Merge lp:~freyes/openstack-charm-testing/fix-port_security into lp:openstack-charm-testing

[Felipe Reyes]

Support underclouds where port_security extension is disabled

Some clouds may have the port_security ml2 extension disabled, in those envs
at port creation the port_security_enabled property shouldn't be passed.

[Billy Olsen (billy-olsen)]

Per our conversation in IRC, its probably better to have the cloud declare its capabilities and the code take that into account.

review: Needs Fixing

[David Coronel (davecore)]

In my stsstack, this code failed with:

Traceback (most recent call last):
  File "./bin/post-deploy-config", line 160, in <module>
    del new_port['port_security_enabled']
KeyError: 'port_security_enabled'

(full pastebin https://pastebin.canonical.com/193011/)

I commented out two lines:

"port_security_enabled": False,
del new_port['port_security_enabled']

And the script went through successfully.

[Billy Olsen (billy-olsen)]

davecore - yeah that's a good point. The del line should be:

del new_port['port']['port_security_enabled']

However, I think with the changes that Felipe and I discussed it would add the port_security_enabled flag to the port properties if the under-cloud's profile states it supports it.

[Ryan Beisner (1chb1n)]

The code repo for this project is now at the following location:
https://github.com/openstack-charmers/openstack-charm-testing

review: Needs Resubmitting

Unmerged revisions

300. By Felipe Reyes on 2017-07-07

Support underclouds where port_security extension is disabled

Some clouds may have the port_security ml2 extension disabled, in those envs
at port creation the port_security_enabled property shouldn't be passed.

=== modified file 'bin/post-deploy-config'
--- bin/post-deploy-config	2017-04-11 15:57:54 +0000
+++ bin/post-deploy-config	2017-07-07 22:25:37 +0000
@@ -8,6 +8,7 @@
 import novaclient
 
 from neutronclient.v2_0 import client as ne_client
+from neutronclient.common import exceptions
 from novaclient import client as no_client
 
 import keystoneauth1.identity.v3 as keystoneauth1
@@ -124,15 +125,21 @@
         if data_port is None:
             # Attach a new port
             print("Attaching interface to instance {}".format(uuid))
-            new_port =  {
-                "port": {
-                    "admin_state_up": True,
-                    "name": "data-port",
-                    "network_id": net_id,
-                    "port_security_enabled": False,
+            try:
+                new_port =  {
+                    "port": {
+                        "admin_state_up": True,
+                        "name": "data-port",
+                        "network_id": net_id,
+                        "port_security_enabled": False,
+                    }
                 }
-            }
-            result = neutron.create_port(body=new_port)
+                result = neutron.create_port(body=new_port)
+            except exceptions.BadRequest as ex:
+                # when the port_security extension is disabled, it will fail
+                del new_port['port_securtiy_enabled']
+                result = neutron.create_port(body=new_port)
+
             result = server.interface_attach(port_id=result['port']['id'],
                                              net_id=None,
                                              fixed_ip=None).to_dict()