Bug 1827567

Summary: [RFE] Octavia. Allow adding security groups to LB's VIP ports
Product: Red Hat OpenStack Reporter: Alex Stupnikov <astupnik>
Component: openstack-octaviaAssignee: OSP Team <rhos-maint>
Status: CLOSED WONTFIX QA Contact: Bruna Bonguardo <bbonguar>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 16.0 (Train)CC: beagles, cgoncalves, cylopez, lpeer, majopela, scohen
Target Milestone: ---Keywords: FutureFeature
Target Release: ---   
Hardware: All   
OS: All   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-08-08 14:46:30 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Alex Stupnikov 2020-04-24 08:37:11 UTC 
Description of problem:

AWS allows its customers to configure inbound traffic filters on VMs to allow traffic from load balancers only. In OpenStack we can modify VM's security group and add a rule to allow certain type of traffic from some other security group. It is possible to use LB's VIP port's SG and achieve the same goal.

The problem is that load balancer's security groups for VIP ports are generated dynamically and described configuration process is not straighforward: customers need to add SG rule after every LB is created, get its SG ID and modify VM's SG. What if there are different groups of VMs?

It would be great to allow customers to add some existing SG to LB's VIP port when LB is created or modified (in addition to default SG generated automatically). After such change customer will have to create custom SG, set VM's SG rule only once and specify some extra SG when LB is created or modified.