Disassociate/change a security group from a Virtual Machine's NIC

[larshith]

Description
How do we change a security group associated with a NIC of the Virtual Machine? We don't see any option to remove/add any security to a NIC of the Virtual Machine.

Use case
Currently, a small modification in VM with respective Security Group ends up with a complete rewrite of the Security Group rules.

Scenario:

Suppose a customer has spun up a Virtual Machine by accidentally attaching a security group named "default" which allows "all" Ingress communication, and without the knowledge, he has deployed his applications onto the VM. The customer then notices the Security group allowing "all" traffic. Customer decides to create a new security group to meet his needs and tries associating it to the VM NIC. But there is no option to do it. It also wouldn't be a viable option to change the firewall rules of the security group "default" as it would affect other VMs (let's say). We know that the NIC detach-attach and choosing the Security Group at that time does the work, but we think that it is not considered to be the best possible solution.

Interface Changes
Sunstone

Progress Status

• Branch created
• Code committed to development branch
• Testing - QA
• Documentation
• Release notes - resolved issues, compatibility, known issues
• Code committed to upstream release/hotfix branches
• Documentation committed to upstream release/hotfix branches

[rsmontero]

Duplicated in: #2411. We'll keep this one

[paczerny]

PRs:

• src
• tests
• docs

[FrederickBor]

@tinova PRs to be approved:

• Code: https://github.com/OpenNebula/one-ee/pull/1764
• Docs: F OpenNebula/one#5612: Attach/detach secgroup in VM NICs docs#2145

[tinova]

@paczerny please check that the sunstone implementation is correct, and we can close this