I am testing two OpenStack deployments. One is installed via Kolla Ansible, and the other is installed via Devstack. Both use the OVN mechanism driver.

I am using OpenStack CLI with admin privileges.
My problem is that: when I create an instance, a new “Default security group” is created in the OpenStack “Service” project. Is this normal?

Here are the commands I have used:

openstack image create cirros --public --container-format bare --disk-format qcow2 --property hw_rng_model=virtio < /opt/stack/devstack/offline/cirros

openstack --os-region-name=RegionOne flavor create --id 1 --ram 256 --disk 1 --vcpus 1 --property hw_rng:allowed=True cirros256

openstack network create self_service_net_1

openstack subnet create --network self_service_net_1 --subnet-range 10.20.30.0/24 s_sub_1

openstack network create --external --share --provider-physical-network physnet1 --provider-network-type flat   provider_net_1

openstack subnet create --network provider_net_1 --subnet-range x.y.z.0/24 --allocation-pool start=x.y.z.200,end=x.y.z.250 --gateway x.y.z.1 p_sub_1

openstack  router create extrouter

openstack router set  --external-gateway provider_net_1 extrouter

openstack router add subnet extrouter s_sub_1

openstack server create --flavor 1 --image cirros  --network self_service_net_1 --security-group default  --availability-zone nova:srv1 s1

openstack security group list

The result is :

+--------------------------------------+---------+------------------------+----------------------------------+------+
| ID                                   | Name    | Description            | Project                          | Tags |
+--------------------------------------+---------+------------------------+----------------------------------+------+
| 1a62aa21-01a0-46fa-aa54-940fa36df3c2 | default | Default security group | 6a412d392b92495a8c43d09a0c1ed971 | []   |
| fed64997-1b00-41e6-b21c-fbf073d7bd49 | default | Default security group | 87c7e9f6853e46d08d6867ac739896c5 | []   |
+--------------------------------------+---------+------------------------+----------------------------------+------+

The security group with ID 1a62aa21-01a0-46fa-aa54-940fa36df3c2 belongs to the “service” project and is created after the instance is built.

I had expected to have only one security group for the admin project.