Repository: gophercloud/gophercloud

Issue:
Supporting Neutron security address groups
Currently the option to create a security group rule only allows RemoteGroupID  or RemoteIPPrefix on rule creation, could this be extended to allow the use of remote address groups per the API?

https://docs.openstack.org/api-ref/network/v2/index.html#address-groups

Discussion:
@github-actions: Thank you for reporting your first issue! Be sure that we will be looking at it, but keep in mind
this sometimes takes a while.
Please let the maintainers know if your issue has not got enough attention after a few days.
If any doubt, please consult our issue [tutorial](https://github.com/gophercloud/gophercloud/blob/master/docs/contributor-tutorial/step-02-issues.md).@Jscott377: @kayrus Have developed this for local use - ok to raise PR on this?@kayrus: @Jscott377 feel free to submit a PR

Solution patch:
diff --git a/internal/acceptance/openstack/networking/v2/extensions/extensions.go b/internal/acceptance/openstack/networking/v2/extensions/extensions.go
index 9565d1e30..ae0b52f59 100644
--- a/internal/acceptance/openstack/networking/v2/extensions/extensions.go
+++ b/internal/acceptance/openstack/networking/v2/extensions/extensions.go
@@ -7,6 +7,7 @@ import (
 	"github.com/gophercloud/gophercloud/v2"
 	"github.com/gophercloud/gophercloud/v2/internal/acceptance/tools"
 	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/external"
+	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/security/addressgroups"
 	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/security/groups"
 	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/security/rules"
 	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/networks"
@@ -199,3 +200,45 @@ func DeleteSecurityGroupRule(t *testing.T, client *gophercloud.ServiceClient, ru
 		t.Fatalf("Unable to delete security group rule: %v", err)
 	}
 }
+
+// CreateSecurityAddressGroup will create a security address group with a random name.
+func CreateSecurityAddressGroup(t *testing.T, client *gophercloud.ServiceClient) (*addressgroups.AddressGroup, error) {
+	addressGroupName := tools.RandomString("TESTACC-", 8)
+	addressGroupDescription := tools.RandomString("TESTACC-DESC-", 8)
+
+	t.Logf("Attempting to create security address group: %s", addressGroupName)
+
+	addresses := []string{
+		"192.168.1.1/32",
+	}
+	createOpts := addressgroups.CreateOpts{
+		Name:        addressGroupName,
+		Description: addressGroupDescription,
+		Addresses:   addresses,
+	}
+
+	addressGroup, err := addressgroups.Create(context.TODO(), client, createOpts).Extract()
+	if err != nil {
+		return addressGroup, err
+	}
+
+	t.Logf("Created security address group: %s", addressGroup.ID)
+
+	th.AssertEquals(t, addressGroupName, addressGroup.Name)
+	th.AssertEquals(t, addressGroupDescription, addressGroup.Description)
+	th.AssertDeepEquals(t, addresses, addressGroup.Addresses)
+
+	return addressGroup, nil
+}
+
+// DeleteSecurityAddressGroup will delete a security address group of a specified ID.
+// A fatal error will occur if the deletion failed. This works best as a
+// deferred function
+func DeleteSecurityAddressGroup(t *testing.T, client *gophercloud.ServiceClient, addressGroupID string) {
+	t.Logf("Attempting to delete security address group: %s", addressGroupID)
+
+	err := addressgroups.Delete(context.TODO(), client, addressGroupID).ExtractErr()
+	if err != nil {
+		t.Fatalf("Unable to delete security address group: %v", err)
+	}
+}
diff --git a/openstack/networking/v2/extensions/security/addressgroups/doc.go b/openstack/networking/v2/extensions/security/addressgroups/doc.go
new file mode 100644
index 000000000..e1921f430
--- /dev/null
+++ b/openstack/networking/v2/extensions/security/addressgroups/doc.go
@@ -0,0 +1,91 @@
+/*
+Package addressgroups provides information and interaction with Address Groups
+for the OpenStack Networking services.
