/119495372","html_url":"https://github.com/Metaswitch/calico/issues/652#issuecomment-119495372","issue_url":"https://api.github.com/repos/Metaswitch/calico/issues/652","id":119495372,"user":{"login":"Lukasa","id":1382556,"avatar_url":"https://avatars.githubusercontent.com/u/1382556?v=3","gravatar_id":"","url":"https://api.github.com/users/Lukasa","html_url":"https://github.com/Lukasa","followers_url":"https://api.github.com/users/Lukasa/followers","following_url":"https://api.github.com/users/Lukasa/following{/other_user}","gists_url":"https://api.github.com/users/Lukasa/gists{/gist_id}","starred_url":"https://api.github.com/users/Lukasa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lukasa/subscriptions","organizations_url":"https://api.github.com/users/Lukasa/orgs","repos_url":"https://api.github.com/users/Lukasa/repos","events_url":"https://api.github.com/users/Lukasa/events{/privacy}","received_events_url":"https://api.github.com/users/Lukasa/received_events","type":"User","site_admin":false},"created_at":"2015-07-08T08:35:08Z","updated_at":"2015-07-08T08:35:08Z","body":"New plan.\r\n\r\nGiven that this change is going to be in Liberty we're going to do the following:\r\n\r\n1. When Liberty drops, update the mechanism driver to use the proper interface where it is available.\r\n2. Assume that the odds of the Neutron team breaking the interface we monkeypatched *midcycle* in Icehouse, Juno, or Kilo is really low, and that we can detect it early.\r\n3. As a result, not bother to backport the work to those releases.\r\n\r\nThat is the most efficient use of our time, so for now that's what we'll do."}}