Merge lp:~thedac/openstack-mojo-specs/updated-os-clients into lp:openstack-mojo-specs

[David Ames]

Update mojo utilities for keystone v3 and Ocata clients

[lp:~thedac/openstack-mojo-specs/updated-os-clients]

308. By David Ames on 2017-04-13

Allow insecure SSL connections

309. By David Ames on 2017-04-13

Fixes for v3 Overcloud

[Ryan Beisner (1chb1n)]

review: Approve

=== modified file 'helper/setup/image_setup.py'
--- helper/setup/image_setup.py	2015-10-14 16:34:53 +0000
+++ helper/setup/image_setup.py	2017-04-13 21:13:22 +0000
@@ -8,8 +8,9 @@
 
 def main(argv):
     mojo_utils.setup_logging()
-    overcloud_novarc = mojo_utils.get_overcloud_auth()
-    glance_client = mojo_os_utils.get_glance_client(overcloud_novarc)
+    session = (
+        mojo_os_utils.get_keystone_session(mojo_utils.get_overcloud_auth()))
+    glance_client = mojo_os_utils.get_glance_session_client(session)
     current_images = mojo_os_utils.get_images_list(glance_client)
     image_config = mojo_utils.get_mojo_config('images.yaml')
     cache_dir = '/tmp/img_cache'
@@ -32,5 +33,6 @@
             image_config[image]['disk_format'],
             image_config[image]['container_format'])
 
+
 if __name__ == "__main__":
     sys.exit(main(sys.argv))

=== modified file 'helper/setup/keystone_setup.py'
--- helper/setup/keystone_setup.py	2016-03-31 07:58:12 +0000
+++ helper/setup/keystone_setup.py	2017-04-13 21:13:22 +0000
@@ -8,21 +8,21 @@
     mojo_utils.setup_logging()
     overcloud_novarc = mojo_utils.get_overcloud_auth()
     user_config = mojo_utils.get_mojo_config('keystone_users.yaml')
+    keystone_session = mojo_os_utils.get_keystone_session(overcloud_novarc)
+    keystone_client = (
+        mojo_os_utils.get_keystone_session_client(keystone_session))
     if overcloud_novarc.get('API_VERSION', 2) == 2:
-        keystone_client = mojo_os_utils.get_keystone_client(overcloud_novarc)
-        tenants = [user['tenant'] for user in user_config]
-        mojo_os_utils.tenant_create(keystone_client, tenants)
+        projects = [user['project'] for user in user_config]
+        mojo_os_utils.project_create(keystone_client, projects)
         mojo_os_utils.user_create_v2(keystone_client, user_config)
-        mojo_os_utils.add_users_to_roles(keystone_client, user_config)
+        # TODO validate this works without adding roles
+        # mojo_os_utils.add_users_to_roles(keystone_client, user_config)
     else:
-        keystone_session = mojo_os_utils.get_keystone_session(overcloud_novarc)
-        keystone_client = mojo_os_utils.get_keystone_session_client(
-            keystone_session)
         for user in user_config:
             mojo_os_utils.domain_create(keystone_client, [user['domain']])
-            mojo_os_utils.project_create(keystone_client, [user['tenant']],
+            mojo_os_utils.project_create(keystone_client, [user['project']],
                                          user['domain'])
-        mojo_os_utils.user_create_v3(keystone_client, user_config)
+    mojo_os_utils.user_create_v3(keystone_client, user_config)
 
 
 if __name__ == "__main__":

=== modified file 'helper/setup/keystone_users.yaml'
--- helper/setup/keystone_users.yaml	2016-03-31 07:44:24 +0000
+++ helper/setup/keystone_users.yaml	2017-04-13 21:13:22 +0000
@@ -1,14 +1,14 @@
 - email: [e-mail]
   password: pass
   roles: [_member_]
-  tenant: demo
+  project: demo
   username: demo
   domain: norwich
   scope: project
 - email: [e-mail]
   password: secret
   roles: [_member_]
-  tenant: alt_demo
+  project: alt_demo
   username: alt_demo
   domain: leeds
   scope: project

=== modified file 'helper/setup/network_setup.py'
--- helper/setup/network_setup.py	2016-07-22 09:24:59 +0000
+++ helper/setup/network_setup.py	2017-04-13 21:13:22 +0000
@@ -8,18 +8,11 @@
 
 def setup_sdn(net_topology, net_info):
     overcloud_novarc = mojo_utils.get_overcloud_auth()
-    # Get os clients
-    if overcloud_novarc.get('API_VERSION', 2) == 2:
-        # V2 explicitly, or assume V2 if not defined
-        keystonec = mojo_os_utils.get_keystone_client(overcloud_novarc)
-        neutronc = mojo_os_utils.get_neutron_client(overcloud_novarc)
-    else:
-        # Not V2
-        keystone_session = mojo_os_utils.get_keystone_session(overcloud_novarc)
-        keystonec = mojo_os_utils.get_keystone_session_client(keystone_session)
-        neutronc = mojo_os_utils.get_neutron_session_client(keystone_session)
-    # Resolve the tenant name from the overcloud novarc into a tenant id
-    tenant_id = mojo_os_utils.get_tenant_id(
+    keystone_session = mojo_os_utils.get_keystone_session(overcloud_novarc)
+    keystonec = mojo_os_utils.get_keystone_session_client(keystone_session)
+    neutronc = mojo_os_utils.get_neutron_session_client(keystone_session)
+    # Resolve the project name from the overcloud novarc into a project id
+    project_id = mojo_os_utils.get_project_id(
         keystonec,
         'admin',
         api_version=overcloud_novarc['API_VERSION']
@@ -27,42 +20,43 @@
     # Create the external network
     ext_network = mojo_os_utils.create_external_network(
         neutronc,
-        tenant_id,
+        project_id,
         net_info.get('dvr_enabled', False),
         net_info['external_net_name'])
     mojo_os_utils.create_external_subnet(
         neutronc,
-        tenant_id,
+        project_id,
         ext_network,
         net_info['default_gateway'],
         net_info['external_net_cidr'],
         net_info['start_floating_ip'],
         net_info['end_floating_ip'],
         net_info['external_subnet_name'])
-    provider_router = mojo_os_utils.create_provider_router(neutronc, tenant_id)
+    provider_router = (
+        mojo_os_utils.create_provider_router(neutronc, project_id))
     mojo_os_utils.plug_extnet_into_router(
         neutronc,
         provider_router,
         ext_network)
-    tenant_network = mojo_os_utils.create_tenant_network(
+    project_network = mojo_os_utils.create_project_network(
         neutronc,
-        tenant_id,
+        project_id,
         shared=False,
         network_type=net_info['network_type'])
-    tenant_subnet = mojo_os_utils.create_tenant_subnet(
+    project_subnet = mojo_os_utils.create_project_subnet(
         neutronc,
-        tenant_id,
-        tenant_network,
+        project_id,
+        project_network,
         net_info['private_net_cidr'])
     mojo_os_utils.update_subnet_dns(
         neutronc,
-        tenant_subnet,
+        project_subnet,
         net_info['external_dns'])
     mojo_os_utils.plug_subnet_into_router(
         neutronc,
         net_info['router_name'],
-        tenant_network,
-        tenant_subnet)
+        project_network,
+        project_subnet)
 
 
 def main(argv):
@@ -84,9 +78,10 @@
     # Handle network for Openstack-on-Openstack scenarios
     if mojo_utils.get_provider_type() == 'openstack':
         logging.info('Configuring network for OpenStack undercloud/provider')
-        undercloud_novarc = mojo_utils.get_undercloud_auth()
-        novac = mojo_os_utils.get_nova_client(undercloud_novarc)
-        neutronc = mojo_os_utils.get_neutron_client(undercloud_novarc)
+        session = mojo_os_utils.get_keystone_session(
+                       mojo_utils.get_undercloud_auth())
+        novac = mojo_os_utils.get_nova_session_client(session)
+        neutronc = mojo_os_utils.get_neutron_session_client(session)
 
