The trigger_members_refresh method in compute.api.py specifies a group id in the call to refresh_security_group_members. This is just the last group id seen and ignores the fact that a refresh may impact members of multiple groups.
Possible fallout from this is covered by the fact that the do_refresh_security_group_rules method in virt.firewall.py takes a specific group id but doesn't target just members of that group for refresh, rather it refreshes the rules for all instances on the host. This can lead to a lot of time wasted in needless refreshes of security group rules.
I would propose changing the logic of trigger_members_refresh so that instead of specifying a group to refresh it sends a specific refresh request per instance impacted, then alter the logic in do_refresh_security_group_rules to refresh a single instance resulting in refresh of only those rules that need it and removing the possibility of refreshing an instance multiple times if it is a member of more than one affected group.
Fix proposed to branch: master
Review: https:/