)]}'
{"kuryr_kubernetes/controller/drivers/network_policy.py":[{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"64caf2c6d0d49708d07501fc5b7f5204cb00384e","unresolved":false,"context_lines":[{"line_number":137,"context_line":"        worker_subnet_id \u003d CONF.pod_vif_nested.worker_nodes_subnet"},{"line_number":138,"context_line":"        if worker_subnet_id:"},{"line_number":139,"context_line":"            default_cidrs.append(utils.get_subnet_cidr(worker_subnet_id))"},{"line_number":140,"context_line":"        for cidr in default_cidrs:"},{"line_number":141,"context_line":"            default_rule \u003d {"},{"line_number":142,"context_line":"                \u0027security_group_rule\u0027: {"},{"line_number":143,"context_line":"                    \u0027ethertype\u0027: \u0027IPv4\u0027,"},{"line_number":144,"context_line":"                    \u0027security_group_id\u0027: sg_id,"},{"line_number":145,"context_line":"                    \u0027direction\u0027: \u0027ingress\u0027,"},{"line_number":146,"context_line":"                    \u0027description\u0027: \u0027Kuryr-Kubernetes NetPolicy SG rule\u0027,"},{"line_number":147,"context_line":"                    \u0027remote_ip_prefix\u0027: cidr"},{"line_number":148,"context_line":"                }}"},{"line_number":149,"context_line":"            driver_utils.create_security_group_rule(default_rule)"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    def create_security_group_rules_from_network_policy(self, policy,"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_7b313eec","line":148,"range":{"start_line":140,"start_character":0,"end_line":148,"end_character":18},"updated":"2020-03-02 09:11:14.000000000","message":"I know it\u0027s still wip, but just to highlight this also needs update.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"d4bee0eaa227919dc8ff4cd8c90a9143bd29d4cf","unresolved":false,"context_lines":[{"line_number":137,"context_line":"        worker_subnet_id \u003d CONF.pod_vif_nested.worker_nodes_subnet"},{"line_number":138,"context_line":"        if worker_subnet_id:"},{"line_number":139,"context_line":"            default_cidrs.append(utils.get_subnet_cidr(worker_subnet_id))"},{"line_number":140,"context_line":"        for cidr in default_cidrs:"},{"line_number":141,"context_line":"            default_rule \u003d {"},{"line_number":142,"context_line":"                \u0027security_group_rule\u0027: {"},{"line_number":143,"context_line":"                    \u0027ethertype\u0027: \u0027IPv4\u0027,"},{"line_number":144,"context_line":"                    \u0027security_group_id\u0027: sg_id,"},{"line_number":145,"context_line":"                    \u0027direction\u0027: \u0027ingress\u0027,"},{"line_number":146,"context_line":"                    \u0027description\u0027: \u0027Kuryr-Kubernetes NetPolicy SG rule\u0027,"},{"line_number":147,"context_line":"                    \u0027remote_ip_prefix\u0027: cidr"},{"line_number":148,"context_line":"                }}"},{"line_number":149,"context_line":"            driver_utils.create_security_group_rule(default_rule)"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    def create_security_group_rules_from_network_policy(self, policy,"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_21c2b4ea","line":148,"range":{"start_line":140,"start_character":0,"end_line":148,"end_character":18},"in_reply_to":"1fa4df85_7b313eec","updated":"2020-03-02 11:01:39.000000000","message":"Good catch!","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"49f0ef8a2c5ec9cee80f49ee2cee877c06eb322d","unresolved":false,"context_lines":[{"line_number":366,"context_line":"                    policy_namespace)"},{"line_number":367,"context_line":"        if allow_all:"},{"line_number":368,"context_line":"            for container_port, pods in matched_pods.items():"},{"line_number":369,"context_line":"                # TODO(gryf): should IPv6 be applied automatically here?"},{"line_number":370,"context_line":"                sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":371,"context_line":"                    sg_id, direction, container_port,"},{"line_number":372,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_df8dccd3","line":369,"range":{"start_line":369,"start_character":0,"end_line":369,"end_character":72},"updated":"2020-02-28 14:50:07.000000000","message":"I think so.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"49f0ef8a2c5ec9cee80f49ee2cee877c06eb322d","unresolved":false,"context_lines":[{"line_number":411,"context_line":"                sg_rule_body_list, pod_selector, policy_namespace,"},{"line_number":412,"context_line":"                allow_all\u003dTrue)"},{"line_number":413,"context_line":"        else:"},{"line_number":414,"context_line":"            # TODO(gryf): should IPv6 be applied automatically here?"},{"line_number":415,"context_line":"            sg_rule \u003d ("},{"line_number":416,"context_line":"                driver_utils.create_security_group_rule_body("},{"line_number":417,"context_line":"                    sg_id, direction, port.get(\u0027port\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_7fbe1866","line":414,"range":{"start_line":414,"start_character":0,"end_line":414,"end_character":68},"updated":"2020-02-28 14:50:07.000000000","message":"Yup.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"64caf2c6d0d49708d07501fc5b7f5204cb00384e","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":424,"context_line":"                sg_rule_body_list.extend(rule)"},{"line_number":425,"context_line":""},{"line_number":426,"context_line":"    def _create_default_sg_rule(self, sg_id, direction, sg_rule_body_list):"},{"line_number":427,"context_line":"        default_rule \u003d {"},{"line_number":428,"context_line":"            \u0027security_group_rule\u0027: {"},{"line_number":429,"context_line":"                \u0027ethertype\u0027: \u0027IPv4\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_bb37b6e3","line":426,"range":{"start_line":426,"start_character":8,"end_line":426,"end_character":31},"updated":"2020-03-02 09:11:14.000000000","message":"this also needs update.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"d4bee0eaa227919dc8ff4cd8c90a9143bd29d4cf","unresolved":false,"context_lines":[{"line_number":423,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":424,"context_line":"                sg_rule_body_list.extend(rule)"},{"line_number":425,"context_line":""},{"line_number":426,"context_line":"    def _create_default_sg_rule(self, sg_id, direction, sg_rule_body_list):"},{"line_number":427,"context_line":"        default_rule \u003d {"},{"line_number":428,"context_line":"            \u0027security_group_rule\u0027: {"},{"line_number":429,"context_line":"                \u0027ethertype\u0027: \u0027IPv4\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_a1ad4432","line":426,"range":{"start_line":426,"start_character":8,"end_line":426,"end_character":31},"in_reply_to":"1fa4df85_bb37b6e3","updated":"2020-03-02 11:01:39.000000000","message":"Done","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"49f0ef8a2c5ec9cee80f49ee2cee877c06eb322d","unresolved":false,"context_lines":[{"line_number":480,"context_line":"        if rule_list[0] \u003d\u003d {}:"},{"line_number":481,"context_line":"            LOG.debug(\u0027Applying default all open policy from %s\u0027,"},{"line_number":482,"context_line":"                      policy[\u0027metadata\u0027][\u0027selfLink\u0027])"},{"line_number":483,"context_line":"            # TODO(gryf): should IPv6 be applied automatically here?"},{"line_number":484,"context_line":"            rule \u003d driver_utils.create_security_group_rule_body(sg_id,"},{"line_number":485,"context_line":"                                                                direction)"},{"line_number":486,"context_line":"            sg_rule_body_list.append(rule)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_9fc194e7","line":483,"range":{"start_line":483,"start_character":0,"end_line":483,"end_character":68},"updated":"2020-02-28 14:50:07.000000000","message":"I\u0027d say so.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"49f0ef8a2c5ec9cee80f49ee2cee877c06eb322d","unresolved":false,"context_lines":[{"line_number":549,"context_line":"                            sg_id, policy_namespace, resource\u003dresource)"},{"line_number":550,"context_line":"                        sg_rule_body_list.extend(rule)"},{"line_number":551,"context_line":"                if allow_all:"},{"line_number":552,"context_line":"                    # TODO(gryf): should IPv6 be applied automatically here?"},{"line_number":553,"context_line":"                    rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":554,"context_line":"                        sg_id, direction,"},{"line_number":555,"context_line":"                        port_range_min\u003d1,"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_3fb8a074","line":552,"range":{"start_line":552,"start_character":0,"end_line":552,"end_character":76},"updated":"2020-02-28 14:50:07.000000000","message":"Yes.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"db437e0b45749ad6a6442b113f0c8c4d678b327d","unresolved":false,"context_lines":[{"line_number":549,"context_line":"                            sg_id, policy_namespace, resource\u003dresource)"},{"line_number":550,"context_line":"                        sg_rule_body_list.extend(rule)"},{"line_number":551,"context_line":"                if allow_all:"},{"line_number":552,"context_line":"                    # TODO(gryf): should IPv6 be applied automatically here?"},{"line_number":553,"context_line":"                    rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":554,"context_line":"                        sg_id, direction,"},{"line_number":555,"context_line":"                        port_range_min\u003d1,"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_b56351dc","line":552,"range":{"start_line":552,"start_character":0,"end_line":552,"end_character":76},"in_reply_to":"1fa4df85_3fb8a074","updated":"2020-02-28 16:09:37.000000000","message":"Alright. So I follow the rule of thumb, that in case of \"allow_all\", I\u0027ll create security group rules for both: ipv4 and ipv6.