+
+Example to List Address Groups
+
+	listOpts := addressgroups.ListOpts{
+	}
+
+	allPages, err := addressgroups.List(networkClient, listOpts).AllPages(context.TODO())
+	if err != nil {
+		panic(err)
+	}
+
+	allAddressGroups, err := addressgroups.ExtractGroups(allPages)
+	if err != nil {
+		panic(err)
+	}
+
+	for _, addressGroup := range allAddressGroups {
+		fmt.Printf("%+v\n", addressGroup)
+	}
+
+Example to Get an Address Group
+
+	groupID := "37d94f8a-d136-465c-ae46-144f0d8ef141"
+	addressGroup, err := addressgroups.Get(context.TODO(), networkClient, groupID).Extract()
+	if err != nil {
+		panic(err)
+	}
+
+Example to Create an Address Group
+
+	createOpts := addressgroups.CreateOpts{
+		Name:        "addressGroupName",
+		Addresses:   []string{"10.2.30.4/32", "10.2.30.6/32"},
+		Description: "Created address group",
+	}
+
+	addressGroup, err := addressgroups.Create(context.TODO(), networkClient, createOpts).Extract()
+	if err != nil {
+		panic(err)
+	}
+
+Example to Delete a Address Group
+
+	groupID := "37d94f8a-d136-465c-ae46-144f0d8ef141"
+	err := addressgroups.Delete(context.TODO(), computeClient, groupID).ExtractErr()
+	if err != nil {
+		panic(err)
+	}
+
+Example to update an existing Address Group
+
+	groupID := "37d94f8a-d136-465c-ae46-144f0d8ef141"
+	name := "ADDR_GP_2"
+	description := "new description"
+	updateOpts := addressgroups.UpdateOpts{
+		Name:        &name,
+		Description: &description,
+	}
+	addressGroup, err := addressgroups.UpdateAddressGroup(context.TODO(), networkClient, groupID, createOpts).Extract()
+	if err != nil {
+		panic(err)
+	}
+
+Example to add addresses to an existing Address Group
+
+	groupID := "37d94f8a-d136-465c-ae46-144f0d8ef141"
+	createOpts := addressgroups.UpdateAddressesOpts{
+		Addresses: []string{"10.2.30.4/32", "10.2.30.6/32"},
+	}
+	addressGroup, err := addressgroups.AddAddresses(context.TODO(), networkClient, groupID, createOpts).Extract()
+	if err != nil {
+		panic(err)
+	}
+
+Example to remove addresses from an existing Address Group
+
+	groupID := "37d94f8a-d136-465c-ae46-144f0d8ef141"
+	createOpts := addressgroups.UpdateAddressesOpts{
+		Addresses: []string{"10.2.30.4/32", "10.2.30.6/32"},
+	}
+	addressGroup, err := addressgroups.RemoveAddresses(context.TODO(), networkClient, groupID, createOpts).Extract()
+	if err != nil {
+		panic(err)
+	}
+
+*/
+
+package addressgroups
diff --git a/openstack/networking/v2/extensions/security/addressgroups/requests.go b/openstack/networking/v2/extensions/security/addressgroups/requests.go
new file mode 100644
index 000000000..8d2d6fedb
--- /dev/null
+++ b/openstack/networking/v2/extensions/security/addressgroups/requests.go
@@ -0,0 +1,197 @@
+package addressgroups
+
+import (
+	"context"
+
+	"github.com/gophercloud/gophercloud/v2"
+	"github.com/gophercloud/gophercloud/v2/pagination"
+)
+
+// ListOptsBuilder allows extensions to add additional parameters to the
+// List request.
+type ListOptsBuilder interface {
+	ToAddressGroupListQuery() (string, error)
+}
+
+// ListOpts allows the filtering and sorting of paginated collections through
+// the API. Filtering is achieved by passing in struct field values that map to
+// the address group attributes you want to see returned. SortKey allows
+// you to sort by a particular network attribute. SortDir sets the direction,
+// and is either `asc' or `desc'. Marker and Limit are used for pagination.
+type ListOpts struct {
+	ID          string   `q:"id"`
+	Name        string   `q:"name"`
+	Description string   `q:"description"`
+	ProjectID   string   `q:"project_id"`
+	Addresses   []string `q:"addresses"`
+	Limit       int      `q:"limit"`
+	Marker      string   `q:"marker"`
+	SortKey     string   `q:"sort_key"`
+	SortDir     string   `q:"sort_dir"`
+}
+
+// ToAddressGroupListQuery formats a ListOpts into a query string.
+func (opts ListOpts) ToAddressGroupListQuery() (string, error) {
+	q, err := gophercloud.BuildQueryString(opts)
+	return q.String(), err
+}
+
+// List returns a Pager which allows you to iterate over a collection of
+// address groups. It accepts a ListOpts struct, which allows you to filter
+// and sort the returned collection for greater efficiency.
+func List(c *gophercloud.ServiceClient, opts ListOptsBuilder) pagination.Pager {
+	url := rootURL(c)
+	if opts != nil {
+		query, err := opts.ToAddressGroupListQuery()
+		if err != nil {
+			return pagination.Pager{Err: err}
+		}
+		url += query
+	}
+	return pagination.NewPager(c, url, func(r pagination.PageResult) pagination.Page {
+		return AddressGroupPage{pagination.LinkedPageBase{PageResult: r}}
+	})
+}
+
+// CreateOptsBuilder allows extensions to add additional parameters to the
+// Create request.
+type CreateOptsBuilder interface {
+	ToAddressGroupCreateMap() (map[string]any, error)
+}
+
+// CreateOpts contains all the values needed to create a new address group.
+type CreateOpts struct {
+	// The address group ID to associate with this address group.
+	ID string `json:"id,omitempty"`
+
+	// Human readable name for the address group (255 characters limit). Does not have to be unique.
+	Name string `json:"name,omitempty"`
+
+	// Human readable description for the address group (255 characters limit).
+	Description string `json:"description,omitempty"`
+
+	// Owner of the address group.
+	// Only administrative users can specify a project UUID other than their own.
+	ProjectID string `json:"project_id,omitempty"`
+
+	// Array of address. It supports both CIDR and IP range objects.
+	// An example of addresses: [“132.168.4.12/24”, “132.168.5.12-132.168.5.24”, “2001::db8::f00/64”]
+	Addresses []string `json:"addresses" required:"true"`
+}
+
+// ToAddressGroupCreateMap builds a request body from CreateOpts.
+func (opts CreateOpts) ToAddressGroupCreateMap() (map[string]any, error) {
+	return gophercloud.BuildRequestBody(opts, "address_group")
+}
+
+// ToAddressesCreateMap builds a request body from CreateOpts.
+func (opts CreateOpts) ToAddressesCreateMap() (map[string]any, error) {
+	return gophercloud.BuildRequestBody(opts, "")
+}
+
+// Create is an operation which creates a new address group and associates it
+// with an existing address group (whose ID is specified in CreateOpts).
