weizhouapache commented on PR #13684: URL: https://github.com/apache/cloudstack/pull/13684#issuecomment-5196693838
> I would put this very boldly in the Release notes as the first item. > > @weizhouapache from what I know - if default behaviour is Deny, and automation/human is then adding ANY SINGLE RULE, then that deny is NO MORE active and they can allow this or that, but they have to have a DENY at the end of the list of rules as a security thing - that being said - I'm sure 99% of their code will simply work out of the box, except cases where someone deployes VMs in Isolated network and does NOT ever touch the Egress rules - which is the 1% IMO of users (all VMs need to exit to Internet at least to some ports/or some networks). Can you confirm this with what you know about Isolated netowrk - I mean the behavior of when a single rule is added the default DENY doesn't apply any more? > > I did think about that @weizhouapache for a bit, I'm the first one who doesn't want to break backward compatibility- but if it's a silent switch, which needs to be turned ON - effectively this PR will never really introduce changes/improvements in peoples environments. > > I would just make sure we put it as the very first "what's changed" line in Release Notes, and in bold - with NOTE to users to consider if their automation will need prior things. > > @andrijapanicsb If CloudStack were a new project, I would completely agree with your changes. However, CloudStack has been around for more than 15 years. While the current default behavior may not be ideal, changing it now could introduce more disadvantages. For users who simply allow VMs to access the entire Internet, the migration is relatively straightforward: retrieve the current default egress policy and add an egress rule that allows all traffic if needed. However, for users who only allow VMs to access specific CIDRs or port ranges, the migration becomes more complicated. They would need to create a new network offering and migrate to it. One possible approach is to introduce a new default network offering with the egress policy set to Allow. This would give new deployments the desired default behavior while preserving backward compatibility for existing users and deployments. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