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"64caf2c6d0d49708d07501fc5b7f5204cb00384e","unresolved":false,"context_lines":[{"line_number":549,"context_line":"                            sg_id, policy_namespace, resource\u003dresource)"},{"line_number":550,"context_line":"                        sg_rule_body_list.extend(rule)"},{"line_number":551,"context_line":"                if allow_all:"},{"line_number":552,"context_line":"                    # TODO(gryf): should IPv6 be applied automatically here?"},{"line_number":553,"context_line":"                    rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":554,"context_line":"                        sg_id, direction,"},{"line_number":555,"context_line":"                        port_range_min\u003d1,"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_821dabbe","line":552,"range":{"start_line":552,"start_character":0,"end_line":552,"end_character":76},"in_reply_to":"1fa4df85_b56351dc","updated":"2020-03-02 09:11:14.000000000","message":"Right. Makes sense. I\u0027ll probably need to also update this patch to follow the same pattern then https://review.opendev.org/#/c/710317/6/kuryr_kubernetes/controller/drivers/lbaasv2.py@352","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"8b16ee8feec1f366dd142daaaf5ea3d0b4b0f2c7","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        if worker_subnet_id:"},{"line_number":139,"context_line":"            default_cidrs.append(utils.get_subnet_cidr(worker_subnet_id))"},{"line_number":140,"context_line":"        for cidr in default_cidrs:"},{"line_number":141,"context_line":"            for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":142,"context_line":"                default_rule \u003d {"},{"line_number":143,"context_line":"                    \u0027security_group_rule\u0027: {"},{"line_number":144,"context_line":"                        \u0027ethertype\u0027: ethertype,"}],"source_content_type":"text/x-python","patch_set":2,"id":"1fa4df85_4deb4ddb","line":141,"range":{"start_line":141,"start_character":0,"end_line":141,"end_character":46},"updated":"2020-03-03 10:34:09.000000000","message":"Whoops, this one should decide ethertype based on cidr here.","commit_id":"8bee405b7007ea07c0405c4f05a73a12826a98b8"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"a2bc3dd9a045bdf838735570281513843631f8d8","unresolved":false,"context_lines":[{"line_number":138,"context_line":"        if worker_subnet_id:"},{"line_number":139,"context_line":"            default_cidrs.append(utils.get_subnet_cidr(worker_subnet_id))"},{"line_number":140,"context_line":"        for cidr in default_cidrs:"},{"line_number":141,"context_line":"            for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":142,"context_line":"                default_rule \u003d {"},{"line_number":143,"context_line":"                    \u0027security_group_rule\u0027: {"},{"line_number":144,"context_line":"                        \u0027ethertype\u0027: ethertype,"}],"source_content_type":"text/x-python","patch_set":2,"id":"1fa4df85_f3da0149","line":141,"range":{"start_line":141,"start_character":0,"end_line":141,"end_character":46},"in_reply_to":"1fa4df85_4deb4ddb","updated":"2020-03-04 14:06:39.000000000","message":"Yuuup.","commit_id":"8bee405b7007ea07c0405c4f05a73a12826a98b8"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"a5714a42e5136308adac8c0e4746cbd1362f2530","unresolved":false,"context_lines":[{"line_number":550,"context_line":"                        sg_id, direction,"},{"line_number":551,"context_line":"                        port_range_min\u003d1,"},{"line_number":552,"context_line":"                        port_range_max\u003d65535)"},{"line_number":553,"context_line":"                    if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":554,"context_line":"                        rule \u003d self._create_svc_egress_sg_rule("},{"line_number":555,"context_line":"                            sg_id, policy_namespace)"},{"line_number":556,"context_line":"                        sg_rule_body_list.extend(rule)"},{"line_number":557,"context_line":"                    sg_rule_body_list.append(rule)"},{"line_number":558,"context_line":"            else:"},{"line_number":559,"context_line":"                LOG.debug(\u0027This network policy specifies no %(direction)s \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_cf827e00","side":"PARENT","line":556,"range":{"start_line":553,"start_character":0,"end_line":556,"end_character":54},"updated":"2020-03-09 12:27:58.000000000","message":"You\u0027re right. This is not needed as we have the previous rule opening traffic to everywhere.","commit_id":"821f7c42fbc11062f94a58fa67e6217b67a8fb88"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"9748f8c21d17e87504023619d116ce0fd83397a9","unresolved":false,"context_lines":[{"line_number":553,"context_line":"                    if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":554,"context_line":"                        rule \u003d self._create_svc_egress_sg_rule("},{"line_number":555,"context_line":"                            sg_id, policy_namespace)"},{"line_number":556,"context_line":"                        sg_rule_body_list.extend(rule)"},{"line_number":557,"context_line":"                    sg_rule_body_list.append(rule)"},{"line_number":558,"context_line":"            else:"},{"line_number":559,"context_line":"                LOG.debug(\u0027This network policy specifies no %(direction)s \u0027"},{"line_number":560,"context_line":"                          \u0027%(rule_direction)s and no ports: %(policy)s\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_1e454b43","side":"PARENT","line":557,"range":{"start_line":556,"start_character":9,"end_line":557,"end_character":50},"updated":"2020-03-05 16:27:43.000000000","message":"In case of egress, it was added twice? Or am I missing something?","commit_id":"821f7c42fbc11062f94a58fa67e6217b67a8fb88"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"5cc75b9d8992aca96ebf7a0b9c6f85a19920e785","unresolved":false,"context_lines":[{"line_number":553,"context_line":"                    if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":554,"context_line":"                        rule \u003d self._create_svc_egress_sg_rule("},{"line_number":555,"context_line":"                            sg_id, policy_namespace)"},{"line_number":556,"context_line":"                        sg_rule_body_list.extend(rule)"},{"line_number":557,"context_line":"                    sg_rule_body_list.append(rule)"},{"line_number":558,"context_line":"            else:"},{"line_number":559,"context_line":"                LOG.debug(\u0027This network policy specifies no %(direction)s \u0027"},{"line_number":560,"context_line":"                          \u0027%(rule_direction)s and no ports: %(policy)s\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_070df18e","side":"PARENT","line":557,"range":{"start_line":556,"start_character":9,"end_line":557,"end_character":50},"in_reply_to":"1fa4df85_1e454b43","updated":"2020-03-06 16:15:04.000000000","message":"It\u0027s worse. So rule var is a list here, so the next append will insert that list into sg_rule_body_list.","commit_id":"821f7c42fbc11062f94a58fa67e6217b67a8fb88"},{"author":{"_account_id":23567,"name":"Luis Tomas Bolivar","email":"ltomasbo@redhat.com","username":"ltomasbo"},"change_message_id":"a4e8af20cc256a03a5bca91d7f52378fc6ea3ebf","unresolved":false,"context_lines":[{"line_number":365,"context_line":"                    crd_rules, sg_id, direction, port, pod_selector,"},{"line_number":366,"context_line":"                    policy_namespace)"},{"line_number":367,"context_line":"        if allow_all:"},{"line_number":368,"context_line":"            container_port \u003d None"},{"line_number":369,"context_line":"            for container_port, pods in matched_pods.items():"},{"line_number":370,"context_line":"                for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":371,"context_line":"                    sg_rule \u003d driver_utils.create_security_group_rule_body("}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_4f344ede","line":368,"range":{"start_line":368,"start_character":12,"end_line":368,"end_character":33},"updated":"2020-03-09 08:01:12.000000000","message":"why do we need this now and not before? If this is a bug we should have it independent of IPv6 support (and backport it)","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"6cab9e84ddd923f61da3cf074461d0b6124ac731","unresolved":false,"context_lines":[{"line_number":365,"context_line":"                    crd_rules, sg_id, direction, port, pod_selector,"},{"line_number":366,"context_line":"                    policy_namespace)"},{"line_number":367,"context_line":"        if allow_all:"},{"line_number":368,"context_line":"            container_port \u003d None"},{"line_number":369,"context_line":"            for container_port, pods in matched_pods.items():"},{"line_number":370,"context_line":"                for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":371,"context_line":"                    sg_rule \u003d driver_utils.create_security_group_rule_body("}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_0f3ad697","line":368,"range":{"start_line":368,"start_character":12,"end_line":368,"end_character":33},"in_reply_to":"1fa4df85_4f344ede","updated":"2020-03-09 08:43:06.000000000","message":"If matched_pods is empty, we will have name error exception on line 378. This was discovered during the unit tests writing.