<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Arial;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:595.0pt 842.0pt;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Sorry for being vague – have been debugging.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">We overwrite the base method:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> with db_api.context_manager.writer.using(context):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> secgroup_db = (<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> super(NsxV3Plugin, self).create_security_group(<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> context, security_group, default_sg))<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> nsx_db.save_sg_mappings(context,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> secgroup_db['id'],<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> ns_group['id'],<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> firewall_section['id'])<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> self._process_security_group_properties_create(context,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> secgroup_db,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> secgroup,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> default_sg)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">The secgroup_db that returns always has empty rules. If I remove the transaction then it works.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Still trying to figure out why when we call:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> with db_api.context_manager.writer.using(context):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> secgroup_db = (<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> super(NsxV3Plugin, self).create_security_group(…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">The rules are not populated. The db_api.context_manager.writer.using is what is causing the problem.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">As a work around we reread the object when we need to process the rules. Not sure if anyone else has hit this<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Gary<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black">Kevin Benton <kevin@benton.pub><br>
<b>Reply-To: </b>OpenStack List <openstack-dev@lists.openstack.org><br>
<b>Date: </b>Monday, June 19, 2017 at 10:01 AM<br>
<b>To: </b>OpenStack List <openstack-dev@lists.openstack.org><br>
<b>Cc: </b>"isaku.yamahata@gmail.com" <isaku.yamahata@gmail.com><br>
<b>Subject: </b>Re: [openstack-dev] [neutron] security group OVO change<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Do you mean the callback event for AFTER_CREATE is missing the rules when it's for default security groups?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Sun, Jun 18, 2017 at 4:44 AM, Gary Kotton <<a href="mailto:gkotton@vmware.com" target="_blank">gkotton@vmware.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">Hi,<br>
That patch looks good. We still have an issue in that the create security groups does not return the list of the default rules.<br>
Thanks<br>
<span class="hoenzb"><span style="color:#888888">Gary</span></span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
On 6/17/17, 2:33 AM, "Isaku Yamahata" <<a href="mailto:isaku.yamahata@gmail.com">isaku.yamahata@gmail.com</a>> wrote:<br>
<br>
It also broke networking-odl.<br>
The patch[1] is needed to unbreak.<br>
[1] <a href="https://review.openstack.org/#/c/448420/" target="_blank">https://review.openstack.org/#/c/448420/</a><br>
<br>
necessary db info is taken from context.session.new.<br>
But with OVO, those expunge themselves with create method.<br>
Those info needs to be passed as callback argument.<br>
<br>
Thanks,<br>
<br>
On Fri, Jun 16, 2017 at 01:25:28PM -0700,<br>
Ihar Hrachyshka <<a href="mailto:ihrachys@redhat.com">ihrachys@redhat.com</a>> wrote:<br>
<br>
> To close the loop here,<br>
><br>
> - this also broke heat py3 job (<a href="https://launchpad.net/bugs/1698355" target="_blank">https://launchpad.net/bugs/1698355</a>)<br>
> - we polished <a href="https://review.openstack.org/474575" target="_blank">
https://review.openstack.org/474575</a> to fix both<br>
> vmware-nsx and heat issues<br>
> - I also posted a patch for oslo.serialization for the bug that<br>
> triggered MemoryError in heat gate:<br>
> <a href="https://review.openstack.org/475052" target="_blank">https://review.openstack.org/475052</a><br>
> - the vmware-nsx adoption patch is at:<br>
> <a href="https://review.openstack.org/#/c/474608/" target="_blank">https://review.openstack.org/#/c/474608/</a> and @boden is working on it,<br>
> should be ready to go in due course.<br>
><br>
> Thanks and sorry for inconveniences,<br>
> Ihar<br>
><br>
> On Thu, Jun 15, 2017 at 6:17 AM, Gary Kotton <<a href="mailto:gkotton@vmware.com">gkotton@vmware.com</a>> wrote:<br>
> > Hi,<br>
> ><br>
> > The commit <a href="https://review.openstack.org/284738" target="_blank">
https://review.openstack.org/284738</a> has broken decomposed plugins<br>
> > (those that extend security groups and rules). The reason for this is that<br>
> > there is a extend callback that we use which expects to get a database<br>
> > object and the aforementioned patch passes a new neutron object.<br>
> ><br>
> > I have posted [i] to temporarily address the issue. An alternative is to<br>
> > revert the patch until the decomposed plugins can figure out how to<br>
> > correctly address this.<br>
> ><br>
> > Thanks<br>
> ><br>
> > Gary<br>
> ><br>
> > [i] <a href="https://review.openstack.org/474575" target="_blank">https://review.openstack.org/474575</a><br>
> ><br>
> ><br>
> > __________________________________________________________________________<br>
> > OpenStack Development Mailing List (not for usage questions)<br>
> > Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
> > <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
> ><br>
><br>
> __________________________________________________________________________<br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
--<br>
Isaku Yamahata <<a href="mailto:isaku.yamahata@gmail.com">isaku.yamahata@gmail.com</a>><br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">
OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>