)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"98af58df3a7894449fd427cdc876add69a3a32ac","unresolved":true,"context_lines":[{"line_number":17,"context_line":"seems to be a fair compromise between opening as little traffic as"},{"line_number":18,"context_line":"possible and increasing number of security groups and rules."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"This has some ramifications to Amphora too - we won\u0027t open ingress on"},{"line_number":21,"context_line":"whole services subnet anymore as it should be enough to just open it for"},{"line_number":22,"context_line":"all the services in the namespace."},{"line_number":23,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"1f14ca4a_8ed41d92","line":20,"updated":"2021-04-22 20:00:40.000000000","message":"Probably this paragraph can be removed now","commit_id":"4d87b9b165546fb15b1dc23238580ba6658bcdb7"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"5531ff8c4acba70b5eef6afdfb349ab424bcee80","unresolved":false,"context_lines":[{"line_number":17,"context_line":"seems to be a fair compromise between opening as little traffic as"},{"line_number":18,"context_line":"possible and increasing number of security groups and rules."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"This has some ramifications to Amphora too - we won\u0027t open ingress on"},{"line_number":21,"context_line":"whole services subnet anymore as it should be enough to just open it for"},{"line_number":22,"context_line":"all the services in the namespace."},{"line_number":23,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"04c219c4_9efeee9d","line":20,"in_reply_to":"1f14ca4a_8ed41d92","updated":"2021-04-23 09:43:07.000000000","message":"Whoops, true, thanks for spotting this.","commit_id":"4d87b9b165546fb15b1dc23238580ba6658bcdb7"}],"kuryr_kubernetes/controller/drivers/network_policy.py":[{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"275309060714f3c47ada16b8efec55975d41d37a","unresolved":true,"context_lines":[{"line_number":137,"context_line":"        #               source-ip problem as Amphora does not use LB VIP for"},{"line_number":138,"context_line":"        #               LB-\u003emembers traffic, but that other IP attached to the"},{"line_number":139,"context_line":"        #               Amphora VM in the service subnet. It\u0027s ridiculous."},{"line_number":140,"context_line":"        i_rules +\u003d self._get_service_ingress_rules(policy)"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"        return i_rules, e_rules"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"7658e31c_de844a9f","line":140,"updated":"2021-04-21 19:55:00.000000000","message":"Should these rules only be created when enforce_sg_rules is not set as with Amphora it\u0027s not needed?","commit_id":"49a7584c720faf8c35cf8f8767a131bbd643d6e1"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"e4e06f5bbb7b504950134da4e84edad2d7741b09","unresolved":false,"context_lines":[{"line_number":137,"context_line":"        #               source-ip problem as Amphora does not use LB VIP for"},{"line_number":138,"context_line":"        #               LB-\u003emembers traffic, but that other IP attached to the"},{"line_number":139,"context_line":"        #               Amphora VM in the service subnet. It\u0027s ridiculous."},{"line_number":140,"context_line":"        i_rules +\u003d self._get_service_ingress_rules(policy)"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"        return i_rules, e_rules"},{"line_number":143,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"ee972ff0_d56699e4","line":140,"in_reply_to":"7658e31c_de844a9f","updated":"2021-04-22 12:14:48.000000000","message":"True.","commit_id":"49a7584c720faf8c35cf8f8767a131bbd643d6e1"},{"author":{"_account_id":23567,"name":"Luis Tomas Bolivar","email":"ltomasbo@redhat.com","username":"ltomasbo"},"change_message_id":"940d1e523fa0bdc7a700763c812a057d7a43b7e7","unresolved":true,"context_lines":[{"line_number":144,"context_line":"    def _get_service_ingress_rules(self, policy):"},{"line_number":145,"context_line":"        \"\"\"Get SG rules allowing traffic from Services in the namespace"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"        This methods returns ingress rules allowing traffic from all"},{"line_number":148,"context_line":"        services clusterIPs in the cluster. This is required for OVN LBs in"},{"line_number":149,"context_line":"        order to work around the fact that it changes source-ip to LB IP in"},{"line_number":150,"context_line":"        hairpin traffic."},{"line_number":151,"context_line":"        \"\"\""},{"line_number":152,"context_line":"        if CONF.octavia_defaults.enforce_sg_rules:"},{"line_number":153,"context_line":"            # When enforce_sg_rules is True, one of the default rules will"}],"source_content_type":"text/x-python","patch_set":6,"id":"c9b35fb9_cb2f6454","line":150,"range":{"start_line":147,"start_character":0,"end_line":150,"end_character":24},"updated":"2021-04-26 06:44:31.000000000","message":"perhaps worth to mention that traffic coming to a pod from a service IP can only happen if the member receiving the traffic is the one making the call, so this is not a security issue here. In addition, perhaps we can add a fixme for when OVN supports selecting the IP that will be used, and in that case we will only need to open that extra IP by default","commit_id":"4f199efb36227173a81690d533716ef620c3ac9f"}],"kuryr_kubernetes/controller/handlers/lbaas.py":[{"author":{"_account_id":27032,"name":"Maysa de Macedo Souza","email":"maysa.macedo95@gmail.com","username":"maysa"},"change_message_id":"3fc3f8604c84b06d714edb95ca58aa73a466cd59","unresolved":true,"context_lines":[{"line_number":121,"context_line":"                        f\"{svc_namespace}/kuryrloadbalancers/{svc_name}\")"},{"line_number":122,"context_line":"        # Bump all the NPs in the namespace to force SG rules"},{"line_number":123,"context_line":"        # recalculation."},{"line_number":124,"context_line":"        self._bump_network_policies(service)"},{"line_number":125,"context_line":"        try:"},{"line_number":126,"context_line":"            k8s.delete(klb_crd_path)"},{"line_number":127,"context_line":"        except k_exc.K8sResourceNotFound:"}],"source_content_type":"text/x-python","patch_set":7,"id":"6a414e2c_797611b2","line":124,"updated":"2021-05-05 13:06:38.000000000","message":"Should the network policy be bumped only after the service is gone?\nI see we base on the existent services when updating the service sg:\nhttps://github.com/openstack/kuryr-kubernetes/blob/master/kuryr_kubernetes/controller/handlers/kuryrnetworkpolicy.py#L190-L200","commit_id":"da994add09c56bca9eba14c870786d5adb3479f6"},{"author":{"_account_id":11600,"name":"Michał Dulko","email":"michal.dulko@gmail.com","username":"dulek"},"change_message_id":"bb3b4613802447d68bc87eb4791c6ad8e1f5e525","unresolved":true,"context_lines":[{"line_number":121,"context_line":"                        f\"{svc_namespace}/kuryrloadbalancers/{svc_name}\")"},{"line_number":122,"context_line":"        # Bump all the NPs in the namespace to force SG rules"},{"line_number":123,"context_line":"        # recalculation."},{"line_number":124,"context_line":"        self._bump_network_policies(service)"},{"line_number":125,"context_line":"        try:"},{"line_number":126,"context_line":"            k8s.delete(klb_crd_path)"},{"line_number":127,"context_line":"        except k_exc.K8sResourceNotFound:"}],"source_content_type":"text/x-python","patch_set":7,"id":"0fdb8c41_9576447a","line":124,"in_reply_to":"6a414e2c_797611b2","updated":"2021-05-05 14:38:12.000000000","message":"Nice find! So we can fix this by making sure we ignore services with deletionTimestamp set in this loop. I already do that in 2 other places, let me add it to those lines you\u0027ve pointed out.","commit_id":"da994add09c56bca9eba14c870786d5adb3479f6"}]}