brooklyncentral/brooklyn — pull request #1337 by sjcorbett (2014-04-25 17:45:52+00:00)
Title: Security group location customiser

Adds a JcloudsLocationCustomizer that configures application-wide and machine-unique security groups.

Machines are created with two security groups: one unique to the machine and one shared by all machines in the same application. The shared group allows communication on all ports between all machines in the group and SSH access on port 22 from the external IP address of the Brooklyn host. By default the machine-unique group configures no rules.

Permissions can be applied to individual machines by calling `addPermissionsToLocation(JcloudsSshMachineLocation, Collection)`. Entities that poll sensors with HTTP/JMX/etc. should call this before they are started.

The class is designed to be loaded by a `Supplier>` (i.e. from the `JCLOUDS_LOCATION_CUSTOMIZERS_SUPPLIER_TYPE` config) that calls `getInstance` with the appropriate application ID. The class will not work as expected if configured via the other customizer properties because JcloudsLocation will create new instances of the class and security groups will not be shared between nodes in the same application.

I have live tests for the class but a) they depend on code in brooklyn-software-base and b) they do not follow the same pattern as the rest of Brooklyn's live tests. I'm not sure how best to include them here.

I've tested the class extensively in EC2. I know for certain that it doesn't currently work with GCE, but the reason isn't insurmountable. See the comment in `createBaseSecurityGroupInLocation` for an explanation. I haven't tested other providers.