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":23567,"name":"Luis Tomas Bolivar","email":"ltomasbo@redhat.com","username":"ltomasbo"},"change_message_id":"a4e8af20cc256a03a5bca91d7f52378fc6ea3ebf","unresolved":false,"context_lines":[{"line_number":367,"context_line":"        if allow_all:"},{"line_number":368,"context_line":"            container_port \u003d None"},{"line_number":369,"context_line":"            for container_port, pods in matched_pods.items():"},{"line_number":370,"context_line":"                for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":371,"context_line":"                    sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":372,"context_line":"                        sg_id, direction, container_port,"},{"line_number":373,"context_line":"                        protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_0f2bb682","line":370,"range":{"start_line":370,"start_character":16,"end_line":370,"end_character":50},"updated":"2020-03-09 08:01:12.000000000","message":"interesting that both are created... I thought that should depend on the pod VM type instead. If there is a reason to create both, please add a comment","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"6cab9e84ddd923f61da3cf074461d0b6124ac731","unresolved":false,"context_lines":[{"line_number":367,"context_line":"        if allow_all:"},{"line_number":368,"context_line":"            container_port \u003d None"},{"line_number":369,"context_line":"            for container_port, pods in matched_pods.items():"},{"line_number":370,"context_line":"                for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":371,"context_line":"                    sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":372,"context_line":"                        sg_id, direction, container_port,"},{"line_number":373,"context_line":"                        protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_4f53eee2","line":370,"range":{"start_line":370,"start_character":16,"end_line":370,"end_character":50},"in_reply_to":"1fa4df85_0f2bb682","updated":"2020-03-09 08:43:06.000000000","message":"There is no ip address, we could get the network version from. That\u0027s why rules are created for both network versions.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"badef61bcaee7b3cfedd22225fb9c3059d0917d7","unresolved":false,"context_lines":[{"line_number":367,"context_line":"        if allow_all:"},{"line_number":368,"context_line":"            container_port \u003d None"},{"line_number":369,"context_line":"            for container_port, pods in matched_pods.items():"},{"line_number":370,"context_line":"                for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":371,"context_line":"                    sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":372,"context_line":"                        sg_id, direction, container_port,"},{"line_number":373,"context_line":"                        protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_0d955533","line":370,"range":{"start_line":370,"start_character":16,"end_line":370,"end_character":50},"in_reply_to":"1fa4df85_4f53eee2","updated":"2020-03-19 14:18:13.000000000","message":"I\u0027d just use rule of thumb and open both. The SG created in 371 does not use remote_ip_prefix at all, so we\u0027re not really sure which one is it. We could check what is the type of the pod subnetpool and decide on that, but if there\u0027s no IP involved in the rule I\u0027d just stick with creating 2 rules.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":23567,"name":"Luis Tomas Bolivar","email":"ltomasbo@redhat.com","username":"ltomasbo"},"change_message_id":"a4e8af20cc256a03a5bca91d7f52378fc6ea3ebf","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                        ethertype\u003dethertype,"},{"line_number":375,"context_line":"                        pods\u003dpods)"},{"line_number":376,"context_line":"                    crd_rules.append(sg_rule)"},{"line_number":377,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":378,"context_line":"                rules \u003d self._create_svc_egress_sg_rule("},{"line_number":379,"context_line":"                    sg_id, policy_namespace, port\u003dcontainer_port,"},{"line_number":380,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":381,"context_line":"                crd_rules.extend(rules)"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    def _create_sg_rule_on_number_port(self, allowed_resources, sg_id,"},{"line_number":384,"context_line":"                                       direction, port, sg_rule_body_list,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_6f2fca87","line":381,"range":{"start_line":377,"start_character":0,"end_line":381,"end_character":39},"updated":"2020-03-09 08:01:12.000000000","message":"is egress rule only created for the last container_port?","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"4a070bad47ce55f335d6bff97d83798abc34b051","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                        ethertype\u003dethertype,"},{"line_number":375,"context_line":"                        pods\u003dpods)"},{"line_number":376,"context_line":"                    crd_rules.append(sg_rule)"},{"line_number":377,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":378,"context_line":"                rules \u003d self._create_svc_egress_sg_rule("},{"line_number":379,"context_line":"                    sg_id, policy_namespace, port\u003dcontainer_port,"},{"line_number":380,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":381,"context_line":"                crd_rules.extend(rules)"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    def _create_sg_rule_on_number_port(self, allowed_resources, sg_id,"},{"line_number":384,"context_line":"                                       direction, port, sg_rule_body_list,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_d27e91e2","line":381,"range":{"start_line":377,"start_character":0,"end_line":381,"end_character":39},"in_reply_to":"1fa4df85_1c8c40d5","updated":"2020-03-10 11:00:06.000000000","message":"In the case of allow all this _create_svc_egress_sg_rule method is creating a sg rule allowing egress traffic to the svc cidr on the specific port. However, the previous rule is already allowing traffic to everywhere, which includes the svc cidr, right?\nI guess we\u0027re safe by removing it. But, to ensure we must run the NP tests when possible.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"3758f264b4d2c31d69b5d6bd8b68fa4d6b02fa78","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                        ethertype\u003dethertype,"},{"line_number":375,"context_line":"                        pods\u003dpods)"},{"line_number":376,"context_line":"                    crd_rules.append(sg_rule)"},{"line_number":377,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":378,"context_line":"                rules \u003d self._create_svc_egress_sg_rule("},{"line_number":379,"context_line":"                    sg_id, policy_namespace, port\u003dcontainer_port,"},{"line_number":380,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":381,"context_line":"                crd_rules.extend(rules)"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    def _create_sg_rule_on_number_port(self, allowed_resources, sg_id,"},{"line_number":384,"context_line":"                                       direction, port, sg_rule_body_list,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_690801d9","line":381,"range":{"start_line":377,"start_character":0,"end_line":381,"end_character":39},"in_reply_to":"1fa4df85_52014137","updated":"2020-03-11 10:48:55.000000000","message":"I believe that If there are no matched pods with the named port, there is no need to open the traffic to the service as no pod in the backend should accept the traffic.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"d2fc03a2ebb0d04d61f2e4d6f8187f0e8668a7e0","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                        ethertype\u003dethertype,"},{"line_number":375,"context_line":"                        pods\u003dpods)"},{"line_number":376,"context_line":"                    crd_rules.append(sg_rule)"},{"line_number":377,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":378,"context_line":"                rules \u003d self._create_svc_egress_sg_rule("},{"line_number":379,"context_line":"                    sg_id, policy_namespace, port\u003dcontainer_port,"},{"line_number":380,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":381,"context_line":"                crd_rules.extend(rules)"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    def _create_sg_rule_on_number_port(self, allowed_resources, sg_id,"},{"line_number":384,"context_line":"                                       direction, port, sg_rule_body_list,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_520b8128","line":381,"range":{"start_line":377,"start_character":0,"end_line":381,"end_character":39},"in_reply_to":"1fa4df85_52014137","updated":"2020-03-10 11:25:49.000000000","message":"Well, no. Previously it was done despite the fact, we iterate over the matched_pods or not (in case of empty match dict). Probably we didn\u0027t even had such situation, that there was no matched_pods at all.\n\nSo either we remove it, or indent it, so that there will be no need for creating anything in case of empty matched_pods.