[Bug 1813007] Re: Unable to install new flows on compute nodes when having broken security group rules

[Corey Bryant]

I'm working on recreating this but any more details you can provide in
the mean time will help speed that up (ie. juju crashdump and ensuing
commands that lead up to the error).

As I understand it, creation of a security group rule B with '--remote-
group A' specifies that rule B applies to any instances that use rule A.
[1]

That said, can you explain why the rule for tcp 5672:5672 is needed
along with the rule for tcp port_range_min:port_range_max? ie. Is the
former a subset of the latter?

Thanks,
Corey

[1] https://docs.openstack.org/nova/queens/admin/security-groups.html
#create-security-group-rules-for-a-cluster-of-instances

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/1813007

Title:
  Unable to install new flows on compute nodes when having broken
  security group rules

Status in neutron package in Ubuntu:
  New

Bug description:
  It appears that we have found that neutron-openvswitch-agent appears to have a bug where two security group rules that have two different port ranges that overlap tied to the same parent security group will cause neutron to not be able to configure networks on the compute nodes where those security groups are present.
  Those are the broken security rules: https://pastebin.canonical.com/p/wSy8RSXt85/
  Here is the log when we discovered the issue: https://pastebin.canonical.com/p/wvFKjNWydr/

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/neutron/+bug/1813007/+subscriptions