provider/openstack: Remove Default Security Group Rules (#11466)

This commit removes the default security group rules that are automatically
created when a security group is created. These rules are usually
permissive egress rules which makes it difficult to add more strict egress
security group rules.
This commit is contained in:
Joe Topjian 2017-01-29 17:07:33 +01:00 committed by Paul Stack
parent 5f94b51eb0
commit 5f8dc6cc34
2 changed files with 22 additions and 0 deletions

View File

@ -10,6 +10,7 @@ import (
"github.com/gophercloud/gophercloud"
"github.com/gophercloud/gophercloud/openstack/networking/v2/extensions/security/groups"
"github.com/gophercloud/gophercloud/openstack/networking/v2/extensions/security/rules"
)
func resourceNetworkingSecGroupV2() *schema.Resource {
@ -70,6 +71,14 @@ func resourceNetworkingSecGroupV2Create(d *schema.ResourceData, meta interface{}
return err
}
// Remove the default rules
for _, rule := range security_group.Rules {
if err := rules.Delete(networkingClient, rule.ID).ExtractErr(); err != nil {
return fmt.Errorf(
"There was a problem deleting a default security group rule: %s", err)
}
}
log.Printf("[DEBUG] OpenStack Neutron Security Group created: %#v", security_group)
d.SetId(security_group.ID)

View File

@ -23,6 +23,7 @@ func TestAccNetworkingV2SecGroup_basic(t *testing.T) {
Check: resource.ComposeTestCheckFunc(
testAccCheckNetworkingV2SecGroupExists(
"openstack_networking_secgroup_v2.secgroup_1", &security_group),
testAccCheckNetworkingV2SecGroupRuleCount(&security_group, 0),
),
},
resource.TestStep{
@ -89,6 +90,18 @@ func testAccCheckNetworkingV2SecGroupExists(n string, security_group *groups.Sec
}
}
func testAccCheckNetworkingV2SecGroupRuleCount(
sg *groups.SecGroup, count int) resource.TestCheckFunc {
return func(s *terraform.State) error {
if len(sg.Rules) == count {
return nil
}
return fmt.Errorf("Unexpected number of rules in group %s. Expected %d, got %d",
sg.ID, count, len(sg.Rules))
}
}
const testAccNetworkingV2SecGroup_basic = `
resource "openstack_networking_secgroup_v2" "secgroup_1" {
name = "security_group"