\n\nWhat do you think?","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"3758f264b4d2c31d69b5d6bd8b68fa4d6b02fa78","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                        ethertype\u003dethertype,"},{"line_number":375,"context_line":"                        pods\u003dpods)"},{"line_number":376,"context_line":"                    crd_rules.append(sg_rule)"},{"line_number":377,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":378,"context_line":"                rules \u003d self._create_svc_egress_sg_rule("},{"line_number":379,"context_line":"                    sg_id, policy_namespace, port\u003dcontainer_port,"},{"line_number":380,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":381,"context_line":"                crd_rules.extend(rules)"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    def _create_sg_rule_on_number_port(self, allowed_resources, sg_id,"},{"line_number":384,"context_line":"                                       direction, port, sg_rule_body_list,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_29b9a9e8","line":381,"range":{"start_line":377,"start_character":0,"end_line":381,"end_character":39},"in_reply_to":"1fa4df85_520b8128","updated":"2020-03-11 10:48:55.000000000","message":"I believe it\u0027s okay to remove it. But, it would be great if you could certify we\u0027re taking the correct decision by running https://github.com/kubernetes/kubernetes/blob/master/test/e2e/network/network_policy.go#L643-L683","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"c5ddd7829aded23a44fe93f89cece8b731eafd7e","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                        ethertype\u003dethertype,"},{"line_number":375,"context_line":"                        pods\u003dpods)"},{"line_number":376,"context_line":"                    crd_rules.append(sg_rule)"},{"line_number":377,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":378,"context_line":"                rules \u003d self._create_svc_egress_sg_rule("},{"line_number":379,"context_line":"                    sg_id, policy_namespace, port\u003dcontainer_port,"},{"line_number":380,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":381,"context_line":"                crd_rules.extend(rules)"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    def _create_sg_rule_on_number_port(self, allowed_resources, sg_id,"},{"line_number":384,"context_line":"                                       direction, port, sg_rule_body_list,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_d2c99a5a","line":381,"range":{"start_line":377,"start_character":0,"end_line":381,"end_character":39},"in_reply_to":"1fa4df85_690801d9","updated":"2020-03-11 13:06:32.000000000","message":"Ack. Im waiting for Luis change to be merged, which introduce get_subnetpool_version (as stated in PS6). After that, I\u0027m going to test it.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"6cab9e84ddd923f61da3cf074461d0b6124ac731","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                        ethertype\u003dethertype,"},{"line_number":375,"context_line":"                        pods\u003dpods)"},{"line_number":376,"context_line":"                    crd_rules.append(sg_rule)"},{"line_number":377,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":378,"context_line":"                rules \u003d self._create_svc_egress_sg_rule("},{"line_number":379,"context_line":"                    sg_id, policy_namespace, port\u003dcontainer_port,"},{"line_number":380,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":381,"context_line":"                crd_rules.extend(rules)"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    def _create_sg_rule_on_number_port(self, allowed_resources, sg_id,"},{"line_number":384,"context_line":"                                       direction, port, sg_rule_body_list,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_ef5bbaf2","line":381,"range":{"start_line":377,"start_character":0,"end_line":381,"end_character":39},"in_reply_to":"1fa4df85_6f2fca87","updated":"2020-03-09 08:43:06.000000000","message":"This is how it previously was, nothing changed, so yes, egress is only created for last container_port (or None in case there was no matched pods found).","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":23567,"name":"Luis Tomas Bolivar","email":"ltomasbo@redhat.com","username":"ltomasbo"},"change_message_id":"25866d280952db382a412dd16bd2a189ebc45139","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                        ethertype\u003dethertype,"},{"line_number":375,"context_line":"                        pods\u003dpods)"},{"line_number":376,"context_line":"                    crd_rules.append(sg_rule)"},{"line_number":377,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":378,"context_line":"                rules \u003d self._create_svc_egress_sg_rule("},{"line_number":379,"context_line":"                    sg_id, policy_namespace, port\u003dcontainer_port,"},{"line_number":380,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":381,"context_line":"                crd_rules.extend(rules)"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    def _create_sg_rule_on_number_port(self, allowed_resources, sg_id,"},{"line_number":384,"context_line":"                                       direction, port, sg_rule_body_list,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_1c8c40d5","line":381,"range":{"start_line":377,"start_character":0,"end_line":381,"end_character":39},"in_reply_to":"1fa4df85_af25c20a","updated":"2020-03-10 08:37:25.000000000","message":"umm feels suspicious that we had a rule specifically for egress there... perhaps it is covering some corner case...","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":23567,"name":"Luis Tomas Bolivar","email":"ltomasbo@redhat.com","username":"ltomasbo"},"change_message_id":"459159149b894b991ea437e2f349419874824d17","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                        ethertype\u003dethertype,"},{"line_number":375,"context_line":"                        pods\u003dpods)"},{"line_number":376,"context_line":"                    crd_rules.append(sg_rule)"},{"line_number":377,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":378,"context_line":"                rules \u003d self._create_svc_egress_sg_rule("},{"line_number":379,"context_line":"                    sg_id, policy_namespace, port\u003dcontainer_port,"},{"line_number":380,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":381,"context_line":"                crd_rules.extend(rules)"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    def _create_sg_rule_on_number_port(self, allowed_resources, sg_id,"},{"line_number":384,"context_line":"                                       direction, port, sg_rule_body_list,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_52014137","line":381,"range":{"start_line":377,"start_character":0,"end_line":381,"end_character":39},"in_reply_to":"1fa4df85_d27e91e2","updated":"2020-03-10 11:03:46.000000000","message":"but, the previous one is only for the matched pods, right? could it be that we need to add the services despite not having matched_pods?","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"a5714a42e5136308adac8c0e4746cbd1362f2530","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                        ethertype\u003dethertype,"},{"line_number":375,"context_line":"                        pods\u003dpods)"},{"line_number":376,"context_line":"                    crd_rules.append(sg_rule)"},{"line_number":377,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":378,"context_line":"                rules \u003d self._create_svc_egress_sg_rule("},{"line_number":379,"context_line":"                    sg_id, policy_namespace, port\u003dcontainer_port,"},{"line_number":380,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":381,"context_line":"                crd_rules.extend(rules)"},{"line_number":382,"context_line":""},{"line_number":383,"context_line":"    def _create_sg_rule_on_number_port(self, allowed_resources, sg_id,"},{"line_number":384,"context_line":"                                       direction, port, sg_rule_body_list,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_af25c20a","line":381,"range":{"start_line":377,"start_character":0,"end_line":381,"end_character":39},"in_reply_to":"1fa4df85_ef5bbaf2","updated":"2020-03-09 12:27:58.000000000","message":"As the previous rule is allowing traffic to everywhere(remote_ip_prefix\u003d0.0.0.0/0) on the specific ports, I believe this rules creation could also be removed.\n\nbtw, It might be good to run the Network Policy tests after the devstack support is in place.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"d2fc03a2ebb0d04d61f2e4d6f8187f0e8668a7e0","unresolved":false,"context_lines":[{"line_number":420,"context_line":"                        ethertype\u003dethertype,"},{"line_number":421,"context_line":"                        protocol\u003dport.get(\u0027protocol\u0027)))"},{"line_number":422,"context_line":"                sg_rule_body_list.append(sg_rule)"},{"line_number":423,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":424,"context_line":"                rule \u003d self._create_svc_egress_sg_rule("},{"line_number":425,"context_line":"                    sg_id, policy_namespace, port\u003dport.get(\u0027port\u0027),"},{"line_number":426,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":427,"context_line":"                sg_rule_body_list.extend(rule)"},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"    def _create_default_sg_rule(self, sg_id, direction, sg_rule_body_list):"},{"line_number":430,"context_line":"        for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_4d3e84b8","line":427,"range":{"start_line":423,"start_character":0,"end_line":427,"end_character":46},"updated":"2020-03-10 11:25:49.000000000","message":"This one should be indented right.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"3758f264b4d2c31d69b5d6bd8b68fa4d6b02fa78","unresolved":false,"context_lines":[{"line_number":420,"context_line":"                        ethertype\u003dethertype,"},{"line_number":421,"context_line":"                        protocol\u003dport.get(\u0027protocol\u0027)))"},{"line_number":422,"context_line":"                sg_rule_body_list.append(sg_rule)"},{"line_number":423,"context_line":"            if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":424,"context_line":"                rule \u003d self._create_svc_egress_sg_rule("},{"line_number":425,"context_line":"                    sg_id, policy_namespace, port\u003dport.get(\u0027port\u0027),"},{"line_number":426,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027))"},{"line_number":427,"context_line":"                sg_rule_body_list.extend(rule)"},{"line_number":428,"context_line":""},{"line_number":429,"context_line":"    def _create_default_sg_rule(self, sg_id, direction, sg_rule_body_list):"},{"line_number":430,"context_line":"        for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_69a481ba","line":427,"range":{"start_line":423,"start_character":0,"end_line":427,"end_character":46},"in_reply_to":"1fa4df85_4d3e84b8","updated":"2020-03-11 10:48:55.000000000","message":"yup.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"d2fc03a2ebb0d04d61f2e4d6f8187f0e8668a7e0","unresolved":false,"context_lines":[{"line_number":560,"context_line":"                            port_range_max\u003d65535,"},{"line_number":561,"context_line":"                            ethertype\u003dethertype)"},{"line_number":562,"context_line":"                        sg_rule_body_list.append(rule)"},{"line_number":563,"context_line":"                    if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":564,"context_line":"                        rule \u003d self._create_svc_egress_sg_rule("},{"line_number":565,"context_line":"                            sg_id, policy_namespace)"},{"line_number":566,"context_line":"                        sg_rule_body_list.extend(rule)"},{"line_number":567,"context_line":"            else:"},{"line_number":568,"context_line":"                LOG.debug(\u0027This network policy specifies no %(direction)s \u0027"},{"line_number":569,"context_line":"                          \u0027%(rule_direction)s and no ports: %(policy)s\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_cd7b5489","line":566,"range":{"start_line":563,"start_character":20,"end_line":566,"end_character":54},"updated":"2020-03-10 11:25:49.000000000","message":"Wrong indent. Either this should be removed, or fixed.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"c5ddd7829aded23a44fe93f89cece8b731eafd7e","unresolved":false,"context_lines":[{"line_number":560,"context_line":"                            port_range_max\u003d65535,"},{"line_number":561,"context_line":"                            ethertype\u003dethertype)"},{"line_number":562,"context_line":"                        sg_rule_body_list.append(rule)"},{"line_number":563,"context_line":"                    if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":564,"context_line":"                        rule \u003d self._create_svc_egress_sg_rule("},{"line_number":565,"context_line":"                            sg_id, policy_namespace)"},{"line_number":566,"context_line":"                        sg_rule_body_list.extend(rule)"},{"line_number":567,"context_line":"            else:"},{"line_number":568,"context_line":"                LOG.debug(\u0027This network policy specifies no %(direction)s \u0027"},{"line_number":569,"context_line":"                          \u0027%(rule_direction)s and no ports: %(policy)s\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_72e0e6cd","line":566,"range":{"start_line":563,"start_character":20,"end_line":566,"end_character":54},"in_reply_to":"1fa4df85_299c495c","updated":"2020-03-11 13:06:32.000000000","message":"Ack.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"3758f264b4d2c31d69b5d6bd8b68fa4d6b02fa78","unresolved":false,"context_lines":[{"line_number":560,"context_line":"                            port_range_max\u003d65535,"},{"line_number":561,"context_line":"                            ethertype\u003dethertype)"},{"line_number":562,"context_line":"                        sg_rule_body_list.append(rule)"},{"line_number":563,"context_line":"                    if direction \u003d\u003d \u0027egress\u0027:"},{"line_number":564,"context_line":"                        rule \u003d self._create_svc_egress_sg_rule("},{"line_number":565,"context_line":"                            sg_id, policy_namespace)"},{"line_number":566,"context_line":"                        sg_rule_body_list.extend(rule)"},{"line_number":567,"context_line":"            else:"},{"line_number":568,"context_line":"                LOG.debug(\u0027This network policy specifies no %(direction)s \u0027"},{"line_number":569,"context_line":"                          \u0027%(rule_direction)s and no ports: %(policy)s\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_299c495c","line":566,"range":{"start_line":563,"start_character":20,"end_line":566,"end_character":54},"in_reply_to":"1fa4df85_cd7b5489","updated":"2020-03-11 10:48:55.000000000","message":"If we decide to remove it we should check with a Network Policy similar to this one [1] but without any ports declared on the spec.\n\n[1] https://github.com/kubernetes/kubernetes/blob/master/test/e2e/network/network_policy.go#L643-L683","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"ca2ad932dc8de2c4d76872f13616c1cc5f3f6e91","unresolved":false,"context_lines":[{"line_number":140,"context_line":"        for cidr in default_cidrs:"},{"line_number":141,"context_line":"            default_rule \u003d {"},{"line_number":142,"context_line":"                \u0027security_group_rule\u0027: {"},{"line_number":143,"context_line":"                    \u0027ethertype\u0027: \u0027IPv\u0027 + ipaddress.ip_network(cidr).version,"},{"line_number":144,"context_line":"                    \u0027security_group_id\u0027: sg_id,"},{"line_number":145,"context_line":"                    \u0027direction\u0027: \u0027ingress\u0027,"},{"line_number":146,"context_line":"                    \u0027description\u0027: \u0027Kuryr-Kubernetes NetPolicy SG rule\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"1fa4df85_8dd689c3","line":143,"range":{"start_line":143,"start_character":33,"end_line":143,"end_character":75},"updated":"2020-03-12 18:10:17.000000000","message":"In [3]: \u0027IPv\u0027 + ipaddress.ip_network(\u002710.0.0.0/24\u0027).version                                    \n---------------------------------------------------------------------------\nTypeError                                 Traceback (most recent call last)\n\u003cipython-input-3-ad0963ea3754\u003e in \u003cmodule\u003e\n----\u003e 1 \u0027IPv\u0027 + ipaddress.ip_network(\u002710.0.0.0/24\u0027).version\n\nTypeError: can only concatenate str (not \"int\") to str","commit_id":"7353d22ffa18d046a2d7c72b3ef8a32301fa9593"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"8878932315ae3febcec6049d55730e3a56434601","unresolved":false,"context_lines":[{"line_number":140,"context_line":"        for cidr in default_cidrs:"},{"line_number":141,"context_line":"            default_rule \u003d {"},{"line_number":142,"context_line":"                \u0027security_group_rule\u0027: {"},{"line_number":143,"context_line":"                    \u0027ethertype\u0027: \u0027IPv\u0027 + ipaddress.ip_network(cidr).version,"},{"line_number":144,"context_line":"                    \u0027security_group_id\u0027: sg_id,"},{"line_number":145,"context_line":"                    \u0027direction\u0027: \u0027ingress\u0027,"},{"line_number":146,"context_line":"                    \u0027description\u0027: \u0027Kuryr-Kubernetes NetPolicy SG rule\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"1fa4df85_7bc42393","line":143,"range":{"start_line":143,"start_character":33,"end_line":143,"end_character":75},"in_reply_to":"1fa4df85_8dd689c3","updated":"2020-03-12 19:38:19.000000000","message":"huh? I was pretty sure this case was covered by tests :C","commit_id":"7353d22ffa18d046a2d7c72b3ef8a32301fa9593"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"db036d32ab1047dd4d9c244b46e8310e1ed3fa2a","unresolved":false,"context_lines":[{"line_number":367,"context_line":"        if allow_all:"},{"line_number":368,"context_line":"            container_port \u003d None"},{"line_number":369,"context_line":"            for container_port, pods in matched_pods.items():"},{"line_number":370,"context_line":"                for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":371,"context_line":"                    sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":372,"context_line":"                        sg_id, direction, container_port,"},{"line_number":373,"context_line":"                        protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":6,"id":"1fa4df85_43dba620","line":370,"range":{"start_line":370,"start_character":16,"end_line":370,"end_character":50},"updated":"2020-03-11 08:50:36.000000000","message":"Waiting for https://review.opendev.org/#/c/708657/ to be merged, so that I can use get_subnetpool_version function from utils module.","commit_id":"7353d22ffa18d046a2d7c72b3ef8a32301fa9593"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"d310af8d881e4a9cf32ebf845b4716b05d2c0f55","unresolved":false,"context_lines":[{"line_number":367,"context_line":"        if allow_all:"},{"line_number":368,"context_line":"            container_port \u003d None"},{"line_number":369,"context_line":"            for container_port, pods in matched_pods.items():"},{"line_number":370,"context_line":"                for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":371,"context_line":"                    sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":372,"context_line":"                        sg_id, direction, container_port,"},{"line_number":373,"context_line":"                        protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":6,"id":"1fa4df85_8dcc4962","line":370,"range":{"start_line":370,"start_character":16,"end_line":370,"end_character":50},"in_reply_to":"1fa4df85_43dba620","updated":"2020-03-12 18:07:12.000000000","message":"It\u0027s getting in. ;) BTW if you would copy Maysa\u0027s addition to constants.py exactly it would not complain about a conflict.","commit_id":"7353d22ffa18d046a2d7c72b3ef8a32301fa9593"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"8878932315ae3febcec6049d55730e3a56434601","unresolved":false,"context_lines":[{"line_number":367,"context_line":"        if allow_all:"},{"line_number":368,"context_line":"            container_port \u003d None"},{"line_number":369,"context_line":"            for container_port, pods in matched_pods.items():"},{"line_number":370,"context_line":"                