<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Morgan Fainberg [mailto:morgan.fainberg@gmail.com]
<b>on</b> Friday, December 12, 2014 2:01 PM wrote:</span><br>
On Friday, December 12, 2014, Sean Dague <<a href="mailto:sean@dague.net">sean@dague.net</a>> wrote:<span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""><o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">On 12/12/2014 01:05 PM, Maru Newby wrote:<br>
><br>
> On Dec 11, 2014, at 2:27 PM, Sean Dague <<a href="javascript:;">sean@dague.net</a>> wrote:<br>
><br>
>> On 12/11/2014 04:16 PM, Jay Pipes wrote:<br>
>>> On 12/11/2014 04:07 PM, Vishvananda Ishaya wrote:<br>
>>>> On Dec 11, 2014, at 1:04 PM, Jay Pipes <<a href="javascript:;">jaypipes@gmail.com</a>> wrote:<br>
>>>>> On 12/11/2014 04:01 PM, Vishvananda Ishaya wrote:<br>
>>>>>><br>
>>>>>> On Dec 11, 2014, at 8:00 AM, Henry Gessau <<a href="javascript:;">gessau@cisco.com</a>> wrote:<br>
>>>>>><br>
>>>>>>> On Thu, Dec 11, 2014, Mark McClain <mark@mcclain.xyz> wrote:<br>
>>>>>>>><br>
>>>>>>>>> On Dec 11, 2014, at 8:43 AM, Jay Pipes <<a href="javascript:;">jaypipes@gmail.com</a><br>
>>>>>>>>> <mailto:<a href="javascript:;">jaypipes@gmail.com</a>>> wrote:<br>
>>>>>>>>><br>
>>>>>>>>> I'm generally in favor of making name attributes opaque, utf-8<br>
>>>>>>>>> strings that<br>
>>>>>>>>> are entirely user-defined and have no constraints on them. I<br>
>>>>>>>>> consider the<br>
>>>>>>>>> name to be just a tag that the user places on some resource. It<br>
>>>>>>>>> is the<br>
>>>>>>>>> resource's ID that is unique.<br>
>>>>>>>>><br>
>>>>>>>>> I do realize that Nova takes a different approach to *some*<br>
>>>>>>>>> resources,<br>
>>>>>>>>> including the security group name.<br>
>>>>>>>>><br>
>>>>>>>>> End of the day, it's probably just a personal preference whether<br>
>>>>>>>>> names<br>
>>>>>>>>> should be unique to a tenant/user or not.<br>
>>>>>>>>><br>
>>>>>>>>> Maru had asked me my opinion on whether names should be unique and I<br>
>>>>>>>>> answered my personal opinion that no, they should not be, and if<br>
>>>>>>>>> Neutron<br>
>>>>>>>>> needed to ensure that there was one and only one default security<br>
>>>>>>>>> group for<br>
>>>>>>>>> a tenant, that a way to accomplish such a thing in a race-free<br>
>>>>>>>>> way, without<br>
>>>>>>>>> use of SELECT FOR UPDATE, was to use the approach I put into the<br>
>>>>>>>>> pastebin on<br>
>>>>>>>>> the review above.<br>
>>>>>>>>><br>
>>>>>>>><br>
>>>>>>>> I agree with Jay. We should not care about how a user names the<br>
>>>>>>>> resource.<br>
>>>>>>>> There other ways to prevent this race and Jay’s suggestion is a<br>
>>>>>>>> good one.<br>
>>>>>>><br>
>>>>>>> However we should open a bug against Horizon because the user<br>
>>>>>>> experience there<br>
>>>>>>> is terrible with duplicate security group names.<br>
>>>>>><br>
>>>>>> The reason security group names are unique is that the ec2 api<br>
>>>>>> supports source<br>
>>>>>> rule specifications by tenant_id (user_id in amazon) and name, so<br>
>>>>>> not enforcing<br>
>>>>>> uniqueness means that invocation in the ec2 api will either fail or be<br>
>>>>>> non-deterministic in some way.<br>
>>>>><br>
>>>>> So we should couple our API evolution to EC2 API then?<br>
>>>>><br>
>>>>> -jay<br>
>>>><br>
>>>> No I was just pointing out the historical reason for uniqueness, and<br>
>>>> hopefully<br>
>>>> encouraging someone to find the best behavior for the ec2 api if we<br>
>>>> are going<br>
>>>> to keep the incompatibility there. Also I personally feel the ux is<br>
>>>> better<br>
>>>> with unique names, but it is only a slight preference.<br>
>>><br>
>>> Sorry for snapping, you made a fair point.<br>
>><br>
>> Yeh, honestly, I agree with Vish. I do feel that the UX of that<br>
>> constraint is useful. Otherwise you get into having to show people UUIDs<br>
>> in a lot more places. While those are good for consistency, they are<br>
>> kind of terrible to show to people.<br>
><br>
> While there is a good case for the UX of unique names - it also makes orchestration via tools like puppet a heck of a lot simpler - the fact is that most OpenStack resources do not require unique names. That being the case, why would we want security groups
to deviate from this convention?<br>
<br>
Maybe the other ones are the broken ones?<br>
<br>
Honestly, any sanely usable system makes names unique inside a<br>
container. Like files in a directory. In this case the tenant is the<br>
container, which makes sense.<br>
<br>
It is one of many places that OpenStack is not consistent. But I'd<br>
rather make things consistent and more usable than consistent and less.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">+1. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">More consistent and more usable is a good approach. The name uniqueness has prior art in OpenStack - keystone keeps project names unique within a domain (domain is the container), similar usernames can't be duplicated in the same domain.
It would be silly to auth with the user ID, likewise unique names for the security group in the container (tenant) makes a lot of sense from a UX Perspective. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><i><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">[Rockyg] +1<o:p></o:p></span></i></b></p>
<p class="MsoNormal"><b><i><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Especially when dealing with domain data that are managed by Humans, human visible unique is important for understanding *and* efficiency. Tenant security
is expected to be managed by the tenant admin, not some automated “robot admin” and as such needs to be clear , memorable and seperable between instances. Unique names is the most straightforward (and easiest to enforce) way do this for humans. Humans read
differentiate alphanumerics, so that should be the standard differentiator when humans are expected to interact and reason about containers.<o:p></o:p></span></i></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal">--Morgan <o:p></o:p></p>
</div>
</div>
</body>
</html>