+func Create(ctx context.Context, c *gophercloud.ServiceClient, opts CreateOptsBuilder) (r CreateResult) {
+	b, err := opts.ToAddressGroupCreateMap()
+	if err != nil {
+		r.Err = err
+		return
+	}
+	resp, err := c.Post(ctx, rootURL(c), b, &r.Body, nil)
+	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
+	return
+}
+
+// Get retrieves a particular address group based on its unique ID.
+func Get(ctx context.Context, c *gophercloud.ServiceClient, id string) (r GetResult) {
+	resp, err := c.Get(ctx, resourceURL(c, id), &r.Body, nil)
+	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
+	return
+}
+
+// Delete will permanently delete a particular address group based on its
+// unique ID.
+func Delete(ctx context.Context, c *gophercloud.ServiceClient, id string) (r DeleteResult) {
+	resp, err := c.Delete(ctx, resourceURL(c, id), nil)
+	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
+	return
+}
+
+// UpdateOptsBuilder allows extensions to add additional parameters to the
+// Update requests.
+type UpdateOptsBuilder interface {
+	ToAddressGroupUpdateMap() (map[string]any, error)
+}
+
+// UpdateOpts contains all the values needed to update an address group.
+type UpdateOpts struct {
+	// Human readable name for the address group (255 characters limit). Does not have to be unique.
+	Name *string `json:"name,omitempty"`
+	// Human readable description for the address group (255 characters limit).
+	Description *string `json:"description,omitempty"`
+}
+
+// ToAddressGroupUpdateMap builds a request body from UpdateOpts.
+func (opts UpdateOpts) ToAddressGroupUpdateMap() (map[string]any, error) {
+	return gophercloud.BuildRequestBody(opts, "address_group")
+}
+
+// Update will update a particular address group with a complete new set of data.
+func Update(ctx context.Context, c *gophercloud.ServiceClient, id string, opts UpdateOptsBuilder) (r UpdateResult) {
+	b, err := opts.ToAddressGroupUpdateMap()
+	if err != nil {
+		r.Err = err
+		return
+	}
+	resp, err := c.Put(ctx, resourceURL(c, id), b, &r.Body, &gophercloud.RequestOpts{
+		OkCodes: []int{200},
+	})
+	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
+	return
+}
+
+// UpdateAddressesOpts will add or remove a list of particular addresses from
+// an address group. It is used by both AddAddresses and RemoveAddresses
+// requests.
+type UpdateAddressesOpts struct {
+	Addresses []string `json:"addresses" required:"true"`
+}
+
+// AddressesBuilder allows extensions to add additional parameters to the
+// AddAddresses or RemoveAddresses requests.
+type UpdateAddressesBuilder interface {
+	ToUpdateAddressesMap() (map[string]any, error)
+}
+
+// ToAddressesCreateMap builds a request body from CreateOpts.
+func (opts UpdateAddressesOpts) ToUpdateAddressesMap() (map[string]any, error) {
+	return gophercloud.BuildRequestBody(opts, "")
+}
+
+// AddAddresses will add IP addresses to a particular address group.
+func AddAddresses(ctx context.Context, c *gophercloud.ServiceClient, id string, opts UpdateAddressesBuilder) (r AddAddressesResult) {
+	b, err := opts.ToUpdateAddressesMap()
+	if err != nil {
+		r.Err = err
+		return
+	}
+	resp, err := c.Put(ctx, resourceAddAddressesURL(c, id), b, &r.Body, &gophercloud.RequestOpts{
+		OkCodes: []int{200},
+	})
+	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
+	return
+}
+
+// RemoveAddresses will remove particular IP addresses from a particular address group.
+func RemoveAddresses(ctx context.Context, c *gophercloud.ServiceClient, id string, opts UpdateAddressesBuilder) (r RemoveAddressesResult) {
+	b, err := opts.ToUpdateAddressesMap()
+	if err != nil {
+		r.Err = err
+		return
+	}
+	resp, err := c.Put(ctx, resourceRemoveAddressesURL(c, id), b, &r.Body, &gophercloud.RequestOpts{
+		OkCodes: []int{200},
+	})
+	_, r.Header, r.Err = gophercloud.ParseResponse(resp, err)
+	return
+}
diff --git a/openstack/networking/v2/extensions/security/addressgroups/results.go b/openstack/networking/v2/extensions/security/addressgroups/results.go
new file mode 100644
index 000000000..b949def3a
--- /dev/null
+++ b/openstack/networking/v2/extensions/security/addressgroups/results.go
@@ -0,0 +1,115 @@
+package addressgroups
+
+import (
+	"github.com/gophercloud/gophercloud/v2"
+	"github.com/gophercloud/gophercloud/v2/pagination"
+)
+
+// AddressGroup represents a container for address groups.
+type AddressGroup struct {
+	// Unique identifier for the address_group object.
+	ID string `json:"id"`
+
+	// Human readable name for the address group (255 characters limit). Does not have to be unique.
+	Name string `json:"name"`
+
+	// Human readable description for the address group (255 characters limit).
+	Description string `json:"description"`
+
+	// ProjectID is the project owner of this address group.
+	ProjectID string `json:"project_id"`
+
+	// Array of address. It supports both CIDR and IP range objects.