for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":371,"context_line":"                    sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":372,"context_line":"                        sg_id, direction, container_port,"},{"line_number":373,"context_line":"                        protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":6,"id":"1fa4df85_9bc1df83","line":370,"range":{"start_line":370,"start_character":16,"end_line":370,"end_character":50},"in_reply_to":"1fa4df85_8dcc4962","updated":"2020-03-12 19:38:19.000000000","message":"Ack that.","commit_id":"7353d22ffa18d046a2d7c72b3ef8a32301fa9593"}],"kuryr_kubernetes/controller/drivers/network_policy_security_groups.py":[{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"db437e0b45749ad6a6442b113f0c8c4d678b327d","unresolved":false,"context_lines":[{"line_number":48,"context_line":"        # TODO(gryf): Signature of create_security_group_rule_body differs"},{"line_number":49,"context_line":"        # from what we have here"},{"line_number":50,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":51,"context_line":"            sg_id, direction, port.get(\u0027port\u0027),"},{"line_number":52,"context_line":"            protocol\u003dport.get(\u0027protocol\u0027),"},{"line_number":53,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":54,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_5581bd49","line":51,"range":{"start_line":51,"start_character":30,"end_line":51,"end_character":46},"updated":"2020-02-28 16:09:37.000000000","message":"So what about that part? It doesn\u0027t seems right, since here we expect port_range_min, but `port.get(\u0027port\u0027)` is passed which, I assume, is a port definition in dictionary. Am I right? Or maybe we never pass port to `_create_sg_rule`, so the issue has never been spoted?","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"97057f3f9100cfda748d95a1e3e7db78e3047204","unresolved":false,"context_lines":[{"line_number":48,"context_line":"        # TODO(gryf): Signature of create_security_group_rule_body differs"},{"line_number":49,"context_line":"        # from what we have here"},{"line_number":50,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":51,"context_line":"            sg_id, direction, port.get(\u0027port\u0027),"},{"line_number":52,"context_line":"            protocol\u003dport.get(\u0027protocol\u0027),"},{"line_number":53,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":54,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_c356525d","line":51,"range":{"start_line":51,"start_character":30,"end_line":51,"end_character":46},"in_reply_to":"1fa4df85_159ee553","updated":"2020-02-29 08:19:47.000000000","message":"Still, \"… either be a numerical or named port on a pod.\" doesn\u0027t sound anything like port_range_min which is third argument for create_security_group_rule_body function[1], hence my concerns.\n\n[1] https://opendev.org/openstack/kuryr-kubernetes/src/commit/65f5235fab1d0a4c06990af5a13a0eb17ccc5763/kuryr_kubernetes/controller/drivers/utils.py#L255-L259","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"40f7a887065adda95d97c8df704f1a615a4dfe86","unresolved":false,"context_lines":[{"line_number":48,"context_line":"        # TODO(gryf): Signature of create_security_group_rule_body differs"},{"line_number":49,"context_line":"        # from what we have here"},{"line_number":50,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":51,"context_line":"            sg_id, direction, port.get(\u0027port\u0027),"},{"line_number":52,"context_line":"            protocol\u003dport.get(\u0027protocol\u0027),"},{"line_number":53,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":54,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_d587d60e","line":51,"range":{"start_line":51,"start_character":30,"end_line":51,"end_character":46},"in_reply_to":"1fa4df85_24c08250","updated":"2020-03-02 13:39:19.000000000","message":"Ok. Although it\u0027s bizarre/not straightforward, I get it. Also naming a virtual socket as a port and interchangeably using it with… port number doesn\u0027t help either ;).","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"9af28e1603244da0be64b1a554a3daa2a013d6f3","unresolved":false,"context_lines":[{"line_number":48,"context_line":"        # TODO(gryf): Signature of create_security_group_rule_body differs"},{"line_number":49,"context_line":"        # from what we have here"},{"line_number":50,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":51,"context_line":"            sg_id, direction, port.get(\u0027port\u0027),"},{"line_number":52,"context_line":"            protocol\u003dport.get(\u0027protocol\u0027),"},{"line_number":53,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":54,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_159ee553","line":51,"range":{"start_line":51,"start_character":30,"end_line":51,"end_character":46},"in_reply_to":"1fa4df85_5581bd49","updated":"2020-02-28 16:32:15.000000000","message":"No, in case of NP\u0027s I think \"port\" will mean this K8s structure: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#networkpolicyport-v1-networking-k8s-io","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"511a1b316a2fee3daa7f3e5ebd046845976205e0","unresolved":false,"context_lines":[{"line_number":48,"context_line":"        # TODO(gryf): Signature of create_security_group_rule_body differs"},{"line_number":49,"context_line":"        # from what we have here"},{"line_number":50,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":51,"context_line":"            sg_id, direction, port.get(\u0027port\u0027),"},{"line_number":52,"context_line":"            protocol\u003dport.get(\u0027protocol\u0027),"},{"line_number":53,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":54,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_24c08250","line":51,"range":{"start_line":51,"start_character":30,"end_line":51,"end_character":46},"in_reply_to":"1fa4df85_a1d6a4c2","updated":"2020-03-02 11:30:23.000000000","message":"\u003e Wait. I\u0027m not talking about whether or not it\u0027s a numerical or\n \u003e string, still it\u0027s different thing than port range, right?\n\nIt\u0027s handled like this: https://github.com/openstack/kuryr-kubernetes/blob/1045bcb02a34cbc8249de8d1b3933bc08707b503/kuryr_kubernetes/controller/drivers/utils.py#L260-L264.\n\nBasically network policy tells us what port to open and we do that. With SGs you cannot specify just port, so you need to set max and min of the range to the same number.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"64caf2c6d0d49708d07501fc5b7f5204cb00384e","unresolved":false,"context_lines":[{"line_number":48,"context_line":"        # TODO(gryf): Signature of create_security_group_rule_body differs"},{"line_number":49,"context_line":"        # from what we have here"},{"line_number":50,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":51,"context_line":"            sg_id, direction, port.get(\u0027port\u0027),"},{"line_number":52,"context_line":"            protocol\u003dport.get(\u0027protocol\u0027),"},{"line_number":53,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":54,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_d814f850","line":51,"range":{"start_line":51,"start_character":30,"end_line":51,"end_character":46},"in_reply_to":"1fa4df85_c356525d","updated":"2020-03-02 09:11:14.000000000","message":"As Michal pointed, the value passed here is a numerical port on a pod. In case of a named port on a pod we handle it differently on \"_create_sg_rule_on_text_port\"","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"c131f34b448d957e5cb67812327342f757323f3c","unresolved":false,"context_lines":[{"line_number":48,"context_line":"        # TODO(gryf): Signature of create_security_group_rule_body differs"},{"line_number":49,"context_line":"        # from what we have here"},{"line_number":50,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":51,"context_line":"            sg_id, direction, port.get(\u0027port\u0027),"},{"line_number":52,"context_line":"            protocol\u003dport.get(\u0027protocol\u0027),"},{"line_number":53,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":54,"context_line":"    else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_a1d6a4c2","line":51,"range":{"start_line":51,"start_character":30,"end_line":51,"end_character":46},"in_reply_to":"1fa4df85_d814f850","updated":"2020-03-02 10:56:04.000000000","message":"Wait. I\u0027m not talking about whether or not it\u0027s a numerical or string, still it\u0027s different thing than port range, right?","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"49f0ef8a2c5ec9cee80f49ee2cee877c06eb322d","unresolved":false,"context_lines":[{"line_number":178,"context_line":"                port, rule_selected_pod)"},{"line_number":179,"context_line":"    for container_port, pods in matched_pods.items():"},{"line_number":180,"context_line":"        if allow_all:"},{"line_number":181,"context_line":"            # TODO(gryf): we dont have cidr here - how can we get ether type?"},{"line_number":182,"context_line":"            # out of port maybe? Or just create corresponding rule for IPv6?"},{"line_number":183,"context_line":"            sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":184,"context_line":"                sg_id, direction, container_port,"},{"line_number":185,"context_line":"                protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_9f98b41b","line":182,"range":{"start_line":181,"start_character":0,"end_line":182,"end_character":76},"updated":"2020-02-28 14:50:07.000000000","message":"Yes, allow_all seems to mean that we need to create both SG\u0027s.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"db437e0b45749ad6a6442b113f0c8c4d678b327d","unresolved":false,"context_lines":[{"line_number":178,"context_line":"                port, rule_selected_pod)"},{"line_number":179,"context_line":"    for container_port, pods in matched_pods.items():"},{"line_number":180,"context_line":"        if allow_all:"},{"line_number":181,"context_line":"            # TODO(gryf): we dont have cidr here - how can we get ether type?"},{"line_number":182,"context_line":"            # out of port maybe? Or just create corresponding rule for IPv6?"},{"line_number":183,"context_line":"            sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":184,"context_line":"                sg_id, direction, container_port,"},{"line_number":185,"context_line":"                protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_757639a7","line":182,"range":{"start_line":181,"start_character":0,"end_line":182,"end_character":76},"in_reply_to":"1fa4df85_9f98b41b","updated":"2020-02-28 16:09:37.000000000","message":"Ack.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"8b16ee8feec1f366dd142daaaf5ea3d0b4b0f2c7","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    if port:"},{"line_number":48,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":49,"context_line":"            sg_id, direction, port.get(\u0027port\u0027),"},{"line_number":50,"context_line":"            protocol\u003dport.get(\u0027protocol\u0027),"},{"line_number":51,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":52,"context_line":"    else:"},{"line_number":53,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":54,"context_line":"            sg_id, direction, port_range_min\u003d1,"},{"line_number":55,"context_line":"            port_range_max\u003d65535,"},{"line_number":56,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    sgr_id \u003d driver_utils.create_security_group_rule(sg_rule)"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"1fa4df85_6dd16923","line":56,"range":{"start_line":50,"start_character":0,"end_line":56,"end_character":43},"updated":"2020-03-03 10:34:09.000000000","message":"Seems like unrelated, but okay.","commit_id":"8bee405b7007ea07c0405c4f05a73a12826a98b8"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"a2bc3dd9a045bdf838735570281513843631f8d8","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    if port:"},{"line_number":48,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":49,"context_line":"            sg_id, direction, port.get(\u0027port\u0027),"},{"line_number":50,"context_line":"            protocol\u003dport.get(\u0027protocol\u0027),"},{"line_number":51,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":52,"context_line":"    else:"},{"line_number":53,"context_line":"        sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":54,"context_line":"            sg_id, direction, port_range_min\u003d1,"},{"line_number":55,"context_line":"            port_range_max\u003d65535,"},{"line_number":56,"context_line":"            cidr\u003dcidr, namespace\u003dnamespace)"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    sgr_id \u003d driver_utils.create_security_group_rule(sg_rule)"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"1fa4df85_53c3d55d","line":56,"range":{"start_line":50,"start_character":0,"end_line":56,"end_character":43},"in_reply_to":"1fa4df85_6dd16923","updated":"2020-03-04 14:06:39.000000000","message":"I\u0027ll revert it.","commit_id":"8bee405b7007ea07c0405c4f05a73a12826a98b8"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"a2bc3dd9a045bdf838735570281513843631f8d8","unresolved":false,"context_lines":[{"line_number":130,"context_line":"                LOG.debug(\"Skipping SG rule creation for pod %s due to no IP \""},{"line_number":131,"context_line":"                          \"assigned\", rule_selected_pod[\u0027metadata\u0027][\u0027name\u0027])"},{"line_number":132,"context_line":"                continue"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"            sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":135,"context_line":"                sg_id, direction, container_port,"},{"line_number":136,"context_line":"                protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1fa4df85_73c7f165","line":133,"updated":"2020-03-04 14:06:39.000000000","message":"Also this one.","commit_id":"8bee405b7007ea07c0405c4f05a73a12826a98b8"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"8b16ee8feec1f366dd142daaaf5ea3d0b4b0f2c7","unresolved":false,"context_lines":[{"line_number":176,"context_line":"                port, rule_selected_pod)"},{"line_number":177,"context_line":"    for container_port, pods in matched_pods.items():"},{"line_number":178,"context_line":"        if allow_all:"},{"line_number":179,"context_line":"            for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":180,"context_line":"                sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":181,"context_line":"                    sg_id, direction, container_port,"},{"line_number":182,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1fa4df85_0da8f58a","line":179,"range":{"start_line":179,"start_character":30,"end_line":179,"end_character":44},"updated":"2020-03-03 10:34:09.000000000","message":"I think in some other patch we\u0027re defining those as constants, I\u0027d nice to keep it consistent.","commit_id":"8bee405b7007ea07c0405c4f05a73a12826a98b8"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"a2bc3dd9a045bdf838735570281513843631f8d8","unresolved":false,"context_lines":[{"line_number":176,"context_line":"                port, rule_selected_pod)"},{"line_number":177,"context_line":"    for container_port, pods in matched_pods.items():"},{"line_number":178,"context_line":"        if allow_all:"},{"line_number":179,"context_line":"            for ethertype in (\u0027IPv4\u0027, \u0027IPv6\u0027):"},{"line_number":180,"context_line":"                sg_rule \u003d driver_utils.create_security_group_rule_body("},{"line_number":181,"context_line":"                    sg_id, direction, container_port,"},{"line_number":182,"context_line":"                    protocol\u003dport.get(\u0027protocol\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1fa4df85_d320254b","line":179,"range":{"start_line":179,"start_character":30,"end_line":179,"end_character":44},"in_reply_to":"1fa4df85_0da8f58a","updated":"2020-03-04 14:06:39.000000000","message":"Yes. The Maysa\u0027s patch[1] defines them. I\u0027ll change it after it\u0027ll land.\n\n[1] https://review.opendev.org/#/c/710317/","commit_id":"8bee405b7007ea07c0405c4f05a73a12826a98b8"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"5cc75b9d8992aca96ebf7a0b9c6f85a19920e785","unresolved":false,"context_lines":[{"line_number":204,"context_line":"                sg_id, direction, container_port,"},{"line_number":205,"context_line":"                protocol\u003dport.get(\u0027protocol\u0027), cidr\u003dnamespace_cidr,"},{"line_number":206,"context_line":"                pods\u003dpods)"},{"line_number":207,"context_line":"            sgr_id \u003d driver_utils.create_security_group_rule(sg_rule)"},{"line_number":208,"context_line":"            sg_rule[\u0027security_group_rule\u0027][\u0027id\u0027] \u003d sgr_id"},{"line_number":209,"context_line":"            if sg_rule not in crd_rules:"},{"line_number":210,"context_line":"                crd_rules.append(sg_rule)"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"def _create_sg_rules(crd, pod, pod_selector, rule_block,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_275eed75","line":210,"range":{"start_line":207,"start_character":0,"end_line":210,"end_character":41},"updated":"2020-03-06 16:15:04.000000000","message":"Wow, nice finding…","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":23567,"name":"Luis Tomas Bolivar","email":"ltomasbo@redhat.com","username":"ltomasbo"},"change_message_id":"a4e8af20cc256a03a5bca91d7f52378fc6ea3ebf","unresolved":false,"context_lines":[{"line_number":204,"context_line":"                sg_id, direction, container_port,"},{"line_number":205,"context_line":"                protocol\u003dport.get(\u0027protocol\u0027), cidr\u003dnamespace_cidr,"},{"line_number":206,"context_line":"                pods\u003dpods)"},{"line_number":207,"context_line":"            sgr_id \u003d driver_utils.create_security_group_rule(sg_rule)"},{"line_number":208,"context_line":"            sg_rule[\u0027security_group_rule\u0027][\u0027id\u0027] \u003d sgr_id"},{"line_number":209,"context_line":"            if sg_rule not in crd_rules:"},{"line_number":210,"context_line":"                crd_rules.append(sg_rule)"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"def _create_sg_rules(crd, pod, pod_selector, rule_block,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_ef589a31","line":210,"range":{"start_line":207,"start_character":0,"end_line":210,"end_character":41},"in_reply_to":"1fa4df85_275eed75","updated":"2020-03-09 08:01:12.000000000","message":"What is the finding?","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"6cab9e84ddd923f61da3cf074461d0b6124ac731","unresolved":false,"context_lines":[{"line_number":204,"context_line":"                sg_id, direction, container_port,"},{"line_number":205,"context_line":"                protocol\u003dport.get(\u0027protocol\u0027), cidr\u003dnamespace_cidr,"},{"line_number":206,"context_line":"                pods\u003dpods)"},{"line_number":207,"context_line":"            sgr_id \u003d driver_utils.create_security_group_rule(sg_rule)"},{"line_number":208,"context_line":"            sg_rule[\u0027security_group_rule\u0027][\u0027id\u0027] \u003d sgr_id"},{"line_number":209,"context_line":"            if sg_rule not in crd_rules:"},{"line_number":210,"context_line":"                crd_rules.append(sg_rule)"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"def _create_sg_rules(crd, pod, pod_selector, rule_block,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_0f0896d7","line":210,"range":{"start_line":207,"start_character":0,"end_line":210,"end_character":41},"in_reply_to":"1fa4df85_ef589a31","updated":"2020-03-09 08:43:06.000000000","message":"In my previous patch set I didn\u0027t append both rules (for ipv4 and ipv6) but only last one. Now, you can see that it is added in both cases (lines 191-194 