Merge "Make security group configurable - dovetail"

4 files changed, 91 insertions, 58 deletions

diff --git a/yardstick/benchmark/contexts/heat.py b/yardstick/benchmark/contexts/heat.py
index f118ffc32..c3c5451bd 100644
--- a/yardstick/benchmark/contexts/heat.py
+++ b/yardstick/benchmark/contexts/heat.py
@@ -59,6 +59,7 @@ class HeatContext(Context):
         self.server_groups = []
         self.keypair_name = None
         self.secgroup_name = None
+        self.security_group = None
         self._server_map = {}
         self.attrs = {}
         self._image = None
@@ -118,8 +119,11 @@ class HeatContext(Context):
             return
 
         self.keypair_name = h_join(self.name, "key")
+
         self.secgroup_name = h_join(self.name, "secgroup")
 
+        self.security_group = attrs.get("security_group")
+
         self._image = attrs.get("image")
 
         self._flavor = attrs.get("flavor")
@@ -185,7 +189,7 @@ class HeatContext(Context):
                 self.flavors.add(flavor)
 
         template.add_keypair(self.keypair_name, self.name)
-        template.add_security_group(self.secgroup_name)
+        template.add_security_group(self.secgroup_name, self.security_group)
 
         for network in self.networks.values():
             # Using existing network
diff --git a/yardstick/orchestrator/heat.py b/yardstick/orchestrator/heat.py
index 99a5760a3..9da4948dd 100644
--- a/yardstick/orchestrator/heat.py
+++ b/yardstick/orchestrator/heat.py
@@ -471,68 +471,77 @@ name (i.e. %s).
             'value': {'get_resource': name}
         }
 
-    def add_security_group(self, name):
+    def add_security_group(self, name, security_group=None):
         """add to the template a Neutron SecurityGroup"""
         log.debug("adding Neutron::SecurityGroup '%s'", name)
+        description = ("Group allowing IPv4 and IPv6 for icmp and upd/tcp on"
+                       "all ports")
+        rules = [
+            {'remote_ip_prefix': '0.0.0.0/0',
+             'protocol': 'tcp',
+             'port_range_min': '1',
+             'port_range_max': '65535'},
+            {'remote_ip_prefix': '0.0.0.0/0',
+             'protocol': 'udp',
+             'port_range_min': '1',
+             'port_range_max': '65535'},
+            {'remote_ip_prefix': '0.0.0.0/0',
+             'protocol': 'icmp'},
+            {'remote_ip_prefix': '::/0',
+             'ethertype': 'IPv6',
+             'protocol': 'tcp',
+             'port_range_min': '1',
+             'port_range_max': '65535'},
+            {'remote_ip_prefix': '::/0',
+             'ethertype': 'IPv6',
+             'protocol': 'udp',
+             'port_range_min': '1',
+             'port_range_max': '65535'},
+            {'remote_ip_prefix': '::/0',
+             'ethertype': 'IPv6',
+             'protocol': 'ipv6-icmp'},
+            {'remote_ip_prefix': '0.0.0.0/0',
+             'direction': 'egress',
+             'protocol': 'tcp',
+             'port_range_min': '1',
+             'port_range_max': '65535'},
+            {'remote_ip_prefix': '0.0.0.0/0',
+             'direction': 'egress',
+             'protocol': 'udp',
+             'port_range_min': '1',
+             'port_range_max': '65535'},
+            {'remote_ip_prefix': '0.0.0.0/0',
+             'direction': 'egress',
+             'protocol': 'icmp'},
+            {'remote_ip_prefix': '::/0',
+             'direction': 'egress',
+             'ethertype': 'IPv6',
+             'protocol': 'tcp',
+             'port_range_min': '1',
+             'port_range_max': '65535'},
+            {'remote_ip_prefix': '::/0',
+             'direction': 'egress',
+             'ethertype': 'IPv6',
+             'protocol': 'udp',
+             'port_range_min': '1',
+             'port_range_max': '65535'},
+            {'remote_ip_prefix': '::/0',
+             'direction': 'egress',
+             'ethertype': 'IPv6',
+             'protocol': 'ipv6-icmp'},
+        ]
+        if security_group:
+            description = "Custom security group rules defined by the user"
+            rules = security_group.get('rules')
+
+        log.debug("The security group rules is %s", rules)
+
         self.resources[name] = {
             'type': 'OS::Neutron::SecurityGroup',
             'properties': {
                 'name': name,
-                'description': "Group allowing IPv4 and IPv6 for icmp and upd/tcp on all ports",
-                'rules': [
-                    {'remote_ip_prefix': '0.0.0.0/0',
-                     'protocol': 'tcp',
-                     'port_range_min': '1',
-                     'port_range_max': '65535'},
-                    {'remote_ip_prefix': '0.0.0.0/0',
-                     'protocol': 'udp',
-                     'port_range_min': '1',
-                     'port_range_max': '65535'},
-                    {'remote_ip_prefix': '0.0.0.0/0',
-                     'protocol': 'icmp'},
-                    {'remote_ip_prefix': '::/0',
-                     'ethertype': 'IPv6',
-                     'protocol': 'tcp',
-                     'port_range_min': '1',
-                     'port_range_max': '65535'},
-                    {'remote_ip_prefix': '::/0',
-                     'ethertype': 'IPv6',
-                     'protocol': 'udp',
-                     'port_range_min': '1',
-                     'port_range_max': '65535'},
-                    {'remote_ip_prefix': '::/0',
-                     'ethertype': 'IPv6',
-                     'protocol': 'ipv6-icmp'},
-                    {'remote_ip_prefix': '0.0.0.0/0',
-                     'direction': 'egress',
-                     'protocol': 'tcp',
-                     'port_range_min': '1',
-                     'port_range_max': '65535'},
-                    {'remote_ip_prefix': '0.0.0.0/0',
-                     'direction': 'egress',
-                     'protocol': 'udp',
-                     'port_range_min': '1',
-                     'port_range_max': '65535'},
-                    {'remote_ip_prefix': '0.0.0.0/0',
-                     'direction': 'egress',
-                     'protocol': 'icmp'},
-                    {'remote_ip_prefix': '::/0',
-                     'direction': 'egress',
-                     'ethertype': 'IPv6',
-                     'protocol': 'tcp',
-                     'port_range_min': '1',
-                     'port_range_max': '65535'},
-                    {'remote_ip_prefix': '::/0',
-                     'direction': 'egress',
-                     'ethertype': 'IPv6',
-                     'protocol': 'udp',
-                     'port_range_min': '1',
-                     'port_range_max': '65535'},
-                    {'remote_ip_prefix': '::/0',
-                     'direction': 'egress',
-                     'ethertype': 'IPv6',
-                     'protocol': 'ipv6-icmp'},
-                ]
+                'description': description,
+                'rules': rules
             }
         }
 