+	// An example of addresses: [“132.168.4.12/24”, “132.168.5.12-132.168.5.24”, “2001::db8::f00/64”]
+	Addresses []string `json:"addresses"`
+}
+
+// AddressGroupPage is the page returned by a pager when traversing over a
+// collection of address group addresses.
+type AddressGroupPage struct {
+	pagination.LinkedPageBase
+}
+
+// NextPageURL is invoked when a paginated collection of address groups has
+// reached the end of a page and the pager seeks to traverse over a new one. In
+// order to do this, it needs to construct the next page's URL.
+func (r AddressGroupPage) NextPageURL() (string, error) {
+	var s struct {
+		Links []gophercloud.Link `json:"address_groups_links"`
+	}
+	err := r.ExtractInto(&s)
+	if err != nil {
+		return "", err
+	}
+	return gophercloud.ExtractNextURL(s.Links)
+}
+
+// IsEmpty checks whether a AddressGroupPage struct is empty.
+func (r AddressGroupPage) IsEmpty() (bool, error) {
+	if r.StatusCode == 204 {
+		return true, nil
+	}
+
+	is, err := ExtractGroups(r)
+	return len(is) == 0, err
+}
+
+// ExtractGroups accepts a Page struct, specifically a AddressGroupPage struct,
+// and extracts the elements into a slice of AddressGroup structs. In other words,
+// a generic collection is mapped into a relevant slice.
+func ExtractGroups(r pagination.Page) ([]AddressGroup, error) {
+	var s struct {
+		AddressGroups []AddressGroup `json:"address_groups"`
+	}
+	err := (r.(AddressGroupPage)).ExtractInto(&s)
+	return s.AddressGroups, err
+}
+
+type commonResult struct {
+	gophercloud.Result
+}
+
+// Extract is a function that accepts a result and extracts a address group.
+func (r commonResult) Extract() (*AddressGroup, error) {
+	var s struct {
+		AddressGroup *AddressGroup `json:"address_group"`
+	}
+	err := r.ExtractInto(&s)
+	return s.AddressGroup, err
+}
+
+// CreateResult represents the result of a create operation. Call its Extract
+// method to interpret it as a AddressGroup.
+type CreateResult struct {
+	commonResult
+}
+
+// GetResult represents the result of a get operation. Call its Extract
+// method to interpret it as a AddressGroup.
+type GetResult struct {
+	commonResult
+}
+
+// DeleteResult represents the result of a delete operation. Call its
+// ExtractErr method to determine if the request succeeded or failed.
+type DeleteResult struct {
+	gophercloud.ErrResult
+}
+
+// UpdateResult represents the result of an update address group operation. Call its Extract
+// method to interpret it as a AddressGroup.
+type UpdateResult struct {
+	commonResult
+}
+
+// AddAddressesResult represents the result of an add addresses operation. Call its Extract
+// method to interpret it as a AddressGroup.
+type AddAddressesResult struct {
+	commonResult
+}
+
+// RemoveAddressesResult represents the result of a remove addresses operation. Call its Extract
+// method to interpret it as a AddressGroup.
+type RemoveAddressesResult struct {
+	commonResult
+}
diff --git a/openstack/networking/v2/extensions/security/addressgroups/urls.go b/openstack/networking/v2/extensions/security/addressgroups/urls.go
new file mode 100644
index 000000000..60525743e
--- /dev/null
+++ b/openstack/networking/v2/extensions/security/addressgroups/urls.go
@@ -0,0 +1,21 @@
+package addressgroups
+
+import "github.com/gophercloud/gophercloud/v2"
+
+const rootPath = "address-groups"
+
+func rootURL(c *gophercloud.ServiceClient) string {
+	return c.ServiceURL(rootPath)
+}
+
+func resourceURL(c *gophercloud.ServiceClient, id string) string {
+	return c.ServiceURL(rootPath, id)
+}
+
+func resourceAddAddressesURL(c *gophercloud.ServiceClient, id string) string {
+	return c.ServiceURL(rootPath, id, "add_addresses")
+}
+
+func resourceRemoveAddressesURL(c *gophercloud.ServiceClient, id string) string {
+	return c.ServiceURL(rootPath, id, "remove_addresses")
+}
diff --git a/openstack/networking/v2/extensions/security/rules/requests.go b/openstack/networking/v2/extensions/security/rules/requests.go
index a3c6a8a2e..1cba0624b 100644
--- a/openstack/networking/v2/extensions/security/rules/requests.go
+++ b/openstack/networking/v2/extensions/security/rules/requests.go
@@ -19,23 +19,24 @@ type ListOptsBuilder interface {
 // you to sort by a particular network attribute. SortDir sets the direction,
 // and is either `asc' or `desc'. Marker and Limit are used for pagination.
