)]}'
{"kuryr_kubernetes/controller/drivers/network_policy.py":[{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"bf486e350495815cf29238a949a8289283602e1f","unresolved":true,"context_lines":[{"line_number":259,"context_line":"                    allowed_resources.extend(self._get_pods("},{"line_number":260,"context_line":"                        pod_selector))"},{"line_number":261,"context_line":"                else:"},{"line_number":262,"context_line":"                    # allow from all the cluster"},{"line_number":263,"context_line":"                    allowed_cidrs \u003d utils.get_subnetpool_cidrs("},{"line_number":264,"context_line":"                        CONF.namespace_subnet.pod_subnet_pool)"},{"line_number":265,"context_line":"            elif namespace_selector:"}],"source_content_type":"text/x-python","patch_set":1,"id":"dc3828bd_6b7e3efe","line":262,"updated":"2021-02-11 12:56:56.000000000","message":"Shouldn\u0027t we also include the service cidr here for the Amphora case?\n\nIt seems we were creating only sg rules for services cidr when ingress is used[1] or when specifc resources are selected for egress[2] as before we relied on the open to everywhere rule.\n\n[1] https://github.com/openstack/kuryr-kubernetes/blob/master/kuryr_kubernetes/controller/drivers/network_policy.py#L207-L208\n[2] https://github.com/openstack/kuryr-kubernetes/blob/master/kuryr_kubernetes/controller/drivers/network_policy.py#L565","commit_id":"8b411ffb939ac48a0199e38b4a401719ed543915"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"b92788b9075709daa823421ea24fc22c8ad64040","unresolved":true,"context_lines":[{"line_number":259,"context_line":"                    allowed_resources.extend(self._get_pods("},{"line_number":260,"context_line":"                        pod_selector))"},{"line_number":261,"context_line":"                else:"},{"line_number":262,"context_line":"                    # allow from all the cluster"},{"line_number":263,"context_line":"                    allowed_cidrs \u003d utils.get_subnetpool_cidrs("},{"line_number":264,"context_line":"                        CONF.namespace_subnet.pod_subnet_pool)"},{"line_number":265,"context_line":"            elif namespace_selector:"}],"source_content_type":"text/x-python","patch_set":1,"id":"892c9039_f711294f","line":262,"in_reply_to":"dc3828bd_6b7e3efe","updated":"2021-02-11 13:17:46.000000000","message":"Hm. True.","commit_id":"8b411ffb939ac48a0199e38b4a401719ed543915"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"301509a6f3e9a78d1ff3859d0c90a84c200d3ec3","unresolved":true,"context_lines":[{"line_number":263,"context_line":"                    # service subnet."},{"line_number":264,"context_line":"                    allowed_cidrs \u003d utils.get_subnetpool_cidrs("},{"line_number":265,"context_line":"                        CONF.namespace_subnet.pod_subnet_pool)"},{"line_number":266,"context_line":"                    if CONF.octavia_defaults.enforce_sg_rules:"},{"line_number":267,"context_line":"                        allowed_cidrs.append(utils.get_subnet_cidr("},{"line_number":268,"context_line":"                            CONF.neutron_defaults.service_subnet))"},{"line_number":269,"context_line":"            elif namespace_selector:"}],"source_content_type":"text/x-python","patch_set":2,"id":"5cfe8c00_70379af8","line":266,"updated":"2021-02-11 15:24:24.000000000","message":"thanks for the fix!","commit_id":"4968ef1aaafce7cb10426e3f5e12147673d81373"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"301509a6f3e9a78d1ff3859d0c90a84c200d3ec3","unresolved":true,"context_lines":[{"line_number":530,"context_line":"                                sg_rule_body_list, policy_namespace)"},{"line_number":531,"context_line":"                        if allowed_cidrs:"},{"line_number":532,"context_line":"                            self._create_all_pods_sg_rules("},{"line_number":533,"context_line":"                                port, direction, sg_rule_body_list,"},{"line_number":534,"context_line":"                                