OpenStack script to add a new or existing security group to a server.

security-group-updates.sh

#!/bin/bash
#
# Add Named Security Group and Default to the given IP Address
# security-group-updates.sh ipaddress
#
NAME_TO_ADD='the security group name'  # name of the security group to add
ADD_SECURITY='xxxxxxx-xxxx-...'   # ID of the security group to add
DEFAULT_SECURITY='xxxxxxx-xxxx-...'  # ID of the default security group you want to keep

# check if the give hostip has a security group and needs to be updated
function hasSecurityGroups() {
  nodeId=$1

  if [ "`nova show $nodeId | grep security_groups | grep $NAME_TO_ADD`" == "" ] ; then
    return 1
  else
    return 0
  fi
}

function addSecurityGroups() {
  portId=$1
  neutron port-update --security-group $ADD_SECURITY --security-group $DEFAULT_SECURITY $portId
}

function getNodeId() {
  hostip=$1

  nodeId=`nova list | grep $hostip | sed  -e 's/\s//g' | sed -e 's/|//' | sed -e 's/|.*//g'`

  echo $nodeId
}

function getPortId() {
  hostip=$1

  portId=`neutron port-list | grep $hostip | sed  -e 's/\s//g' | sed -e 's/|//' | sed -e 's/|.*//g'`

  echo $portId
}

ipaddr=$1
portId=`getPortId $ipaddr`
nodeId=`getNodeId $ipaddr`

echo "$ipaddr: port $portId at instance $nodeId"
hasSecurityGroups $nodeId
if [ $? -eq 1 ]; then
   echo "it does not have the security group"
   addSecurityGroups $portId
else
   echo "$nodeId already has the security group"
fi