         # Add an interface to the neutron-gateway units and tell juju to use it
         # as the external port.

=== modified file 'helper/tests/simple_os_checks.py'
--- helper/tests/simple_os_checks.py	2016-10-03 10:21:13 +0000
+++ helper/tests/simple_os_checks.py	2017-04-13 21:13:22 +0000
@@ -43,7 +43,7 @@
 def main(argv):
     mojo_utils.setup_logging()
     parser = argparse.ArgumentParser()
-    default_machines = ["precise:m1.small:1", "cirros:m1.tiny:1"]
+    default_machines = ["cirros:m1.tiny:1"]
     parser.add_argument("machines", default=default_machines, nargs="*")
     parser.add_argument("--active_wait", default=180)
     parser.add_argument("--cloudinit_wait", default=180)
@@ -54,22 +54,28 @@
     cloudinit_wait = int(mojo_utils.parse_mojo_arg(options, 'cloudinit_wait'))
     ping_wait = int(mojo_utils.parse_mojo_arg(options, 'ping_wait'))
     overcloud_novarc = mojo_utils.get_overcloud_auth()
-    if overcloud_novarc.get('API_VERSION', 2) == 2:
-        novac = mojo_os_utils.get_nova_client(overcloud_novarc)
-    else:
-        keystone_session = mojo_os_utils.get_keystone_session(overcloud_novarc,
-                                                              scope='PROJECT')
-        novac = mojo_os_utils.get_nova_session_client(keystone_session)
+    keystone_session = mojo_os_utils.get_keystone_session(overcloud_novarc,
+                                                          scope='PROJECT')
+    keystonec = mojo_os_utils.get_keystone_session_client(keystone_session)
+    domain = overcloud_novarc.get('OS_PROJECT_DOMAIN_NAME')
+    project_id = mojo_os_utils.get_project_id(
+        keystonec,
+        'admin',
+        api_version=overcloud_novarc['API_VERSION'],
+        domain_name=domain
+    )
+    novac = mojo_os_utils.get_nova_session_client(keystone_session)
+    neutronc = mojo_os_utils.get_neutron_session_client(keystone_session)
+
     init_flavors(novac)
 
     priv_key = mojo_os_utils.create_keypair(novac, 'mojo')
-    mojo_os_utils.add_secgroup_rules(novac)
-    print(novac.servers.list())
+    mojo_os_utils.add_neutron_secgroup_rules(neutronc, project_id)
     for server in novac.servers.list():
         novac.servers.delete(server.id)
     for instanceset in machines:
         image_name, flavor_name, count = instanceset.split(":")
-        mojo_os_utils.boot_and_test(novac,
+        mojo_os_utils.boot_and_test(novac, neutronc,
                                     image_name=image_name,
                                     flavor_name=flavor_name,
                                     number=int(count),

=== modified file 'helper/tests/test_obj_store.py'
--- helper/tests/test_obj_store.py	2016-09-22 21:25:04 +0000
+++ helper/tests/test_obj_store.py	2017-04-13 21:13:22 +0000
@@ -47,8 +47,9 @@
                 self.failures += 1
 
     def get_swiftclient(self):
-        overcloud_novarc = mojo_utils.get_overcloud_auth()
-        swift_client = mojo_os_utils.get_swift_client(overcloud_novarc)
+        keystone_session = mojo_os_utils.get_keystone_session(
+                               mojo_utils.get_overcloud_auth())
+        swift_client = mojo_os_utils.get_swift_session_client(keystone_session)
         return swift_client
 
     def get_checkstring(self, fname):
@@ -82,5 +83,6 @@
     if thread2.failures > 0:
         sys.exit(1)
 
