)]}'
{"specs/ocata/security-group-improvements.rst":[{"author":{"_account_id":9782,"name":"Morgan Jones","email":"morgan@tesora.com","username":"vgnbkr"},"change_message_id":"aee1e08130cacc758d740c0da823f37914fa759a","unresolved":false,"context_lines":[{"line_number":53,"context_line":"The rules for the DSV SG\u0027s will no longer be parsed from the configuration as"},{"line_number":54,"context_line":"DSV-cfg mapping is not possible at this time. Instead the rules will be stored"},{"line_number":55,"context_line":"in the Trove databases; i.e. via trove-manage. The DSV SG\u0027s will open the"},{"line_number":56,"context_line":"configured ports to the configured CIDR."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Cluster SG\u0027s will open all ports to all instances using the same security"},{"line_number":59,"context_line":"group. This disables the firewall between cluster instances which minimizes"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da6895a0_0edd0d0e","line":56,"range":{"start_line":56,"start_character":20,"end_line":56,"end_character":39},"updated":"2016-10-25 20:12:46.000000000","message":"As the user can select which network they wish an instance to be on, wouldn\u0027t this statement suggest that each network would need its own SG (with appropriate CIDR)?","commit_id":"884e3a49a30859310e4d615d4cd1ce14515aac67"},{"author":{"_account_id":9782,"name":"Morgan Jones","email":"morgan@tesora.com","username":"vgnbkr"},"change_message_id":"aee1e08130cacc758d740c0da823f37914fa759a","unresolved":false,"context_lines":[{"line_number":65,"context_line":"their own security group."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"If the user wants to open additional ports then they can attach their own"},{"line_number":68,"context_line":"security group to the existing instance. A follow up work item involves"},{"line_number":69,"context_line":"allowing the instance and cluster create API\u0027s to pass a security group ID that"},{"line_number":70,"context_line":"will be attached to the instance(s)."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The resulting benefits of this change are reduced SG quota usage, improved"},{"line_number":73,"context_line":"instance create/delete times, and stronger security for clusters and"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da6895a0_4e2c6502","line":70,"range":{"start_line":68,"start_character":41,"end_line":70,"end_character":35},"updated":"2016-10-25 20:12:46.000000000","message":"Why is this necessary?  Allowing the user to specify a SG could allow them to bypass security set up by the operator (maybe?).","commit_id":"884e3a49a30859310e4d615d4cd1ce14515aac67"},{"author":{"_account_id":9782,"name":"Morgan Jones","email":"morgan@tesora.com","username":"vgnbkr"},"change_message_id":"aee1e08130cacc758d740c0da823f37914fa759a","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Behaviour"},{"line_number":78,"context_line":"---------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"A SG will be created when an instance of a DSV is created and there is no"},{"line_number":81,"context_line":"existing SG for that DSV. This SG will be used for all instances of the DSV. If"},{"line_number":82,"context_line":"all instances of the DSV are deleted then the SG will be deleted."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Another SG will be created during cluster-create, or when a replication set is"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da6895a0_2e4651bf","line":81,"range":{"start_line":80,"start_character":0,"end_line":81,"end_character":24},"updated":"2016-10-25 20:12:46.000000000","message":"How could there be a pre-existing SG for a DSV?","commit_id":"884e3a49a30859310e4d615d4cd1ce14515aac67"},{"author":{"_account_id":9782,"name":"Morgan Jones","email":"morgan@tesora.com","username":"vgnbkr"},"change_message_id":"aee1e08130cacc758d740c0da823f37914fa759a","unresolved":false,"context_lines":[{"line_number":85,"context_line":"created (a standalone instance is converted replication primary/master). This"},{"line_number":86,"context_line":"SG will be attached, in addition to the DSV SG, to all instances in the cluster"},{"line_number":87,"context_line":"or replication set. This SG will be deleted during cluster delete or when the"},{"line_number":88,"context_line":"replication set is dismantled."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Configuration"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da6895a0_ee229900","line":88,"range":{"start_line":88,"start_character":0,"end_line":88,"end_character":29},"updated":"2016-10-25 20:12:46.000000000","message":"You will also need to remove the secondary SG from an instance when that instance is ejected or detached from a replication set.","commit_id":"884e3a49a30859310e4d615d4cd1ce14515aac67"},{"author":{"_account_id":9782,"name":"Morgan Jones","email":"morgan@tesora.com","username":"vgnbkr"},"change_message_id":"aee1e08130cacc758d740c0da823f37914fa759a","unresolved":false,"context_lines":[{"line_number":126,"context_line":"Public API"},{"line_number":127,"context_line":"----------"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"The endpoint security-groups will not change, but security-group-rules will be"},{"line_number":130,"context_line":"removed. A GET on security-groups will query the network service for the rules"},{"line_number":131,"context_line":"and return that as part of the SG data."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Public API Security"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da6895a0_ae5ee173","line":131,"range":{"start_line":129,"start_character":0,"end_line":131,"end_character":38},"updated":"2016-10-25 20:12:46.000000000","message":"You might not want to do this.  To do so, you would need to deprecate the existing functionality for two releases, and it is not clear how you would support the old functionality on security-groups unless it only printed the extra info when a flag is specified (or you made an entirely new command).","commit_id":"884e3a49a30859310e4d615d4cd1ce14515aac67"}]}