From ef957eedde019f255ce363d71a644604cca8d8df Mon Sep 17 00:00:00 2001
From: Sean Dague <sean@dague.net>
Date: Fri, 4 Mar 2016 12:31:09 -0500
Subject: [PATCH] deprecate security_group_api config option

This deprecates the security_group_api config option and makes it
respect the new ``use_neutron`` option. This provides a much simpler
and consistent interface for enabling Neutron support in Nova.

Change-Id: I1c2eb51d10ba6370492a911f59370b9870646a38
---
 .../security_group/openstack_driver.py        | 21 +++++++-----
 nova/tests/unit/network/test_config.py        | 32 +++++++++++++++++++
 ...e_security_group_api-3d96d683a3723e2c.yaml |  7 ++++
 3 files changed, 52 insertions(+), 8 deletions(-)
 create mode 100644 releasenotes/notes/deprecate_security_group_api-3d96d683a3723e2c.yaml

diff --git a/nova/network/security_group/openstack_driver.py b/nova/network/security_group/openstack_driver.py
index e0e2f5c223b0..026e3590ac6b 100644
--- a/nova/network/security_group/openstack_driver.py
+++ b/nova/network/security_group/openstack_driver.py
@@ -16,10 +16,14 @@
 from oslo_config import cfg
 from oslo_utils import importutils
 
+import nova.network
+
 security_group_opts = [
-    cfg.StrOpt('security_group_api',
-               default='nova',
-               help='The full class name of the security API class'),
+    cfg.StrOpt(
+        'security_group_api',
+        default='nova',
+        help='DEPRECATED: The full class name of the security API class',
+        deprecated_for_removal=True),
 ]
 
 CONF = cfg.CONF
@@ -32,12 +36,12 @@ DRIVER_CACHE = {}
 
 
 def _get_openstack_security_group_driver(skip_policy_check=False):
-    if CONF.security_group_api.lower() == 'nova':
-        return importutils.import_object(NOVA_DRIVER,
-                                         skip_policy_check=skip_policy_check)
-    elif is_neutron_security_groups():
+    if is_neutron_security_groups():
         return importutils.import_object(NEUTRON_DRIVER,
                                          skip_policy_check=skip_policy_check)
+    elif CONF.security_group_api.lower() == 'nova':
+        return importutils.import_object(NOVA_DRIVER,
+                                         skip_policy_check=skip_policy_check)
     else:
         return importutils.import_object(CONF.security_group_api,
                                          skip_policy_check=skip_policy_check)
@@ -51,4 +55,5 @@ def get_openstack_security_group_driver(skip_policy_check=False):
 
 
 def is_neutron_security_groups():
-    return CONF.security_group_api.lower() == 'neutron'
+    return (CONF.security_group_api.lower() == 'neutron'
+            or nova.network.is_neutron())
diff --git a/nova/tests/unit/network/test_config.py b/nova/tests/unit/network/test_config.py
index a4e29f68e24e..0baa4c88c9d8 100644
--- a/nova/tests/unit/network/test_config.py
+++ b/nova/tests/unit/network/test_config.py
@@ -13,6 +13,8 @@
 # under the License.
 
 import nova.network
+import nova.network.security_group.neutron_driver
+import nova.network.security_group.openstack_driver as sgapi
 import nova.test
 
 
@@ -51,3 +53,33 @@ class NetworkAPIConfigTest(nova.test.NoDBTestCase):
                    'nova.tests.unit.network.test_config.FileATicket')
         netapi = nova.network.API()
         self.assertIsInstance(netapi, FileATicket)
+
+
+class SecurityGroupAPIConfigTest(nova.test.NoDBTestCase):
+
+    def test_use_neutron(self):
+        self.flags(use_neutron=True)
+        driver = sgapi.get_openstack_security_group_driver()
+        self.assertIsInstance(
+            driver,
+            nova.network.security_group.neutron_driver.SecurityGroupAPI)
+
+    def test_sg_nova(self):
+        self.flags(security_group_api='nova')
+        driver = sgapi.get_openstack_security_group_driver()
+        self.assertIsInstance(
+            driver,
+            nova.compute.api.SecurityGroupAPI)
+
+    def test_sg_neutron(self):
+        self.flags(security_group_api='neutron')
+        driver = sgapi.get_openstack_security_group_driver()
+        self.assertIsInstance(
+            driver,
+            nova.network.security_group.neutron_driver.SecurityGroupAPI)
+
+    def test_sg_custom(self):
+        self.flags(security_group_api=
+                   'nova.tests.unit.network.test_config.FileATicket')
+        driver = sgapi.get_openstack_security_group_driver()
+        self.assertIsInstance(driver, FileATicket)
diff --git a/releasenotes/notes/deprecate_security_group_api-3d96d683a3723e2c.yaml b/releasenotes/notes/deprecate_security_group_api-3d96d683a3723e2c.yaml
new file mode 100644
index 000000000000..c6545531f4e9
--- /dev/null
+++ b/releasenotes/notes/deprecate_security_group_api-3d96d683a3723e2c.yaml
@@ -0,0 +1,7 @@
+---
+deprecations:
+
+  - Deprecate ``security_group_api`` configuration option. The current
+    values are ``nova`` and ``neutron``. In future the correct
+    security_group_api option will be chosen based on the value of
+    ``use_neutron`` which provides a more coherent user experience.