+
 if __name__ == "__main__":
     sys.exit(main(sys.argv))

=== modified file 'helper/utils/kiki.py'
--- helper/utils/kiki.py	2017-03-03 21:44:03 +0000
+++ helper/utils/kiki.py	2017-04-13 21:13:22 +0000
@@ -156,6 +156,7 @@
                                      "command structure")
     return True
 
+
 # Assert this is a valid version of Juju immediately
 assert supported_juju_version()
 

=== modified file 'helper/utils/mojo_os_utils.py'
--- helper/utils/mojo_os_utils.py	2017-01-25 15:27:59 +0000
+++ helper/utils/mojo_os_utils.py	2017-04-13 21:13:22 +0000
@@ -1,11 +1,15 @@
 #!/usr/bin/python
 
+
 import swiftclient
 import glanceclient
 from keystoneclient.v2_0 import client as keystoneclient_v2
-from keystoneclient.auth.identity import v3
 from keystoneclient.v3 import client as keystoneclient_v3
-from keystoneclient import session
+from keystoneauth1 import session
+from keystoneauth1.identity import (
+    v3,
+    v2,
+)
 import mojo_utils
 from novaclient import client as novaclient_client
 from neutronclient.v2_0 import client as neutronclient
@@ -23,24 +27,20 @@
 
 # Openstack Client helpers
 def get_nova_creds(cloud_creds):
-    auth = {
-        'username': cloud_creds['OS_USERNAME'],
-        'api_key': cloud_creds['OS_PASSWORD'],
-        'auth_url': cloud_creds['OS_AUTH_URL'],
-        'project_id': cloud_creds['OS_TENANT_NAME'],
-        'region_name': cloud_creds['OS_REGION_NAME'],
-    }
+    auth = get_ks_creds(cloud_creds)
+    if os.environ.get('OS_PROJECT_ID'):
+        auth['project_id'] = os.environ.get('OS_PROJECT_ID')
     return auth
 
 
-def get_ks_creds(cloud_creds, scope='DOMAIN'):
+def get_ks_creds(cloud_creds, scope='PROJECT'):
     if cloud_creds.get('API_VERSION', 2) == 2:
         auth = {
             'username': cloud_creds['OS_USERNAME'],
             'password': cloud_creds['OS_PASSWORD'],
             'auth_url': cloud_creds['OS_AUTH_URL'],
-            'tenant_name': cloud_creds['OS_TENANT_NAME'],
-            'region_name': cloud_creds['OS_REGION_NAME'],
+            'tenant_name': (cloud_creds.get('OS_PROJECT_NAME') or
+                            cloud_creds['OS_TENANT_NAME']),
         }
     else:
         if scope == 'DOMAIN':
@@ -95,10 +95,13 @@
     return neutronclient.Client(session=session)
 
 
-def get_keystone_session(novarc_creds, scope='DOMAIN'):
+def get_keystone_session(novarc_creds, insecure=True, scope='PROJECT'):
     keystone_creds = get_ks_creds(novarc_creds, scope=scope)
-    auth = v3.Password(**keystone_creds)
-    return session.Session(auth=auth)
+    if novarc_creds.get('API_VERSION', 2) == 2:
+        auth = v2.Password(**keystone_creds)
+    else:
+        auth = v3.Password(**keystone_creds)
+    return session.Session(auth=auth, verify=not insecure)
 
 
 def get_keystone_session_client(session):
@@ -108,8 +111,8 @@
 def get_keystone_client(novarc_creds, insecure=True):
     keystone_creds = get_ks_creds(novarc_creds)
     if novarc_creds.get('API_VERSION', 2) == 2:
-        keystone_creds['insecure'] = insecure
-        return keystoneclient_v2.Client(**keystone_creds)
+        sess = v2.Password(**keystone_creds)
+        return keystoneclient_v2.Client(session=sess)
     else:
         sess = v3.Password(**keystone_creds)
         return keystoneclient_v3.Client(session=sess)
@@ -121,6 +124,14 @@
     return swiftclient.client.Connection(**swift_creds)
 
