juju instances not including the "default" security group

not quite the same, but juju environments also have a default group that
this these rules can be applied to once per env.

On Tue, Nov 19, 2013 at 10:43 PM, Haw Loeung <email address hidden>wrote:

> ** Also affects: juju-core
> Importance: Undecided
> Status: New
>
> ** Also affects: juju-core (Ubuntu)
> Importance: Undecided
> Status: New
>
> --
> You received this bug notification because you are subscribed to pyjuju.
> https://bugs.launchpad.net/bugs/1129720
>
> Title:
> juju instances not including the "default" security group
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/juju/+bug/1129720/+subscriptions
>

I'm not sure adding the default group is the right fix for wanting ad-hoc per environment rules. I'd prefer if juju started tolerating external tampering with the environment-specific juju group it adds to all machines it creates. We could potentially report via status any addition ports opened.

There are arguments in all directions depending on the exact use-case though. In cases where you have more than one environment on the same cloud account (for instance, a staging and a live deployment), the fact the default group applies to both could cause issues, would be impossible to monitor/alter one without affecting the other. If the account is also used for non-juju work, sharing rules via the default group could be either a convenience or a hole.

Since some deployments will want the global default group added to Juju machines and others not, we've decided to make it configurable - the default is false so existing behaviour is preserved. But deployments that want to use the default group can do so but changing the config option to true.

This bug was fixed in the package juju-core - 1.17.6-0ubuntu1

---------------
juju-core (1.17.6-0ubuntu1) trusty; urgency=medium

  * New upstream point release, including fixes for:
    - br0 not bought up by cloud-init with MAAS provider (LP: #1271144).
    - ppc64el enablement for juju/lxc (LP: #1273769).
    - juju userdata should not restart networking (LP: #1248283).
    - error detecting hardware characteristics (LP: #1276909).
    - juju instances not including the default security group (LP: #1129720).
    - juju bootstrap does not honor https_proxy (LP: #1240260).
  * d/control,rules: Drop BD on bash-completion, install bash-completion
    direct from upstream source code.
  * d/rules: Set HOME prior to generating man pages.
  * d/control: Drop alternative dependency on mongodb-server; juju now only
    works on trusty with juju-mongodb.
 -- James Page <email address hidden> Mon, 24 Mar 2014 16:05:44 +0000