Clean security groups if api/ssh ips are removed from config

[zetaab]

fixes #7125

[k8s-ci-robot]

@zetaab: The label(s) sig/openstack cannot be appled. These labels are supported: api-review, community/discussion, community/maintenance, community/question, cuj/build-train-deploy, cuj/multi-user, platform/aws, platform/azure, platform/gcp, platform/minikube, platform/other

In response to this:

fixes #7125

/sig openstack

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[zetaab]

/hold

wait until we have answer to kubelet port question

[zetaab]

/hold cancel

[zetaab]

/test pull-kops-verify-gomod

[zetaab]

@justinsb @mikesplain something wrong with gomod check

I0912 05:55:52.896] ERROR: go modules are not up to date; please run: go mod tidy
I0912 05:55:52.897] changed files:
I0912 05:55:52.897] ?? .config/
I0912 05:55:52.897] git diff:
W0912 05:55:52.931] Traceback (most recent call last):
W0912 05:55:52.931]   File "/workspace/./test-infra/jenkins/../scenarios/execute.py", line 50, in <module>
W0912 05:55:52.932]     main(ARGS.env, ARGS.cmd + ARGS.args)
W0912 05:55:52.932]   File "/workspace/./test-infra/jenkins/../scenarios/execute.py", line 41, in main
W0912 05:55:52.932]     check(*cmd)
W0912 05:55:52.932]   File "/workspace/./test-infra/jenkins/../scenarios/execute.py", line 30, in check
W0912 05:55:52.932]     subprocess.check_call(cmd)
W0912 05:55:52.932]   File "/usr/lib/python2.7/subprocess.py", line 186, in check_call
W0912 05:55:52.932]     raise CalledProcessError(retcode, cmd)
W0912 05:55:52.932] subprocess.CalledProcessError: Command '('./hack/verify-gomod',)' returned non-zero exit status 1

I have not created folder called .config

[chrisz100]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chrisz100, zetaab

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/model/openstackmodel/OWNERS [chrisz100,zetaab]
• upup/pkg/fi/cloudup/openstack/OWNERS [chrisz100,zetaab]
• upup/pkg/fi/cloudup/openstacktasks/OWNERS [chrisz100,zetaab]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mikesplain]

@zetaab, I'll open a cherry pick to 1.15, should this be in 1.14 as well?

[zetaab]

@mikesplain yes I think it could be cherrypicked to 1.14 as well. This is basically bug fix, because now the behaviour is that rules are not cleaned. It may lead to situations that there are sg rules that should not be there (like kops is opening 0.0.0.0 by default if you do not specify anything when creating cluster, it does not help modifying rules afterwards because 0.0.0.0 is not removed at all)