diff --git a/yardstick/tests/unit/benchmark/contexts/test_heat.py b/yardstick/tests/unit/benchmark/contexts/test_heat.py
index 7782d96bd..3ccae44c7 100644
--- a/yardstick/tests/unit/benchmark/contexts/test_heat.py
+++ b/yardstick/tests/unit/benchmark/contexts/test_heat.py
@@ -73,6 +73,7 @@ class HeatContextTestCase(unittest.TestCase):
         self.assertEqual(self.test_context.server_groups, [])
         self.assertIsNone(self.test_context.keypair_name)
         self.assertIsNone(self.test_context.secgroup_name)
+        self.assertIsNone(self.test_context.security_group)
         self.assertEqual(self.test_context._server_map, {})
         self.assertIsNone(self.test_context._image)
         self.assertIsNone(self.test_context._flavor)
@@ -192,7 +193,7 @@ class HeatContextTestCase(unittest.TestCase):
         mock_template.add_keypair.assert_called_with(
             "ctx-key",
             "ctx-12345678")
-        mock_template.add_security_group.assert_called_with("ctx-secgroup")
+        mock_template.add_security_group.assert_called_with("ctx-secgroup", None)
         mock_template.add_network.assert_called_with(
             "ctx-12345678-mynet", 'physnet1', None, None, None, None)
         mock_template.add_router.assert_called_with(
diff --git a/yardstick/tests/unit/orchestrator/test_heat.py b/yardstick/tests/unit/orchestrator/test_heat.py
index 3ec59a3c2..2e60a72cb 100644
--- a/yardstick/tests/unit/orchestrator/test_heat.py
+++ b/yardstick/tests/unit/orchestrator/test_heat.py
@@ -256,6 +256,25 @@ class HeatTemplateTestCase(unittest.TestCase):
         self.assertEqual(self.template.resources['some-server-group'][
                              'properties']['policies'], ['anti-affinity'])
 
+    def test_add_security_group(self):
+        security_group = {
+            'rules': [
+                {'remote_ip_prefix': '0.0.0.0/0',
+                 'port_range_max': 65535,
+                 'port_range_min': 1,
+                 'protocol': 'custom'},
+            ]
+        }
+        self.template.add_security_group('some-security-group', security_group)
+
+        secgroup_rsc = self.template.resources['some-security-group']
+
+        self.assertEqual(secgroup_rsc['type'], "OS::Neutron::SecurityGroup")
+        self.assertEqual(secgroup_rsc['properties']['description'],
+                         "Custom security group rules defined by the user")
+        self.assertEqual(secgroup_rsc['properties']['rules'][0]['protocol'],
+                         'custom')
+
     def test__add_resources_to_template_raw(self):
         test_context = node.NodeContext()
         self.addCleanup(test_context._delete_context)