 type ListOpts struct {
-	Direction      string `q:"direction"`
-	EtherType      string `q:"ethertype"`
-	ID             string `q:"id"`
-	Description    string `q:"description"`
-	PortRangeMax   int    `q:"port_range_max"`
-	PortRangeMin   int    `q:"port_range_min"`
-	Protocol       string `q:"protocol"`
-	RemoteGroupID  string `q:"remote_group_id"`
-	RemoteIPPrefix string `q:"remote_ip_prefix"`
-	SecGroupID     string `q:"security_group_id"`
-	TenantID       string `q:"tenant_id"`
-	ProjectID      string `q:"project_id"`
-	Limit          int    `q:"limit"`
-	Marker         string `q:"marker"`
-	SortKey        string `q:"sort_key"`
-	SortDir        string `q:"sort_dir"`
-	RevisionNumber *int   `q:"revision_number"`
+	Direction            string `q:"direction"`
+	EtherType            string `q:"ethertype"`
+	ID                   string `q:"id"`
+	Description          string `q:"description"`
+	PortRangeMax         int    `q:"port_range_max"`
+	PortRangeMin         int    `q:"port_range_min"`
+	Protocol             string `q:"protocol"`
+	RemoteAddressGroupID string `q:"remote_address_group_id"`
+	RemoteGroupID        string `q:"remote_group_id"`
+	RemoteIPPrefix       string `q:"remote_ip_prefix"`
+	SecGroupID           string `q:"security_group_id"`
+	TenantID             string `q:"tenant_id"`
+	ProjectID            string `q:"project_id"`
+	Limit                int    `q:"limit"`
+	Marker               string `q:"marker"`
+	SortKey              string `q:"sort_key"`
+	SortDir              string `q:"sort_dir"`
+	RevisionNumber       *int   `q:"revision_number"`
 }
 
 // ToSecGroupListQuery formats a ListOpts into a query string.
@@ -137,12 +138,16 @@ type CreateOpts struct {
 	// "tcp", "udp", "icmp" or an empty string.
 	Protocol RuleProtocol `json:"protocol,omitempty"`
 
+	// The remote address group ID to be associated with this security group rule.
+	// You can specify either RemoteAddressGroupID, RemoteGroupID, or RemoteIPPrefix
+	RemoteAddressGroupID string `json:"remote_address_group_id,omitempty"`
+
 	// The remote group ID to be associated with this security group rule. You can
-	// specify either RemoteGroupID or RemoteIPPrefix.
+	// specify either RemoteAddressGroupID,RemoteGroupID or RemoteIPPrefix.
 	RemoteGroupID string `json:"remote_group_id,omitempty"`
 
 	// The remote IP prefix to be associated with this security group rule. You can
-	// specify either RemoteGroupID or RemoteIPPrefix. This attribute matches the
+	// specify either RemoteAddressGroupID,RemoteGroupID or RemoteIPPrefix. This attribute matches the
 	// specified IP prefix as the source IP address of the IP packet.
 	RemoteIPPrefix string `json:"remote_ip_prefix,omitempty"`
 
diff --git a/openstack/networking/v2/extensions/security/rules/results.go b/openstack/networking/v2/extensions/security/rules/results.go
index 8a3355dfe..2d528bd28 100644
--- a/openstack/networking/v2/extensions/security/rules/results.go
+++ b/openstack/networking/v2/extensions/security/rules/results.go
@@ -44,6 +44,10 @@ type SecGroupRule struct {
 	// "tcp", "udp", "icmp" or an empty string.
 	Protocol string
 
+	// The remote address group ID to be associated with this security group rule.
+	// You can specify either RemoteAddressGroupID, RemoteGroupID, or RemoteIPPrefix
+	RemoteAddressGroupID string `json:"remote_address_group_id"`
+
 	// The remote group ID to be associated with this security group rule. You
 	// can specify either RemoteGroupID or RemoteIPPrefix.
 	RemoteGroupID string `json:"remote_group_id"`



Test patch:
diff --git a/internal/acceptance/openstack/networking/v2/extensions/security_test.go b/internal/acceptance/openstack/networking/v2/extensions/security_test.go
index 33fc3f176..ab3a05808 100644
--- a/internal/acceptance/openstack/networking/v2/extensions/security_test.go
+++ b/internal/acceptance/openstack/networking/v2/extensions/security_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/gophercloud/gophercloud/v2/internal/acceptance/clients"
 	networking "github.com/gophercloud/gophercloud/v2/internal/acceptance/openstack/networking/v2"
 	"github.com/gophercloud/gophercloud/v2/internal/acceptance/tools"
+	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/security/addressgroups"
 	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/security/groups"
 	th "github.com/gophercloud/gophercloud/v2/testhelper"
 )
@@ -156,3 +157,79 @@ func TestSecurityGroupsRevision(t *testing.T) {
 	th.AssertEquals(t, group.Name, newName)
 	th.AssertEquals(t, group.Description, newDescription)
 }
+
+func TestSecurityAddressGroups(t *testing.T) {
+	client, err := clients.NewNetworkV2Client()
+	th.AssertNoErr(t, err)
+
+	group, err := CreateSecurityAddressGroup(t, client)
+	th.AssertNoErr(t, err)
+	defer DeleteSecurityAddressGroup(t, client, group.ID)
+
+	tools.PrintResource(t, group)
+
+	name := "Update group"
+	description := ""
+	updateOpts := addressgroups.UpdateOpts{
+		Name:        &name,
+		Description: &description,
+	}
+	newGroup, err := addressgroups.Update(context.TODO(), client, group.ID, updateOpts).Extract()
+	th.AssertNoErr(t, err)
+	tools.PrintResource(t, newGroup)
+
+	th.AssertEquals(t, newGroup.Name, name)
+	th.AssertEquals(t, newGroup.Description, description)
+
+	listOpts := addressgroups.ListOpts{}
+	allPages, err := addressgroups.List(client, listOpts).AllPages(context.TODO())
+	th.AssertNoErr(t, err)
+	allGroups, err := addressgroups.ExtractGroups(allPages)
+	th.AssertNoErr(t, err)
+
+	var found = -1
+	for i, v := range allGroups {
+		if v.ID == group.ID {
+			found = i
+			break
+		}
+	}
+	if found == -1 {
+		t.Fatalf("Expected to find group %s in the list of groups", group.ID)
+	}
+
+	th.AssertEquals(t, allGroups[found].Name, newGroup.Name)
+	th.AssertEquals(t, allGroups[found].Description, newGroup.Description)
+	th.AssertDeepEquals(t, allGroups[found].Addresses, newGroup.Addresses)
+
+	// Test that we can add a new address to the group.
+	newAddresses := []string{
+		"192.168.170.0/24",
+	}
+	addAddressOpts := addressgroups.UpdateAddressesOpts{
+		Addresses: newAddresses,
+	}
+	updatedGroup, err := addressgroups.AddAddresses(context.TODO(), client, group.ID, addAddressOpts).Extract()
+	th.AssertNoErr(t, err)
+	tools.PrintResource(t, updatedGroup)
+
+	// Check that the new address was added.
+	expectedAddresses := append(group.Addresses, newAddresses...)
+	th.AssertDeepEquals(t, updatedGroup.Addresses, expectedAddresses)
+
+	// Test that we can remove an address from the group.
+	removeAddressOpts := addressgroups.UpdateAddressesOpts{
+		Addresses: newAddresses,
+	}
+	updatedGroup, err = addressgroups.RemoveAddresses(context.TODO(), client, group.ID, removeAddressOpts).Extract()
+	th.AssertNoErr(t, err)
+	tools.PrintResource(t, updatedGroup)
+
+	// Check that the address was removed.
+	expectedAddresses = group.Addresses
+	th.AssertDeepEquals(t, updatedGroup.Addresses, expectedAddresses)
+
+	// Verify that the group exists.
+	_, err = addressgroups.Get(context.TODO(), client, group.ID).Extract()
+	th.AssertNoErr(t, err)
+}
diff --git a/openstack/networking/v2/extensions/security/addressgroups/testing/fixtures_test.go b/openstack/networking/v2/extensions/security/addressgroups/testing/fixtures_test.go
new file mode 100644
index 000000000..537586863
--- /dev/null
+++ b/openstack/networking/v2/extensions/security/addressgroups/testing/fixtures_test.go
@@ -0,0 +1,119 @@
+package testing
+
+const AddressGroupListResponse = `
+{
+    "address_groups": [
+        {
+            "id": "8722e0e0-9cc9-4490-9660-8c9a5732fbb0",
+            "project_id": "45977fa2dbd7482098dd68d0d8970117",
+            "name": "ADDR_GP_1",
+            "addresses": [
+            "132.168.4.12/24"
+            ]
+        }
+    ]
+}
+`
+
+const AddressGroupGetResponse = `
+{
+    "address_group": {
+        "description": "",
+        "id": "8722e0e0-9cc9-4490-9660-8c9a5732fbb0",
+        "name": "ADDR_GP_1",
+        "project_id": "45977fa2dbd7482098dd68d0d8970117",
+        "addresses": [
+           "132.168.4.12/24"
+        ]
+    }
+}
+`
+
+const AddressGroupCreateRequest = `
+{
+    "address_group": {
+        "name": "ADDR_GP_1",
+        "addresses": [
+           "132.168.4.12/24"
+        ]
+    }
+}
+`
+
+const AddressGroupCreateResponse = `
+{
+   "address_group": {
+        "description": "",
+        "id": "8722e0e0-9cc9-4490-9660-8c9a5732fbb0",
+        "name": "ADDR_GP_1",
+        "project_id": "45977fa2dbd7482098dd68d0d8970117",
+        "addresses": [
+           "132.168.4.12/24"
+        ]
+    }
+}
+`
+
+const AddressGroupUpdateRequest = `
+{
+   "address_group": {
+        "description": "new description",
+        "name": "ADDR_GP_2"
+    }
+}
+`
+
+const AddressGroupUpdateResponse = `
+{
+   "address_group": {
+        "description": "new description",
+        "id": "8722e0e0-9cc9-4490-9660-8c9a5732fbb0",
+        "name": "ADDR_GP_2",
+        "project_id": "45977fa2dbd7482098dd68d0d8970117",
+        "addresses": [
+           "192.168.4.1/32"
+        ]
+    }
+}
+`
+
+const AddressGroupAddAddressesRequest = `
+{
+    "addresses": ["192.168.4.1/32"]
+}
+`
+
+const AddressGroupAddAddressesResponse = `
+{
+   "address_group": {
+        "description": "original description",
+        "id": "8722e0e0-9cc9-4490-9660-8c9a5732fbb0",
+        "name": "ADDR_GP_1",
+        "project_id": "45977fa2dbd7482098dd68d0d8970117",
+        "addresses": [
+           "132.168.4.12/24",
+           "192.168.4.1/32"
+        ]
+    }
+}
+`
+
+const AddressGroupRemoveAddressesRequest = `
+{
+    "addresses": ["192.168.4.1/32"]
+}
+`
+
+const AddressGroupRemoveAddressesResponse = `
+{
+   "address_group": {
+        "description": "original description",
+        "id": "8722e0e0-9cc9-4490-9660-8c9a5732fbb0",
+        "name": "ADDR_GP_1",
+        "project_id": "45977fa2dbd7482098dd68d0d8970117",
+        "addresses": [
+           "132.168.4.12/24"
+        ]
+    }
+}
+`
diff --git a/openstack/networking/v2/extensions/security/addressgroups/testing/requests_test.go b/openstack/networking/v2/extensions/security/addressgroups/testing/requests_test.go
new file mode 100644
index 000000000..24abf1cb7
--- /dev/null
+++ b/openstack/networking/v2/extensions/security/addressgroups/testing/requests_test.go
@@ -0,0 +1,227 @@
+package testing
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+
+	fake "github.com/gophercloud/gophercloud/v2/openstack/networking/v2/common"
+	"github.com/gophercloud/gophercloud/v2/openstack/networking/v2/extensions/security/addressgroups"
+	"github.com/gophercloud/gophercloud/v2/pagination"
+	th "github.com/gophercloud/gophercloud/v2/testhelper"
+)
+
+func TestList(t *testing.T) {
+	fakeServer := th.SetupHTTP()
+	defer fakeServer.Teardown()
+
+	fakeServer.Mux.HandleFunc("/v2.0/address-groups", func(w http.ResponseWriter, r *http.Request) {
+		th.TestMethod(t, r, "GET")
+		th.TestHeader(t, r, "X-Auth-Token", fake.TokenID)
+
+		w.Header().Add("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+
+		fmt.Fprintf(w, AddressGroupListResponse)
+	})
+
+	count := 0
+
+	err := addressgroups.List(fake.ServiceClient(fakeServer), addressgroups.ListOpts{}).EachPage(context.TODO(), func(_ context.Context, page pagination.Page) (bool, error) {
+		count++
+		actual, err := addressgroups.ExtractGroups(page)
+		if err != nil {
+			t.Errorf("Failed to extract address groups: %v", err)
+			return false, err
+		}
+
+		expected := []addressgroups.AddressGroup{
+			{
+				Description: "",
+				ID:          "8722e0e0-9cc9-4490-9660-8c9a5732fbb0",
+				Name:        "ADDR_GP_1",
+				ProjectID:   "45977fa2dbd7482098dd68d0d8970117",
+				Addresses: []string{
+					"132.168.4.12/24",
+				},
+			},
+		}
+
+		th.CheckDeepEquals(t, expected, actual)
+
+		return true, nil
+	})
+	th.AssertNoErr(t, err)
+
+	if count != 1 {
+		t.Errorf("Expected 1 page, got %d", count)
+	}
+}
+
+func TestCreate(t *testing.T) {
+	fakeServer := th.SetupHTTP()
+	defer fakeServer.Teardown()
+
+	fakeServer.Mux.HandleFunc("/v2.0/address-groups", func(w http.ResponseWriter, r *http.Request) {
+		th.TestMethod(t, r, "POST")
+		th.TestHeader(t, r, "X-Auth-Token", fake.TokenID)
+		th.TestHeader(t, r, "Content-Type", "application/json")
+		th.TestHeader(t, r, "Accept", "application/json")
+		th.TestJSONRequest(t, r, AddressGroupCreateRequest)
+
+		w.Header().Add("Content-Type", "application/json")
+		w.WriteHeader(http.StatusCreated)
+
+		fmt.Fprintf(w, AddressGroupCreateResponse)
+	})
+
+	opts := addressgroups.CreateOpts{
+		Name: "ADDR_GP_1",
+		Addresses: []string{
+			"132.168.4.12/24",
+		},
+	}
+	_, err := addressgroups.Create(context.TODO(), fake.ServiceClient(fakeServer), opts).Extract()
+	th.AssertNoErr(t, err)
+}
+
+func TestRequiredCreateOpts(t *testing.T) {
+	fakeServer := th.SetupHTTP()
+	defer fakeServer.Teardown()
+
+	_, err := addressgroups.Create(context.TODO(), fake.ServiceClient(fakeServer), addressgroups.CreateOpts{Name: "ADDR_GP_1"}).Extract()
+	if err == nil {
+		t.Fatalf("Expected error, got none")
+	}
+}
+
+func TestGet(t *testing.T) {
+	fakeServer := th.SetupHTTP()
+	defer fakeServer.Teardown()
+
+	fakeServer.Mux.HandleFunc("/v2.0/address-groups/8722e0e0-9cc9-4490-9660-8c9a5732fbb0", func(w http.ResponseWriter, r *http.Request) {
+		th.TestMethod(t, r, "GET")
+		th.TestHeader(t, r, "X-Auth-Token", fake.TokenID)
+
+		w.Header().Add("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+
+		fmt.Fprintf(w, AddressGroupGetResponse)
+	})
+
+	sr, err := addressgroups.Get(context.TODO(), fake.ServiceClient(fakeServer), "8722e0e0-9cc9-4490-9660-8c9a5732fbb0").Extract()
+	th.AssertNoErr(t, err)
+	th.AssertEquals(t, "", sr.Description)
+	th.AssertEquals(t, "8722e0e0-9cc9-4490-9660-8c9a5732fbb0", sr.ID)
+	th.AssertEquals(t, "45977fa2dbd7482098dd68d0d8970117", sr.ProjectID)
+	th.CheckDeepEquals(t, []string{"132.168.4.12/24"}, sr.Addresses)
+	th.AssertEquals(t, "ADDR_GP_1", sr.Name)
+}
+
+func TestUpdate(t *testing.T) {
+	fakeServer := th.SetupHTTP()
+	defer fakeServer.Teardown()
+
+	fakeServer.Mux.HandleFunc("/v2.0/address-groups/8722e0e0-9cc9-4490-9660-8c9a5732fbb0",
+		func(w http.ResponseWriter, r *http.Request) {
+			th.TestMethod(t, r, "PUT")
+			th.TestHeader(t, r, "X-Auth-Token", fake.TokenID)
+			th.TestHeader(t, r, "Content-Type", "application/json")
+			th.TestHeader(t, r, "Accept", "application/json")
+			th.TestJSONRequest(t, r, AddressGroupUpdateRequest)
+
+			w.Header().Add("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+
+			fmt.Fprintf(w, AddressGroupUpdateResponse)
+		})
+
+	name := "ADDR_GP_2"
+	description := "new description"
+	opts := addressgroups.UpdateOpts{
+		Name:        &name,
+		Description: &description,
+	}
+	ag, err := addressgroups.Update(context.TODO(), fake.ServiceClient(fakeServer), "8722e0e0-9cc9-4490-9660-8c9a5732fbb0", opts).Extract()
+	th.AssertNoErr(t, err)
+
+	th.CheckDeepEquals(t, []string{"192.168.4.1/32"}, ag.Addresses)
+	th.AssertEquals(t, "new description", ag.Description)
+	th.AssertEquals(t, "8722e0e0-9cc9-4490-9660-8c9a5732fbb0", ag.ID)
+	th.AssertEquals(t, "45977fa2dbd7482098dd68d0d8970117", ag.ProjectID)
+	th.AssertEquals(t, "ADDR_GP_2", ag.Name)
+}
+
+func TestAddAddresses(t *testing.T) {
+	fakeServer := th.SetupHTTP()
+	defer fakeServer.Teardown()
+
+	fakeServer.Mux.HandleFunc("/v2.0/address-groups/8722e0e0-9cc9-4490-9660-8c9a5732fbb0/add_addresses",
+		func(w http.ResponseWriter, r *http.Request) {
+			th.TestMethod(t, r, "PUT")
+			th.TestHeader(t, r, "X-Auth-Token", fake.TokenID)
+			th.TestHeader(t, r, "Content-Type", "application/json")
+			th.TestHeader(t, r, "Accept", "application/json")
+			th.TestJSONRequest(t, r, AddressGroupAddAddressesRequest)
+
+			w.Header().Add("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+
+			fmt.Fprintf(w, AddressGroupAddAddressesResponse)
+		})
+
+	opts := addressgroups.UpdateAddressesOpts{
+		Addresses: []string{"192.168.4.1/32"},
+	}
+	ag, err := addressgroups.AddAddresses(context.TODO(), fake.ServiceClient(fakeServer), "8722e0e0-9cc9-4490-9660-8c9a5732fbb0", opts).Extract()
+	th.AssertNoErr(t, err)
+
+	th.CheckDeepEquals(t, []string{"132.168.4.12/24", "192.168.4.1/32"}, ag.Addresses)
+	th.AssertEquals(t, "original description", ag.Description)
+	th.AssertEquals(t, "8722e0e0-9cc9-4490-9660-8c9a5732fbb0", ag.ID)
+}
+
+func TestRemoveAddresses(t *testing.T) {
+	fakeServer := th.SetupHTTP()
+	defer fakeServer.Teardown()
+
+	fakeServer.Mux.HandleFunc("/v2.0/address-groups/8722e0e0-9cc9-4490-9660-8c9a5732fbb0/remove_addresses",
+		func(w http.ResponseWriter, r *http.Request) {
+			th.TestMethod(t, r, "PUT")
+			th.TestHeader(t, r, "X-Auth-Token", fake.TokenID)
+			th.TestHeader(t, r, "Content-Type", "application/json")
+			th.TestHeader(t, r, "Accept", "application/json")
+			th.TestJSONRequest(t, r, AddressGroupRemoveAddressesRequest)
+
+			w.Header().Add("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+
+			fmt.Fprintf(w, AddressGroupRemoveAddressesResponse)
+		})
+
+	opts := addressgroups.UpdateAddressesOpts{
+		Addresses: []string{"192.168.4.1/32"},
+	}
+	ag, err := addressgroups.RemoveAddresses(context.TODO(), fake.ServiceClient(fakeServer), "8722e0e0-9cc9-4490-9660-8c9a5732fbb0", opts).Extract()
+	th.AssertNoErr(t, err)
+
+	th.CheckDeepEquals(t, []string{"132.168.4.12/24"}, ag.Addresses)
+	th.AssertEquals(t, "original description", ag.Description)
+	th.AssertEquals(t, "8722e0e0-9cc9-4490-9660-8c9a5732fbb0", ag.ID)
+}
+
+func TestDelete(t *testing.T) {
+	fakeServer := th.SetupHTTP()
+	defer fakeServer.Teardown()
+
+	fakeServer.Mux.HandleFunc("/v2.0/address-groups/4ec89087-d057-4e2c-911f-60a3b47ee304", func(w http.ResponseWriter, r *http.Request) {
+		th.TestMethod(t, r, "DELETE")
+		th.TestHeader(t, r, "X-Auth-Token", fake.TokenID)
+
+		w.WriteHeader(http.StatusNoContent)
+	})
+
+	err := addressgroups.Delete(context.TODO(), fake.ServiceClient(fakeServer), "4ec89087-d057-4e2c-911f-60a3b47ee304").ExtractErr()
+	th.AssertNoErr(t, err)
+}