OpenStack Compute (nova)

Different default security groups depending on API used to launch instnaces

Bug #681416 reported by Soren Hansen
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Won't Fix
Wishlist
Unassigned
ec2-api
Incomplete
Undecided
Unassigned

Bug Description

Cloud servers from Rackspace have no firewall by default, while access to instances on EC2 are completely blocked from the outside. In order to mimick this behaviour, we should have two default security groups per user (or project, really): One for instances launched through the EC2 API and one for instances launched through the OpenStack API. The former should be closed by default, the latter should be open by default.

Soren Hansen (soren)
Changed in nova:
importance: Undecided → Medium
status: New → Triaged
Thierry Carrez (ttx)
tags: added: security-group
Revision history for this message
Brian Waldon (bcwaldon) wrote :

Soren: can you revisit this and evaluate whether this bug report is still valid?

Changed in nova:
status: Triaged → Incomplete
importance: Medium → Undecided
Revision history for this message
Soren Hansen (soren) wrote :

I'm not sure what has changed that would make this less valid?

Thierry Carrez (ttx)
Changed in nova:
importance: Undecided → Wishlist
status: Incomplete → Confirmed
tags: added: ec2
Mark McLoughlin (markmc)
tags: added: security-groups
removed: security-group
Revision history for this message
Joe Gordon (jogo) wrote :

Is this still valid? its several years old at this point and a lot has changed

Changed in nova:
status: Confirmed → Incomplete
Sean Dague (sdague)
Changed in nova:
status: Incomplete → Confirmed
Revision history for this message
Tom Fifield (fifieldt) wrote :

I don't think there is consensus on this at the current point in time. Perhaps start a mailing list discussion, especially in light of recent EC2 API changes?

Changed in nova:
status: Confirmed → Incomplete
Revision history for this message
Andrey Pavlov (apavlov-e) wrote :

standalone ec2-api project has two ways to run instance - with VPC(only when neutron active) and without VPC(EC2 classic mode).

In VPC mode default security group is created for each VPC with no rules.
In EC2 classic mode system default security group is used if no one specified. And rules from default group is used. Operator can configure this default security group with any rules through OpenStack API or through EC2 API. Amazon has same situation - default security group has no rules by default but user can configure it.

Changed in ec2-api:
status: New → Incomplete
Davanum Srinivas (DIMS) (dims-v)
Changed in nova:
status: Incomplete → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.