NSX-V3 Plugin security integration module
-
class vmware_nsx.nsxlib.v3.security.NSGroupManager(size)
Bases: object
This class assists with NSX integration for Neutron security-groups,
Each Neutron security-group is associated with NSX NSGroup object.
Some specific security policies are the same across all security-groups,
i.e - Default drop rule, DHCP. In order to bind these rules to all
NSGroups (security-groups), we create a nested NSGroup (which its members
are also of type NSGroups) to group the other NSGroups and associate it
with these rules.
In practice, one NSGroup (nested) can’t contain all the other NSGroups, as
it has strict size limit. To overcome the limited space challange, we
create several nested groups instead of just one, and we evenly distribute
NSGroups (security-groups) between them.
By using an hashing function on the NSGroup uuid we determine in which
group it should be added, and when deleting an NSGroup (security-group) we
use the same procedure to find which nested group it was added.
-
NESTED_GROUP_DESCRIPTION = 'OpenStack NSGroup. Do not delete.'
-
NESTED_GROUP_NAME = 'OS Nested Group'
-
add_nsgroup(nsgroup_id)
-
nested_groups
-
remove_nsgroup(nsgroup_id)
-
size
-
vmware_nsx.nsxlib.v3.security.create_firewall_rules(context, section_id, nsgroup_id, logging_enabled, action, security_group_rules)
-
vmware_nsx.nsxlib.v3.security.get_lport_tags_for_security_groups(secgroups)
-
vmware_nsx.nsxlib.v3.security.get_nsgroup_name(security_group)
-
vmware_nsx.nsxlib.v3.security.get_sg_mappings(session, sg_id)
-
vmware_nsx.nsxlib.v3.security.get_sg_rule_mapping(session, rule_id)
-
vmware_nsx.nsxlib.v3.security.init_nsgroup_manager_and_default_section_rules()
-
vmware_nsx.nsxlib.v3.security.save_sg_mappings(session, sg_id, nsgroup_id, section_id)
-
vmware_nsx.nsxlib.v3.security.save_sg_rule_mappings(session, firewall_rules)
-
vmware_nsx.nsxlib.v3.security.set_firewall_rule_logging_for_section(section_id, logging)
-
vmware_nsx.nsxlib.v3.security.update_lport_with_security_groups(context, lport_id, original, updated)
-
vmware_nsx.nsxlib.v3.security.update_security_group_on_backend(context, security_group)