pod_selector, policy_namespace)"},{"line_number":535,"context_line":"                    else:"},{"line_number":536,"context_line":"                        self._create_all_pods_sg_rules("}],"source_content_type":"text/x-python","patch_set":2,"id":"ae9a7ff8_8d394808","line":533,"updated":"2021-02-11 15:24:24.000000000","message":"on a second look I noticed that the allowed_cidrs are not used here. Should it be used on the _create_all_pods_sg_rules?","commit_id":"4968ef1aaafce7cb10426e3f5e12147673d81373"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"5b4c05d1ba3bd9807290bcbe8422e0944c5d4781","unresolved":true,"context_lines":[{"line_number":530,"context_line":"                                sg_rule_body_list, policy_namespace)"},{"line_number":531,"context_line":"                        if allowed_cidrs:"},{"line_number":532,"context_line":"                            self._create_all_pods_sg_rules("},{"line_number":533,"context_line":"                                port, direction, sg_rule_body_list,"},{"line_number":534,"context_line":"                                pod_selector, policy_namespace)"},{"line_number":535,"context_line":"                    else:"},{"line_number":536,"context_line":"                        self._create_all_pods_sg_rules("}],"source_content_type":"text/x-python","patch_set":2,"id":"69200546_95b971eb","line":533,"in_reply_to":"ae9a7ff8_8d394808","updated":"2021-02-12 10:37:39.000000000","message":"You\u0027re right. I\u0027ve analyzed this entire flow, and seems, like we need to pass cidrs, in this particular place, just to not open too wide.","commit_id":"4968ef1aaafce7cb10426e3f5e12147673d81373"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"0e23945eeb1a490166f16d1797b701a9f8be75c9","unresolved":true,"context_lines":[{"line_number":247,"context_line":""},{"line_number":248,"context_line":"    def _parse_selectors(self, rule_block, rule_direction, policy_namespace):"},{"line_number":249,"context_line":"        allowed_resources \u003d []"},{"line_number":250,"context_line":"        allowed_cidrs \u003d None"},{"line_number":251,"context_line":"        selectors \u003d False"},{"line_number":252,"context_line":"        for rule in rule_block.get(rule_direction, []):"},{"line_number":253,"context_line":"            namespace_selector \u003d rule.get(\u0027namespaceSelector\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"fbeeeab0_827f1f3d","line":250,"range":{"start_line":250,"start_character":24,"end_line":250,"end_character":28},"updated":"2021-02-12 14:24:13.000000000","message":"perhaps this could be a list?","commit_id":"4ba363d6c83fe577302447775e882c82d2c3e8a7"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"60688f2d26666072654ae0b6012b515ef6fd6876","unresolved":true,"context_lines":[{"line_number":247,"context_line":""},{"line_number":248,"context_line":"    def _parse_selectors(self, rule_block, rule_direction, policy_namespace):"},{"line_number":249,"context_line":"        allowed_resources \u003d []"},{"line_number":250,"context_line":"        allowed_cidrs \u003d None"},{"line_number":251,"context_line":"        selectors \u003d False"},{"line_number":252,"context_line":"        for rule in rule_block.get(rule_direction, []):"},{"line_number":253,"context_line":"            namespace_selector \u003d rule.get(\u0027namespaceSelector\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"005ecd6f_4587b78e","line":250,"range":{"start_line":250,"start_character":24,"end_line":250,"end_character":28},"in_reply_to":"fbeeeab0_827f1f3d","updated":"2021-02-13 08:36:27.000000000","message":"It might be, yeah. But it doesn\u0027t really needed to be. We still check if allow_cidrs is truthy, before doing anything with the list if it evaluates to true.","commit_id":"4ba363d6c83fe577302447775e882c82d2c3e8a7"},{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"0e23945eeb1a490166f16d1797b701a9f8be75c9","unresolved":true,"context_lines":[{"line_number":353,"context_line":"        param crd_rules: list of parsed SG rules"},{"line_number":354,"context_line":"        param pod_selector: dict with NetworkPolicySpec\u0027s podSelector"},{"line_number":355,"context_line":"        param policy_namespace: string with policy namespace"},{"line_number":356,"context_line":"        param allowed_cidrs: None, or a list of cidrs, where/from the traffic"},{"line_number":357,"context_line":"                             should be allowed."