Fix name in protocolAny #2442
Comments
|
You are saying that the openstack CLI is converting However, the docs explicitly mention that What improvement do you expect once Gophercloud sends |
|
Hi, general in wiki 0 protocol is valid number for So far I found in horizon valid also For
|
In terraform provider no option to create security group with protocol "any" - please see the issue |
|
EDIT: see below. The example that was here was not useful Note that if you find a functional reason to do that, we might as well change |
I fear it won't be fixed, because it's not a bug for python, only problem for typization in go. Correct way is to add in gophercloud supporting passing |
|
There is a way to implement an own |
type RuleCreateOpts rules.CreateOpts
func (o RuleCreateOpts) ToSecGroupRuleCreateMap() (map[string]interface{}, error) {
m, err := rules.CreateOpts(o).ToSecGroupRuleCreateMap()
if err != nil {
return nil, err
}
if o.Protocol == "" {
m["security_group_rule"].(map[string]any)["protocol"] = nil
}
return m, nil
} |
I will assume you mean Can you please explain why you say that The documentation of the Neutron API clearly states:
|
I have checked in openstack, when you push Also it's looks like a bug in documentation openstack about 0 is any. Take a look in openstack python client converting Check neutron lib it's also bug with two valid NUM for and I have created in my openstack two groups. One with With 
|
|
I have managed to record gif, if no access to running openstack. |
|
OK I may have found the problem you want to fix. I have tried creating a group and a rule with this code: group, err := groups.Create(ctx, networkClient, groups.CreateOpts{
Name: "this-is-a-test",
Description: "delete me",
}).Extract()
if err != nil {
panic(err)
}
rule1, err := rules.Create(ctx, networkClient, rules.CreateOpts{
Direction: rules.DirEgress,
Description: "delete me",
EtherType: rules.EtherType4,
SecGroupID: group.ID,
PortRangeMax: 4000,
PortRangeMin: 4000,
Protocol: rules.ProtocolAny,
}).Extract()
if err != nil {
panic(err)
}And what I got is this error message: |
|
I have filed this bug against Neutron: https://bugs.launchpad.net/neutron/+bug/2074056 Based on my current understanding of the issue (which I ideally want confirmed by the Neutron team), you can use Gophercloud to create a rule that applies regardless of the protocol, by not setting the rule, err := rules.Create(ctx, networkClient, rules.CreateOpts{
Direction: rules.DirIngress,
EtherType: rules.EtherType4,
SecGroupID: group.ID,
}).Extract()Not setting This is the code with which I have tested that package main
import (
"context"
"fmt"
"io"
"net/http"
"os"
"github.com/gophercloud/gophercloud/v2/openstack"
"github.com/gophercloud/gophercloud/v2/openstack/config"
"github.com/gophercloud/gophercloud/v2/openstack/config/clouds"
"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/security/groups"
"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/security/rules"
)
type logger struct {
http.RoundTripper
}
func newLogger(rt http.RoundTripper) *logger {
return &logger{rt}
}
type readcloser struct {
io.Reader
io.Closer
}
func (l *logger) RoundTrip(req *http.Request) (*http.Response, error) {
if req.Body != nil {
r := io.TeeReader(req.Body, os.Stderr)
req.Body = readcloser{r, req.Body}
}
res, err := l.RoundTripper.RoundTrip(req)
os.Stderr.Write([]byte{'\n'})
return res, err
}
func main() {
ctx := context.Background()
authOptions, endpointOptions, tlsConfig, err := clouds.Parse()
if err != nil {
panic(err)
}
providerClient, err := config.NewProviderClient(ctx, authOptions, config.WithTLSConfig(tlsConfig))
if err != nil {
panic(err)
}
httpClient := providerClient.HTTPClient
httpClient.Transport = newLogger(httpClient.Transport)
providerClient.HTTPClient = httpClient
networkClient, err := openstack.NewNetworkV2(providerClient, endpointOptions)
if err != nil {
panic(err)
}
group, err := groups.Create(ctx, networkClient, groups.CreateOpts{
Name: "rules-any-test",
Description: "delete me",
}).Extract()
if err != nil {
panic(err)
}
fmt.Printf("Created group %q\n", group.ID)
rule, err := rules.Create(ctx, networkClient, rules.CreateOpts{
Direction: rules.DirIngress,
EtherType: rules.EtherType4,
SecGroupID: group.ID,
}).Extract()
if err != nil {
panic(err)
}
fmt.Printf("Created rule %q\n", rule.ID)
}Based on my findings:
@HappyFX @kmlebedev thoughts? |
|
There are further issues with listing, and as @kayrus notes, comparing rules with each other. Listing all rules that apply to any protocol is tricky because based on how the rule was created, the value of Comparing is something Gophercloud might assist with, by artificially setting a well-known value (like I really look forward to an answer by the Neutron folks, if we ever get one. |
I guess we need documentation for "hack" to know how it can go in terraform provider as well when
Even if they fix this bug to use protocol |
To be honest my ask is just that the API documentation be amended with one recommended (and working) way to set "all protocols". If they really want to go the extra mile, they could make it so that whatever value of |
|
For now:
To clear all this cases and make it obvious, I suggest:
|
|
Why would Regarding the numeric protocols: I have tried using curl to send numbers in strings (e.g. rule, err := rules.Create(ctx, networkClient, rules.CreateOpts{
Direction: rules.DirIngress,
EtherType: rules.EtherType4,
SecGroupID: group.ID,
Protocol: rules.RuleProtocol("6"), // for TCP
}).Extract() |
In documentation:
valid value for openstack cli is 'any'. In fact it's converted in to
Noneand then innull:debug from openstack call:
openstack security group rule create --egress --remote-ip 8.8.8.8/32 --protocol 'any' eece1c60-baf3-4ea9-88bf-54cc40290720REQ: curl -g -i -X POST http://test:9696/v2.0/security-group-rules -H "Content-Type: application/json" -H "User-Agent: openstacksdk/0.99.0 keystoneauth1/4.6.0 python-requests/2.28.1 CPython/3.9.13" -H "X-Auth-Token: {SHA256}547fc1809352d6d9431590520fb0923bbf92d25fbe73af21eb488e1b71e67e52" -d '{"security_group_rule": {"security_group_id": "eece1c60-baf3-4ea9-88bf-54cc40290720", "ethertype": "IPv4", "protocol": null, "direction": "egress", "remote_ip_prefix": "8.8.8.8/32"}}'The text was updated successfully, but these errors were encountered: