[octavia-ingress-controller] Possible lost update race conditions in adding and removing SGs

[stephenfin]

Is this a BUG REPORT or FEATURE REQUEST?:

/kind feature

(it's a feature'y bug :smile:)

What happened:

Neutron doesn't provide a way to add or remove port security groups individually. Instead, you indicate the total set of SGs that should be on the port, meaning to add an SG you must fetch the existing SGs, append the new SG to this set, and then apply this updated set. This opens us up to a TOCTOU race: if a security group is added or removed in the interim, we will lose that update. @dulek has noted this in places.

What you expected to happen:

Per @dulek's notes, we should make use of neutron's revision-if-match shim extension to set a revision ID.

How to reproduce it:

N/A

Anything else we need to know?:

N/A

Environment:

master

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale