Lee-W commented on code in PR #72936:
URL: https://github.com/apache/airflow/pull/72936#discussion_r4052568549
##########
providers/common/ai/src/airflow/providers/common/ai/sandbox/sbx.py:
##########
@@ -80,12 +80,18 @@ class SbxSandboxBackend(SandboxBackend):
backend ships with the provider yet; add one behind :class:`SandboxBackend`
if you need Kubernetes.
- **Network policy is a host-level setting, not a per-sandbox one.** ``sbx``
- governs egress through ``sbx policy``, so this backend cannot apply a
- per-sandbox rule. Rather than let a DAG author believe a
- :class:`~airflow.providers.common.ai.sandbox.SandboxSpec` restriction is in
- force when it is not, ``create`` refuses a spec it cannot honor unless the
- Deployment Manager states the host policy through ``host_network_policy``.
+ **Network policy is layered on a host-level setting, not independent of
+ one.** ``sbx`` governs egress through a host-level ``sbx policy``.
+ ``create`` applies ``allow_egress_to`` as a per-sandbox rule on top of
+ that policy, but the rule can only narrow a host policy that is already
+ ``deny-all`` and never widen one. ``block_network`` has no per-sandbox
+ enforcement at all: no ``sbx`` call implements it. Rather than let a Dag
+ author believe a
+ :class:`~airflow.providers.common.ai.sandbox.SandboxSpec` restriction is
+ in force when it is not, ``create`` raises instead of silently ignoring a
+ spec that names ``allow_egress_to`` or ``block_network``. It lets the
Review Comment:
The docstring now
* reuses `:param host_network_policy:` 20 lines down
* says that `block_network` defaults to `True`, so a bare `SandboxSpec()`
already asks for one.
That is the case for `SandboxToolset` when no spec is passed, so it was the
wrong one to describe as fine. `toolsets.rst` gains the `block_network` half of
the fact it was missing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