 
+def get_swift_session_client(session):
+    return swiftclient.client.Connection(session=session)
+
+
+def get_glance_session_client(session):
+    return glanceclient.Client('1', session=session)
+
+
 def get_glance_client(novarc_creds, insecure=True):
     if novarc_creds.get('API_VERSION', 2) == 2:
         kc = get_keystone_client(novarc_creds)
@@ -128,7 +139,6 @@
                                                    endpoint_type='publicURL')
     else:
         keystone_creds = get_ks_creds(novarc_creds, scope='PROJECT')
-        logging.info(keystone_creds)
         kc = keystoneclient_v3.Client(**keystone_creds)
         glance_svc_id = kc.services.find(name='glance').id
         ep = kc.endpoints.find(service_id=glance_svc_id, interface='public')
@@ -176,14 +186,14 @@
             kclient.tenants.create(tenant_name=tenant)
 
 
-def project_create(kclient, projects, domain):
+def project_create(kclient, projects, domain=None):
     domain_id = None
     for dom in kclient.domains.list():
         if dom.name == domain:
             domain_id = dom.id
     current_projects = []
     for project in kclient.projects.list():
-        if project.domain_id == domain_id:
+        if not domain_id or project.domain_id == domain_id:
             current_projects.append(project.name)
     for project in projects:
         if project in current_projects:
@@ -213,24 +223,25 @@
                             'exists' % (user['username']))
         else:
             logging.info('Creating user %s' % (user['username']))
-            tenant_id = get_tenant_id(kclient, user['tenant'])
+            project_id = get_project_id(kclient, user['project'])
             kclient.users.create(name=user['username'],
                                  password=user['password'],
                                  email=user['email'],
-                                 tenant_id=tenant_id)
+                                 tenant_id=project_id)
 
 
 def user_create_v3(kclient, users):
     current_users = [user.name for user in kclient.users.list()]
     for user in users:
+        project = user.get('project') or user.get('tenant')
         if user['username'] in current_users:
             logging.warning('Not creating user %s it already'
                             'exists' % (user['username']))
         else:
             if user['scope'] == 'project':
                 logging.info('Creating user %s' % (user['username']))
-                project_id = get_tenant_id(kclient, user['tenant'],
-                                           api_version=3)
+                project_id = get_project_id(kclient, project,
+                                            api_version=3)
                 kclient.users.create(name=user['username'],
                                      password=user['password'],
                                      email=user['email'],
@@ -247,7 +258,7 @@
 
 def add_users_to_roles(kclient, users):
     for user_details in users:
-        tenant_id = get_tenant_id(kclient, user_details['tenant'])
+        tenant_id = get_project_id(kclient, user_details['project'])
         for role_name in user_details['roles']:
             role = kclient.roles.find(name=role_name)
             user = kclient.users.find(name=user_details['username'])
@@ -263,16 +274,13 @@
                                             tenant_id)
 
 
-def get_tenant_id(ks_client, tenant_name, api_version=2, domain_name=None):
+def get_project_id(ks_client, project_name, api_version=2, domain_name=None):
     domain_id = None
     if domain_name:
         domain_id = ks_client.domains.list(name=domain_name)[0].id
-    if api_version == 2:
-        all_tenants = ks_client.tenants.list()
-    else:
-        all_tenants = ks_client.projects.list(domain=domain_id)
-    for t in all_tenants:
-        if t._info['name'] == tenant_name:
+    all_projects = ks_client.projects.list(domain=domain_id)
+    for t in all_projects:
+        if t._info['name'] == project_name:
             return t._info['id']
     return None
 