},{"line_number":358,"context_line":"        \"\"\""},{"line_number":359,"context_line":"        matched_pods \u003d {}"}],"source_content_type":"text/x-python","patch_set":3,"id":"b012028c_0bac793a","line":356,"range":{"start_line":356,"start_character":61,"end_line":356,"end_character":65},"updated":"2021-02-12 14:24:13.000000000","message":"from/to?","commit_id":"4ba363d6c83fe577302447775e882c82d2c3e8a7"},{"author":{"_account_id":13692,"name":"Roman Dobosz","email":"gryf73@gmail.com","username":"gryf"},"change_message_id":"60688f2d26666072654ae0b6012b515ef6fd6876","unresolved":true,"context_lines":[{"line_number":353,"context_line":"        param crd_rules: list of parsed SG rules"},{"line_number":354,"context_line":"        param pod_selector: dict with NetworkPolicySpec\u0027s podSelector"},{"line_number":355,"context_line":"        param policy_namespace: string with policy namespace"},{"line_number":356,"context_line":"        param allowed_cidrs: None, or a list of cidrs, where/from the traffic"},{"line_number":357,"context_line":"                             should be allowed."},{"line_number":358,"context_line":"        \"\"\""},{"line_number":359,"context_line":"        matched_pods \u003d {}"}],"source_content_type":"text/x-python","patch_set":3,"id":"bafa8d54_77b01e87","line":356,"range":{"start_line":356,"start_character":61,"end_line":356,"end_character":65},"in_reply_to":"b012028c_0bac793a","updated":"2021-02-13 08:36:27.000000000","message":"ah, right :)","commit_id":"4ba363d6c83fe577302447775e882c82d2c3e8a7"}],"kuryr_kubernetes/utils.py":[{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"efebdd4b0874ee0bf224c344a39633933ecfdd5c","unresolved":true,"context_lines":[{"line_number":327,"context_line":"def get_subnets_cidrs(subnet_ids):"},{"line_number":328,"context_line":"    return [x[1] for x in get_subnets_id_cidrs(subnet_ids)]"},{"line_number":329,"context_line":""},{"line_number":330,"context_line":""},{"line_number":331,"context_line":"@MEMOIZE"},{"line_number":332,"context_line":"def _get_subnetpool(subnetpool_id):"},{"line_number":333,"context_line":"    os_net \u003d clients.get_network_client()"},{"line_number":334,"context_line":"    try:"},{"line_number":335,"context_line":"        subnetpool_obj \u003d os_net.get_subnet_pool(subnetpool_id)"},{"line_number":336,"context_line":"    except os_exc.ResourceNotFound:"},{"line_number":337,"context_line":"        LOG.exception(\"Subnetpool %s not found!\", subnetpool_id)"},{"line_number":338,"context_line":"        raise"},{"line_number":339,"context_line":"    return subnetpool_obj"},{"line_number":340,"context_line":""},{"line_number":341,"context_line":""},{"line_number":342,"context_line":"def get_subnetpool_version(subnetpool_id):"},{"line_number":343,"context_line":"    subnetpool_obj \u003d _get_subnetpool(subnetpool_id)"},{"line_number":344,"context_line":"    return subnetpool_obj.ip_version"},{"line_number":345,"context_line":""},{"line_number":346,"context_line":""},{"line_number":347,"context_line":"def get_subnetpool_cidrs(subnetpool_id):"},{"line_number":348,"context_line":"    subnetpool_obj \u003d _get_subnetpool(subnetpool_id)"},{"line_number":349,"context_line":"    return subnetpool_obj.prefixes"},{"line_number":350,"context_line":""},{"line_number":351,"context_line":""},{"line_number":352,"context_line":"def extract_pod_annotation(annotation):"}],"source_content_type":"text/x-python","patch_set":1,"id":"34e0ac56_9395614f","line":349,"range":{"start_line":330,"start_character":0,"end_line":349,"end_character":34},"updated":"2021-02-10 16:52:40.000000000","message":"This is nice.","commit_id":"8b411ffb939ac48a0199e38b4a401719ed543915"}]}