Bug 1291210

Description of problem:

when booting an instance nova-api automatically adds a default security group if one is not specified, though we shouldn't be doing this and instead quantum should handle be handing this. This actually causes an issue for plugins that implement the port_security_api and have port_security_enabled=False on a network.

upstream bug: https://bugs.launchpad.net/nova/+bug/1175464


Version-Release number of selected component (if applicable):

openstack-nova-compute-2015.1.1-1.el7ost.noarch

How reproducible:
always

Steps to Reproduce:

1. Create a network with port_security_enabled=False:
[root@overcloud-controller-0 ~]# neutron net-create test-port-security-disable -- --port_security_enabled=False
Created a new network:
+---------------------------+--------------------------------------+
| Field                     | Value                                |
+---------------------------+--------------------------------------+
| admin_state_up            | True                                 |
| id                        | f035c5d8-40eb-4bda-8897-66ff3d9a0392 |
| mtu                       | 0                                    |
| name                      | test-port-security-disable           |
| port_security_enabled     | False                                |
| provider:network_type     | vxlan                                |
| provider:physical_network |                                      |
| provider:segmentation_id  | 8                                    |
| router:external           | False                                |
| shared                    | False                                |
| status                    | ACTIVE                               |
| subnets                   |                                      |
| tenant_id                 | c5cb88bd612949a5afaed8acf79350ef     |
+---------------------------+--------------------------------------+

2. Create a subnet:
neutron subnet-create test-port-security-disable 172.28.0.0/24

3. Launch a VM using the network created above:
nova boot  --flavor m1.small --image cirros.qcow2 --nic net-id=f035c5d8-40eb-4bda-8897-66ff3d9a0392 vm-port-security-disabled

4. Then VM launch fails, from compute node , we see errors like:
[root@overcloud-compute-0 ~]# grep 92e83f34-c17d-4b37-815c-e93bd67c6eee /var/log/nova/nova-compute.log | grep " Security"
2015-12-06 20:08:37.852 17015 TRACE nova.compute.manager [instance: 92e83f34-c17d-4b37-815c-e93bd67c6eee] SecurityGroupCannotBeApplied: Network requires port_security_enabled and subnet associated in order to apply security groups.



Actual results:

4. Then VM launch fails, from compute node , we see errors like:
[root@overcloud-compute-0 ~]# grep 92e83f34-c17d-4b37-815c-e93bd67c6eee /var/log/nova/nova-compute.log | grep " Security"
2015-12-06 20:08:37.852 17015 TRACE nova.compute.manager [instance: 92e83f34-c17d-4b37-815c-e93bd67c6eee] SecurityGroupCannotBeApplied: Network requires port_security_enabled and subnet associated in order to apply security groups.



Expected results:
Instance starts without errors