joinedload_all will load all of the objects in the chain so lines 171 and 179 are redundant and can be removed.
Also, have you tested with --use_nova_chains as well?
Finally, do you think that the we be iptables security groups is strictly superior to nwfilter security groups? Should we continue to support the other driver or deprecate it?
Minor issue:
171 options( joinedload( 'security_ groups' )).\ joinedload_ all('security_ groups. rules') ).\
172 + options(
joinedload_all will load all of the objects in the chain so lines 171 and 179 are redundant and can be removed.
Also, have you tested with --use_nova_chains as well?
Finally, do you think that the we be iptables security groups is strictly superior to nwfilter security groups? Should we continue to support the other driver or deprecate it?