@@ -354,7 +362,8 @@
                 "port": {
                     "admin_state_up": True,
                     "name": ext_port_name,
-                    "network_id": net_id
+                    "network_id": net_id,
+                    "port_security_enabled": False,
                 }
             }
             port = neutronclient.create_port(body=body_value)
@@ -394,8 +403,8 @@
         mojo_utils.juju_wait_finished()
 
 
-def create_tenant_network(neutron_client, tenant_id, net_name='private',
-                          shared=False, network_type='gre'):
+def create_project_network(neutron_client, project_id, net_name='private',
+                           shared=False, network_type='gre', domain=None):
     networks = neutron_client.list_networks(name=net_name)
     if len(networks['networks']) == 0:
         logging.info('Creating network: %s',
@@ -404,7 +413,7 @@
             'network': {
                 'name': net_name,
                 'shared': shared,
-                'tenant_id': tenant_id,
+                'tenant_id': project_id,
             }
         }
         if network_type == 'vxlan':
@@ -417,7 +426,7 @@
     return network
 
 
-def create_external_network(neutron_client, tenant_id, dvr_mode,
+def create_external_network(neutron_client, project_id, dvr_mode,
                             net_name='ext_net'):
     networks = neutron_client.list_networks(name=net_name)
     if len(networks['networks']) == 0:
@@ -425,7 +434,7 @@
         network_msg = {
             'name': net_name,
             'router:external': True,
-            'tenant_id': tenant_id,
+            'tenant_id': project_id,
         }
         if not deprecated_external_networking(dvr_mode):
             network_msg['provider:physical_network'] = 'physnet1'
@@ -442,8 +451,8 @@
     return network
 
 
-def create_tenant_subnet(neutron_client, tenant_id, network, cidr, dhcp=True,
-                         subnet_name='private_subnet'):
+def create_project_subnet(neutron_client, project_id, network, cidr, dhcp=True,
+                          subnet_name='private_subnet', domain=None):
     # Create subnet
     subnets = neutron_client.list_subnets(name=subnet_name)
     if len(subnets['subnets']) == 0:
@@ -455,7 +464,7 @@
                 'enable_dhcp': dhcp,
                 'cidr': cidr,
                 'ip_version': 4,
-                'tenant_id': tenant_id
+                'tenant_id': project_id
             }
         }
         subnet = neutron_client.create_subnet(subnet_msg)['subnet']
@@ -571,11 +580,12 @@
     return new_key.private_key
 
 
-def boot_instance(nova_client, image_name, flavor_name, key_name):
-    image = nova_client.images.find(name=image_name)
+def boot_instance(nova_client, neutron_client, image_name,
+                  flavor_name, key_name):
+    image = nova_client.glance.find_image(image_name)
     flavor = nova_client.flavors.find(name=flavor_name)
-    net = nova_client.networks.find(label="private")
-    nics = [{'net-id': net.id}]
+    net = neutron_client.find_resource("network", "private")
+    nics = [{'net-id': net.get('id')}]
     # Obviously time may not produce a unique name
     vm_name = time.strftime("%Y%m%d%H%M%S")
     logging.info('Creating %s %s %s'
@@ -601,7 +611,7 @@
             logging.error('instance %s in unknown '
                           'state %s' % (instance.name, instance.status))
             return False
-        time.sleep(10)
+        time.sleep(1)
     logging.error('instance %s failed to reach '
                   'active state in %is' % (instance.name, wait_time))
     return False
@@ -617,7 +627,7 @@
         if bootstring in console_log:
             logging.info('Cloudinit for %s is complete' % (vm_name))
             return True
-        time.sleep(10)
+        time.sleep(1)
     logging.error('cloudinit for instance %s failed '
                   'to complete in %is' % (instance.name, wait_time))
     return False
@@ -644,12 +654,24 @@
     return False
 
