Merge lp:~james-page/charms/precise/nova-cloud-controller/quantum-security-support into lp:~charmers/charms/precise/nova-cloud-controller/trunk

[James Page]

Add support for:

1) Quantum based security rules

2) Per-tenant Quantum quotas

Only supported in >= grizzly.

[Adam Gandelman (gandelman-a)]

Comparing the strings in [ ]'s will always evaluate to true:

$ [ "essex" > "folsom" ] && echo "True"
True

Needs use [[ ]]'s:

$ [[ "essex" > "folsom" ]] && echo "True"
$ [[ "folsom" > "folsom" ]] && echo "True"
$ [[ "grizzly" > "folsom" ]] && echo "True"
True

or 'dpkg --compare-versions' on the version number instead (like the corresponding nova-c-c merge)

review: Needs Fixing

[lp:~james-page/charms/precise/nova-cloud-controller/quantum-security-support]

54. By James Page on 2013-06-13

Tweak version checking to use dpkg --compare-versions

[James Page (james-page)]

review: Needs Resubmitting

=== modified file 'config.yaml'
--- config.yaml	2013-02-20 01:47:54 +0000
+++ config.yaml	2013-06-13 11:09:47 +0000
@@ -64,6 +64,13 @@
       .
       This configuration only has context when used with
       network-manager Quantum.
+  quantum-security-groups:
+    type: string
+    default: "no"
+    description: |
+      Use quantum for security group management.
+      .
+      Only supported for >= grizzly.
   conf-ext-net:
     type: string
     default: "no"

=== modified file 'hooks/lib/nova/nova-common'
--- hooks/lib/nova/nova-common	2013-04-25 17:46:54 +0000
+++ hooks/lib/nova/nova-common	2013-06-13 11:09:47 +0000
@@ -88,12 +88,33 @@
       set_or_update "quantum_auth_strategy" "keystone"
       set_or_update "core_plugin" "$QUANTUM_CORE_PLUGIN" "$QUANTUM_CONF"
       set_or_update "bind_host" "0.0.0.0" "$QUANTUM_CONF"
+      local cur="$(get_os_codename_package "nova-common")"
+      local vers=$(get_os_version_codename $cur)
+      if dpkg --compare-versions $vers ge '2013.1'; then
+        # Configure per-tenant managed quotas - >= grizzly only
+        set_or_update "quota_driver" "quantum.db.quota_db.DbQuotaDriver" \
+                      "$QUANTUM_CONF" "QUOTAS"
+      fi
       if [ "$QUANTUM_PLUGIN" == "ovs" ]; then
           set_or_update "tenant_network_type" "gre" $QUANTUM_PLUGIN_CONF "OVS"
           set_or_update "enable_tunneling" "True" $QUANTUM_PLUGIN_CONF "OVS"
           set_or_update "tunnel_id_ranges" "1:1000" $QUANTUM_PLUGIN_CONF "OVS"
           set_or_update "local_ip" "$local_ip" $QUANTUM_PLUGIN_CONF "OVS"
       fi
+      if [ "$(config-get quantum-security-groups)" == "yes" ] && \
+         dpkg --compare-versions $vers ge '2013.1'; then
+          set_or_update "security_group_api" "quantum"
+          set_or_update "firewall_driver" "nova.virt.firewall.NoopFirewallDriver"
+          set_or_update "allow_overlapping_ips" "True" $QUANTUM_CONF
+          if [ "$QUANTUM_PLUGIN" == "ovs" ]; then
+              set_or_update "firewall_driver" \
+                "quantum.agent.linux.iptables_firewall.OVSHybridIptablesFirewallDriver" \
+                $QUANTUM_PLUGIN_CONF "SECURITYGROUP"
+          fi
+          # Ensure that security_group_* is included in quota'ed resources
+          set_or_update "quota_items" "network,subnet,port,security_group,security_group_rule" \
+                        $QUANTUM_CONF "QUOTAS"
+      fi
       ;;
     *) juju-log "ERROR: Invalid network manager $1" && exit 1 ;;
   esac

=== modified file 'hooks/nova-cloud-controller-relations'
--- hooks/nova-cloud-controller-relations	2013-04-30 23:44:54 +0000
+++ hooks/nova-cloud-controller-relations	2013-06-13 11:09:47 +0000
@@ -459,7 +459,6 @@
         service_password=$(local_config_get $API_CONF admin_password $sect) \
         service_tenant=$(local_config_get $API_CONF admin_tenant_name $sect) \
         auth_uri=$(local_config_get $API_CONF auth_uri $sect)
-
     fi
     is_clustered && local host=$(config-get vip) ||
       local host=$(unit-get private-address)
@@ -468,7 +467,8 @@
 
     relation-set $r_id quantum_url=$quantum_url \
                        quantum_plugin=$(config-get quantum-plugin) \
-                       region=$(config-get region)
+                       region=$(config-get region) \
+                       quantum_security_groups=$(config-get quantum-security-groups)
 
   fi