Support Network Polcices in the Sandboxes#54
Conversation
lukaszo
force-pushed
the
KOYEB-5970-np
branch
3 times, most recently
from
8fbae3a to
4860e55
Compare
| @@ -0,0 +1 @@ | |||
| 7.24.0-SNAPSHOT | |||
There was a problem hiding this comment.
no idea, dropped. I guess some leftover
|
|
||
| def update_egress_policy( | ||
| self, | ||
| block_network: bool = False, |
There was a problem hiding this comment.
The name might not be super future proof, no? If we add policies ruling inbound, for example
| - **18_create_sandbox_with_existing_app.py** - Create a sandbox in an existing app | ||
| - **19_entrypoint_and_command.py** - Create sandboxes with custom entrypoint and command | ||
| - **20_config_files.py** - Config files with secrets and interpolation | ||
| - **21_egress_policy.py** - Block outbound network access or restrict it to an allowlist |
There was a problem hiding this comment.
I think this will break MAIS e2e tests. It's because network policies are not yet implemented in MAIS but the e2e clone the repository & run all examples 🥲
https://github.com/mistralai/api.koyeb.com/blob/main/test/e2e/flows/sandbox.go#L170
It's my fault sorry, do you mind patching? I think we have multiple choices:
- Clone at a specific commit SHA
- Maintain a whitelist for e2e tests to run
- Have a better strategy than clone the repo
- ?
There was a problem hiding this comment.
I think we could mirror the test else where, maybe in our main repo.
Because there are some tests we'd like to include that might not be user facing as well.
There was a problem hiding this comment.
We already exclude some https://github.com/mistralai/api.koyeb.com/blob/main/test/e2e/flows/sandbox.go#L313
I will add it there
|
|
||
| def update_egress_policy( | ||
| self, | ||
| block_network: bool = False, |
There was a problem hiding this comment.
Should it be directly update_network_policy ?
Forgetting parameters in this function looks a bit dangerous if that's reseting the policy.
| block_network: bool = False, | ||
| outbound_allowlist: Optional[List[str]] = None, | ||
| ) -> None: | ||
| """Update the sandbox's egress network policy asynchronously. |
There was a problem hiding this comment.
Maybe we should mention it's re-deploying
3 participants
No description provided.