and 207-210).","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"}],"kuryr_kubernetes/controller/drivers/utils.py":[{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"49f0ef8a2c5ec9cee80f49ee2cee877c06eb322d","unresolved":false,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"    if not ethertype:"},{"line_number":270,"context_line":"        ethertype \u003d \u0027IPv4\u0027"},{"line_number":271,"context_line":"        if cidr and netaddr.IPAddress(cidr).version \u003d\u003d 6:"},{"line_number":272,"context_line":"            ethertype \u003d \u0027IPv6\u0027"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"    security_group_rule_body \u003d {"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_dfee2cb3","line":271,"range":{"start_line":271,"start_character":20,"end_line":271,"end_character":51},"updated":"2020-02-28 14:50:07.000000000","message":"CIDR is not an IP address, that will fail:\n\n In [2]: netaddr.IPAddress(\u002710.0.0.0/24\u0027)       \n ---------------------------------------------------------------------------\n ValueError                                Traceback (most recent call last)\n \u003cipython-input-2-8c0e3c2d5dd8\u003e in \u003cmodule\u003e\n ----\u003e 1 netaddr.IPAddress(\u002710.0.0.0/24\u0027)\n \n /usr/local/lib/python3.7/site-packages/netaddr/ip/__init__.py in __init__(self, addr, version, flags)\n    278                 raise ValueError(\u0027%s() does not support netmasks or subnet\u0027 \\\n    279                     \u0027 prefixes! See documentation for details.\u0027\n--\u003e 280                     % self.__class__.__name__)\n    281 \n    282             if self._module is None:\n\n ValueError: IPAddress() does not support netmasks or subnet prefixes! See documentation for details.\n\nCan you just use builtin ipaddres?\n\n In [6]: ipaddress.ip_network(\u002710.0.0.0/24\u0027).version                                            \n Out[6]: 4","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"465c4b0b8933a13d11c7589781061a381807cf30","unresolved":false,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"    if not ethertype:"},{"line_number":270,"context_line":"        ethertype \u003d \u0027IPv4\u0027"},{"line_number":271,"context_line":"        if cidr and netaddr.IPAddress(cidr).version \u003d\u003d 6:"},{"line_number":272,"context_line":"            ethertype \u003d \u0027IPv6\u0027"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"    security_group_rule_body \u003d {"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_4025385b","line":271,"range":{"start_line":271,"start_character":20,"end_line":271,"end_character":51},"in_reply_to":"1fa4df85_1793085d","updated":"2020-03-04 17:02:17.000000000","message":"I think we can get both CIDR in 10.0.0.0/24 form and just an IP. It comes from this thing [1].\n\n[1] https://github.com/openstack/kuryr-kubernetes/blob/be132b1aebd68acd050e235c28305bdc9f709815/kuryr_kubernetes/controller/drivers/network_policy.py#L761-L771","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"c4653d3e9339f8fbf0d91ce6ae9d97de608dc32f","unresolved":false,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"    if not ethertype:"},{"line_number":270,"context_line":"        ethertype \u003d \u0027IPv4\u0027"},{"line_number":271,"context_line":"        if cidr and netaddr.IPAddress(cidr).version \u003d\u003d 6:"},{"line_number":272,"context_line":"            ethertype \u003d \u0027IPv6\u0027"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"    security_group_rule_body \u003d {"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_1793085d","line":271,"range":{"start_line":271,"start_character":20,"end_line":271,"end_character":51},"in_reply_to":"1fa4df85_75ddd912","updated":"2020-03-04 14:58:53.000000000","message":"Actually. I was thinking about that. Do we experience such situation, where for the network there is provided address ip with netmask bits? If no, or we don\u0027t know, maybe it\u0027s worth to check it, and minimize external dependencies?","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"9af28e1603244da0be64b1a554a3daa2a013d6f3","unresolved":false,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"    if not ethertype:"},{"line_number":270,"context_line":"        ethertype \u003d \u0027IPv4\u0027"},{"line_number":271,"context_line":"        if cidr and netaddr.IPAddress(cidr).version \u003d\u003d 6:"},{"line_number":272,"context_line":"            ethertype \u003d \u0027IPv6\u0027"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"    security_group_rule_body \u003d {"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_75ddd912","line":271,"range":{"start_line":271,"start_character":20,"end_line":271,"end_character":51},"in_reply_to":"1fa4df85_da54fa23","updated":"2020-02-28 16:32:15.000000000","message":"Makes sense.","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"db437e0b45749ad6a6442b113f0c8c4d678b327d","unresolved":false,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"    if not ethertype:"},{"line_number":270,"context_line":"        ethertype \u003d \u0027IPv4\u0027"},{"line_number":271,"context_line":"        if cidr and netaddr.IPAddress(cidr).version \u003d\u003d 6:"},{"line_number":272,"context_line":"            ethertype \u003d \u0027IPv6\u0027"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"    security_group_rule_body \u003d {"}],"source_content_type":"text/x-python","patch_set":1,"id":"1fa4df85_da54fa23","line":271,"range":{"start_line":271,"start_character":20,"end_line":271,"end_character":51},"in_reply_to":"1fa4df85_dfee2cb3","updated":"2020-02-28 16:09:37.000000000","message":"Oh. My bad. It should be `netaddr.IPNetwork()`. It will work for either cidr, or just address. And I prefer to use netaddr, since it seem to be more flexible in some cases:\n\n  In [1]: import netaddr\n\n  In [2]: netaddr.IPNetwork(\u002710.0.0.0/24\u0027)\n  Out[2]: IPNetwork(\u002710.0.0.0/24\u0027)\n\n  In [3]: netaddr.IPNetwork(\u002710.0.1.1\u0027)\n  Out[3]: IPNetwork(\u002710.0.1.1/32\u0027)\n\n  In [4]: netaddr.IPNetwork(\u002710.0.0.0\u0027)\n  Out[4]: IPNetwork(\u002710.0.0.0/32\u0027)\n\n  In [5]: netaddr.IPNetwork(\u0027fee::1\u0027)\n  Out[5]: IPNetwork(\u0027fee::1/128\u0027)\n  \n  In [6]: import ipaddress\n  \n  In [7]: ipaddress.ip_network(\u002710.0.1.100/24\u0027)\n  ---------------------------------------------------------------------------\n  ValueError                                Traceback (most recent call last)\n  \u003cipython-input-7-e94ca37a5a78\u003e in \u003cmodule\u003e()\n  ----\u003e 1 ipaddress.ip_network(\u002710.0.1.100/24\u0027)\n  \n  /usr/lib64/python3.6/ipaddress.py in ip_network(address, strict)\n       72     \"\"\"\n       73     try:\n  ---\u003e 74         return IPv4Network(address, strict)\n       75     except (AddressValueError, NetmaskValueError):\n       76         pass\n  \n  /usr/lib64/python3.6/ipaddress.py in __init__(self, address, strict)\n     1517         if packed \u0026 int(self.netmask) !\u003d packed:\n     1518             if strict:\n  -\u003e 1519                 raise ValueError(\u0027%s has host bits set\u0027 % self)\n     1520             else:\n     1521                 self.network_address \u003d IPv4Address(packed \u0026\n  \n  ValueError: 10.0.1.100/24 has host bits set\n  \n  In [8]: netaddr.IPNetwork(\u002710.0.1.100/24\u0027)\n  Out[8]: IPNetwork(\u002710.0.1.100/24\u0027)","commit_id":"4e31f4e57be4afaa0d19482a49ed430682e78d2c"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"9748f8c21d17e87504023619d116ce0fd83397a9","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"import urllib"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"import netaddr"},{"line_number":19,"context_line":"from openstack import exceptions as os_exc"},{"line_number":20,"context_line":"from oslo_cache import core as cache"},{"line_number":21,"context_line":"from oslo_config import cfg"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_1e178b47","line":18,"range":{"start_line":18,"start_character":7,"end_line":18,"end_character":14},"updated":"2020-03-05 16:27:43.000000000","message":"Still. Maybe this is a good idea to narrow down external dependencies. Do any of you remember if for some reason network cidr have ip address included in it, instead network address?\n\nIf not, I can exchange it with ipaddress.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"5cc75b9d8992aca96ebf7a0b9c6f85a19920e785","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"import urllib"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"import netaddr"},{"line_number":19,"context_line":"from openstack import exceptions as os_exc"},{"line_number":20,"context_line":"from oslo_cache import core as cache"},{"line_number":21,"context_line":"from oslo_config import cfg"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_c7dd99e0","line":18,"range":{"start_line":18,"start_character":7,"end_line":18,"end_character":14},"in_reply_to":"1fa4df85_1e178b47","updated":"2020-03-06 16:15:04.000000000","message":"I think the CIDR might be taken from NP definition and probably you can put either CIDR or just IP there.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"6cab9e84ddd923f61da3cf074461d0b6124ac731","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"import urllib"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"import netaddr"},{"line_number":19,"context_line":"from openstack import exceptions as os_exc"},{"line_number":20,"context_line":"from oslo_cache import core as cache"},{"line_number":21,"context_line":"from oslo_config import cfg"}],"source_content_type":"text/x-python","patch_set":4,"id":"1fa4df85_0f3176a3","line":18,"range":{"start_line":18,"start_character":7,"end_line":18,"end_character":14},"in_reply_to":"1fa4df85_c7dd99e0","updated":"2020-03-09 08:43:06.000000000","message":"What I meant was, if there is a possibility that we have something like \"10.0.0.10/24\" or even \"10.0.0.10\" instead of \"10.0.0.0/24\" as a CIDR.","commit_id":"05d60e2778afffeed5472dd0a177d8eb9bcbb1e2"}]}