=================================================
SecurityGroup  Extension support for Nuage Plugin
=================================================

https://blueprints.launchpad.net/neutron/+spec/securitygroup-ext-for-nuage-plugin

Adding securitygroup extension support to existing nuage networks' Plugin


Problem description
===================
Current Nuage Plugin does not support Neutron's securitygroup extension.
Nuage's VSP supports this feature and the support for extension needs
to be added in the plugin code.

Proposed change
===============
Adding extension support code in Nuage plugin.

Alternatives
------------
None

Data model impact
-----------------
Existing securitygroup tables in neutron will be supported.

REST API impact
---------------
None

Security impact
---------------
None

Notifications impact
--------------------
None

Other end user impact
---------------------
None

Performance Impact
------------------
None

Other deployer impact
---------------------
None

Developer impact
----------------
None

Implementation
==============
VSP's securitygroup equivalent object's scope is either per router or per subnet.
Where Neutron's is per tenant. Because of this, the mapping between
neutron and VSP resource always happens at the port create or update time; such
that port's router/subnet is known and thus sg attachment point in VSP is known.
Following workflow can be imagined:
1) neutron security-group-create sg1
No-op from VSP point of view
2) neutron security-group-rule-create --direction ingress --protocol tcp --port_range_min 80 --port_range_max 80 <sg-id>
No-op from VSP point of view
3a) neutron port-create 9d0b9f4a-1a72-4c17-a538-06ee7501d185 --name sub1 --security-group 8eb7ee8e-6d15-4a0d-b13a-0affeba438ae
3b) neutron port-update 71083f7d-1450-4bee-9c40-728b7ffd2876 --security-group c6c08246-bad7-4d82-a0ad-4a42327c9516
If this is the first port getting attached to that security-group,
this is where corresponding vport-tag (for sg) and rules (for sg-rules) are created on VSP.
Subsequent port-create/update for this sg will simply increment counter and add value to vport to vporttag
mapping.

Similarly, when the last port attached to this group is deleted, the vport-tag(sg) and the rules(vptag rules)
will be deleted.

CRUD operation on securitygroup will be supported in normal fashion.

Assignee(s)
-----------
Ronak Shah


Primary assignee:
  ronak-malav-shah

Other contributors:
  divya.hc

Work Items
----------
Extension code in Nuage plugin
Nuage Unit tests addition
Nuage CI coverage addition


Dependencies
============
None

Testing
=======
Unit Test coverage for security-group extension within Nuage unit test
Nuage CI will be modified to start supporting this extension tests


Documentation Impact
====================
None

References
==========
None