andrijapanicsb commented on PR #13684: URL: https://github.com/apache/cloudstack/pull/13684#issuecomment-5196059850
I would put this very boldly in the Release notes as the first item. @weizhouapache from what I know - if default behaviour is Deny, and automation/human is then adding ANY SINGLE RULE, then that deny is NO MORE active and they can allow this or that, but they have to have a DENY at the end of the list of rules as a security thing - that being said - I'm sure 99% of their code will simply work out of the box, except cases where someone deployes VMs in Isolated network and does NOT ever touch the Egress rules - which is the 1% IMO of users (all VMs need to exit to Internet at least to some ports/or some networks). Can you confirm this with what you know about Isolated netowrk - I mean the behavior of when a single rule is added the default DENY doesn't apply any more? I did think about that @weizhouapache for a bit, I'm the first one who doesn't want to break backward compatibility- but if it's a silent switch, which needs to be turned ON - effectively this PR will never really introduce changes/improvements in peoples environments. I would just make sure we put it as the very first "what's changed" line in Release Notes, and in bold - with NOTE to users to consider if their automation will need prior things. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
