Re: [Cloud-admin] labtestn sanity checks, weird errors

I this is both expected and a bug :D There is an option to disable port security for a Network. This is potentially the right thing in a world where Tooling here is really Toolforge and we want ferm/iptables to manage rulesets and not be overlapping with security groups. If this is its own VXLAN network that could make sense. So to test this I issued: # optional mass turning off of port-security mode for a network neutron net-update --port-security-enabled=false <net uuid> This documented in modules/openstack/templates/bootstrap/neutron/neutron_ seed.sh.erb port-security (security group application) can be disabled per-port or per-network. Per-port seems to be fairly well worked out, but per network seems to come with confusion between nova and neutron. Nova assumes in some cases that every port will have a security group and so balks. I see https://review.openstack.org/#/c/59578/ in relation but haven't found a similar bug for disabled for an entire network but I'm sure I've seen one I just can't find it. If only we could read redhat's magic docs at https://access.redhat.com/solutions/2143121. Possibly https://bugzilla. redhat.com/show_bug.cgi?id=1291210 I don't recall doing anything special to create the existing instances so that's interesting, and this seems not to happen if we first make a port with security groups disabled and then attach an instance. So in general I think this is just mismatched expectations between nova and neutron when security groups are disabled for an entire network. There a few known upstream reports of similar things. On Fri, Jun 1, 2018 at 7:43 AM, Arturo Borrero Gonzalez < aborrero(a)wikimedia.org&gt; wrote: -- Chase Pettet chasemp on phabricator <https://phabricator.wikimedia.org/p/chasemp/> and IRC