deprecate security_group_api config option

This deprecates the security_group_api config option and makes it
respect the new ``use_neutron`` option. This provides a much simpler
and consistent interface for enabling Neutron support in Nova.

Change-Id: I1c2eb51d10ba6370492a911f59370b9870646a38

nova/network/security_group/openstack_driver.py

@@ -16,10 +16,14 @@
 from oslo_config import cfg
 from oslo_utils import importutils
 
+import nova.network
+
 security_group_opts = [
-    cfg.StrOpt('security_group_api',
+    cfg.StrOpt(
+        'security_group_api',
         default='nova',
-               help='The full class name of the security API class'),
+        help='DEPRECATED: The full class name of the security API class',
+        deprecated_for_removal=True),
 ]
 
 CONF = cfg.CONF
@@ -32,12 +36,12 @@ DRIVER_CACHE = {}
 
 
 def _get_openstack_security_group_driver(skip_policy_check=False):
-    if CONF.security_group_api.lower() == 'nova':
+    if is_neutron_security_groups():
-        return importutils.import_object(NOVA_DRIVER,
-                                         skip_policy_check=skip_policy_check)
-    elif is_neutron_security_groups():
         return importutils.import_object(NEUTRON_DRIVER,
                                          skip_policy_check=skip_policy_check)
+    elif CONF.security_group_api.lower() == 'nova':
+        return importutils.import_object(NOVA_DRIVER,
+                                         skip_policy_check=skip_policy_check)
     else:
         return importutils.import_object(CONF.security_group_api,
                                          skip_policy_check=skip_policy_check)
@@ -51,4 +55,5 @@ def get_openstack_security_group_driver(skip_policy_check=False):
 
 
 def is_neutron_security_groups():
-    return CONF.security_group_api.lower() == 'neutron'
+    return (CONF.security_group_api.lower() == 'neutron'
+            or nova.network.is_neutron())

nova/tests/unit/network/test_config.py

@@ -13,6 +13,8 @@
 # under the License.
 
 import nova.network
+import nova.network.security_group.neutron_driver
+import nova.network.security_group.openstack_driver as sgapi
 import nova.test
 
 
@@ -51,3 +53,33 @@ class NetworkAPIConfigTest(nova.test.NoDBTestCase):
                    'nova.tests.unit.network.test_config.FileATicket')
         netapi = nova.network.API()
         self.assertIsInstance(netapi, FileATicket)
+
+
+class SecurityGroupAPIConfigTest(nova.test.NoDBTestCase):
+
+    def test_use_neutron(self):
+        self.flags(use_neutron=True)
+        driver = sgapi.get_openstack_security_group_driver()
+        self.assertIsInstance(
+            driver,
+            nova.network.security_group.neutron_driver.SecurityGroupAPI)
+
+    def test_sg_nova(self):
+        self.flags(security_group_api='nova')
+        driver = sgapi.get_openstack_security_group_driver()
+        self.assertIsInstance(
+            driver,
+            nova.compute.api.SecurityGroupAPI)
+
+    def test_sg_neutron(self):
+        self.flags(security_group_api='neutron')
+        driver = sgapi.get_openstack_security_group_driver()
+        self.assertIsInstance(
+            driver,
+            nova.network.security_group.neutron_driver.SecurityGroupAPI)
+
+    def test_sg_custom(self):
+        self.flags(security_group_api=
+                   'nova.tests.unit.network.test_config.FileATicket')
+        driver = sgapi.get_openstack_security_group_driver()
+        self.assertIsInstance(driver, FileATicket)

releasenotes/notes/deprecate_security_group_api-3d96d683a3723e2c.yaml

@@ -0,0 +1,7 @@
+---
+deprecations:
+
+  - Deprecate ``security_group_api`` configuration option. The current
+    values are ``nova`` and ``neutron``. In future the correct
+    security_group_api option will be chosen based on the value of
+    ``use_neutron`` which provides a more coherent user experience.