 
-def assign_floating_ip(nova_client, vm_name):
-    floating_ip = nova_client.floating_ips.create()
-    logging.info('Assigning floating IP %s to %s' % (floating_ip.ip, vm_name))
+def assign_floating_ip(nova_client, neutron_client, vm_name):
+    ext_net_id = None
+    instance_port = None
+    for network in neutron_client.list_networks().get('networks'):
+        if 'ext_net' in network.get('name'):
+            ext_net_id = network.get('id')
     instance = nova_client.servers.find(name=vm_name)
-    instance.add_floating_ip(floating_ip)
-    return floating_ip.ip
+    for port in neutron_client.list_ports().get('ports'):
+        if instance.id in port.get('device_id'):
+            instance_port = port
+    floating_ip = neutron_client.create_floatingip({'floatingip':
+                                                    {'floating_network_id':
+                                                     ext_net_id,
+                                                     'port_id':
+                                                     instance_port.get('id')}})
+    ip = floating_ip.get('floatingip').get('floating_ip_address')
+    logging.info('Assigning floating IP %s to %s' % (ip, vm_name))
+    return ip
 
 
 def add_secgroup_rules(nova_client):
@@ -675,6 +697,48 @@
                                                 to_port=-1)
 
 
+def add_neutron_secgroup_rules(neutron_client, project_id):
+    secgroup = None
+    for group in neutron_client.list_security_groups().get('security_groups'):
+        if (group.get('name') == 'default' and
+            (group.get('project_id') == project_id or
+                (group.get('tenant_id') == project_id))):
+            secgroup = group
+    if not secgroup:
+        raise Exception("Failed to find default security group")
+    # Using presence of a 22 rule to indicate whether secgroup rules
+    # have been added
+    port_rules = [rule['port_range_min'] for rule in
+                  secgroup.get('security_group_rules')]
+    protocol_rules = [rule['protocol'] for rule in
+                      secgroup.get('security_group_rules')]
+    if 22 in port_rules:
+        logging.warn('Security group rules for ssh already added')
+    else:
+        logging.info('Adding ssh security group rule')
+        neutron_client.create_security_group_rule(
+            {'security_group_rule':
+                {'security_group_id': secgroup.get('id'),
+                 'protocol': 'tcp',
+                 'port_range_min': 22,
+                 'port_range_max': 22,
+                 'direction': 'ingress',
+                 }
+             })
+
+    if 'icmp' in protocol_rules:
+        logging.warn('Security group rules for ping already added')
+    else:
+        logging.info('Adding ping security group rule')
+        neutron_client.create_security_group_rule(
+            {'security_group_rule':
+                {'security_group_id': secgroup.get('id'),
+                 'protocol': 'icmp',
+                 'direction': 'ingress',
+                 }
+             })
+
+
 def ping(ip):
     # Use the system ping command with count of 1 and wait time of 1.
     ret = subprocess.call(['ping', '-c', '1', '-W', '1', ip],
@@ -705,11 +769,13 @@
         return False
 
 
-def boot_and_test(nova_client, image_name, flavor_name, number, privkey,
-                  active_wait=180, cloudinit_wait=180, ping_wait=180):
+def boot_and_test(nova_client, neutron_client, image_name, flavor_name,
+                  number, privkey, active_wait=180, cloudinit_wait=180,
+                  ping_wait=180):
     image_config = mojo_utils.get_mojo_config('images.yaml')
     for counter in range(number):
         instance = boot_instance(nova_client,
+                                 neutron_client,
                                  image_name=image_name,
                                  flavor_name=flavor_name,
                                  key_name='mojo')
@@ -717,7 +783,7 @@
         wait_for_boot(nova_client, instance.name,
                       image_config[image_name]['bootstring'], active_wait,
                       cloudinit_wait)
-        ip = assign_floating_ip(nova_client, instance.name)
+        ip = assign_floating_ip(nova_client, neutron_client, instance.name)
         wait_for_ping(ip, ping_wait)
         if not wait_for_ping(ip, ping_wait):
             raise Exception('Ping of %s failed' % (ip))