kaxil commented on code in PR #74504:
URL: https://github.com/apache/airflow/pull/74504#discussion_r4258175438
##########
providers/common/ai/src/airflow/providers/common/ai/sandbox/opensandbox.py:
##########
@@ -307,24 +314,66 @@ def _get_network_policy(spec: SandboxSpec | None) ->
NetworkPolicy | None:
# spellings work at runtime, but only the alias is in the typed
signature.
return NetworkPolicy(defaultAction="deny", egress=rules or None)
+ @staticmethod
+ def _get_egress_enforcement_mode(sandbox: SandboxSync) -> str | None:
+ """Return the mode the sandbox's egress sidecar enforces its policy
in, or ``None`` if unreported."""
+ import httpx
+ from opensandbox.adapters.converter.response_handler import
handle_api_error, require_parsed
+ from opensandbox.api.egress import Client
+ from opensandbox.api.egress.api.policy import get_policy
+ from opensandbox.api.egress.models import PolicyStatusResponse
+ from opensandbox.constants import DEFAULT_EGRESS_PORT
+
+ # get_egress_policy() keeps only the rules from the sidecar's /policy
response and drops
+ # its enforcementMode, so read that response with the SDK's generated
egress client.
+ config = sandbox.connection_config
+ endpoint = sandbox.get_endpoint(DEFAULT_EGRESS_PORT)
+ with Client(
Review Comment:
Thanks for catching this. `new_owned_transport()` only exists from
opensandbox 1.1.1, so my suggestion named an API this PR's `>=1.1.0` floor
doesn't have. I checked the `model_copy(update={"transport":
None}).with_transport_if_missing()` version against 1.1.0: it builds a separate
`RetrySyncTransport` stack, and the sandbox's shared transport still serves
requests after the `with` block closes it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
