{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/origin/pulls/comments/74444998","id":74444998,"diff_hunk":"@@ -339,7 +340,12 @@ func (plugin *OsdnNode) SetupSDN(localSubnetCIDR, clusterNetworkCIDR, servicesNe\n func (plugin *OsdnNode) SetupEgressNetworkPolicy() error {\n \tpolicies, err := plugin.registry.GetEgressNetworkPolicies()\n \tif err != nil {\n-\t\treturn fmt.Errorf(\"Could not get EgressNetworkPolicies: %s\", err)\n+\t\tif kapierrs.IsForbidden(err) {\n+\t\t\tglog.Errorf(\"WARNING: EgressNetworkPolicy is not being enforced - please ensure your nodes have access to view EgressNetworkPolicy (eg, 'oadm policy reconcile-cluster-roles')\")\n+\t\t\treturn nil\n+\t\t} else {\n+\t\t\treturn fmt.Errorf(\"Could not get EgressNetworkPolicies: %s\", err)","path":"pkg/sdn/plugin/controller.go","position":17,"original_position":17,"commit_id":"2dab6c5be71b60206fc6afad74c7b6f9b23c3d38","original_commit_id":"2dab6c5be71b60206fc6afad74c7b6f9b23c3d38","user":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"body":"style: lowercase `Could` because all errors follow that pattern","created_at":"2016-08-11T15:31:41Z","updated_at":"2016-08-11T15:31:41Z","html_url":"https://github.com/openshift/origin/pull/10358#discussion_r74444998","pull_request_url":"https://api.github.com/repos/openshift/origin/pulls/10358","_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments/74444998"},"html":{"href":"https://github.com/openshift/origin/pull/10358#discussion_r74444998"},"pull_request":{"href":"https://api.github.com/repos/openshift/origin/pulls/10358"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/10358","id":80977156,"html_url":"https://github.com/openshift/origin/pull/10358","diff_url":"https://github.com/openshift/origin/pull/10358.diff","patch_url":"https://github.com/openshift/origin/pull/10358.patch","issue_url":"https://api.github.com/repos/openshift/origin/issues/10358","number":10358,"state":"open","locked":false,"title":"Allow startup to continue even if nodes don't have EgressNetworkPolicy list permission","user":{"login":"danwinship","id":96040,"avatar_url":"https://avatars.githubusercontent.com/u/96040?v=3","gravatar_id":"","url":"https://api.github.com/users/danwinship","html_url":"https://github.com/danwinship","followers_url":"https://api.github.com/users/danwinship/followers","following_url":"https://api.github.com/users/danwinship/following{/other_user}","gists_url":"https://api.github.com/users/danwinship/gists{/gist_id}","starred_url":"https://api.github.com/users/danwinship/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danwinship/subscriptions","organizations_url":"https://api.github.com/users/danwinship/orgs","repos_url":"https://api.github.com/users/danwinship/repos","events_url":"https://api.github.com/users/danwinship/events{/privacy}","received_events_url":"https://api.github.com/users/danwinship/received_events","type":"User","site_admin":false},"body":"following up from IRC; SDN startup currently bails out if it can't read the list of EgressNetworkPolicy objects, which means if you upgrade and don't reconcile roles, the cluster will break. This patch makes it just print a warning instead.\r\n\r\nIn terms of security; no one is going to already have EgressNetworkPolicy objects before upgrading, and presumably the first time they tried to add one, they would test to see if it actually worked, so even if they didn't see the warning, they would notice there was a problem before the non-enforcement of EgressNetworkPolicy became a security issue. Although, they have to restart each node after reconciling, so there could be a situation where even after reconciling, some nodes were able to implement EgressNetworkPolicy and others weren't...\r\n\r\n@liggitt @deads2k ?","created_at":"2016-08-11T15:22:14Z","updated_at":"2016-08-11T15:31:41Z","closed_at":null,"merged_at":null,"merge_commit_sha":"51488f6d3173f571abe7eb444c08962a4d99920f","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/openshift/origin/pulls/10358/commits","review_comments_url":"https://api.github.com/repos/openshift/origin/pulls/10358/comments","review_comment_url":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/origin/issues/10358/comments","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/2dab6c5be71b60206fc6afad74c7b6f9b23c3d38","head":{"label":"danwinship:egress-policy-migration","ref":"egress-policy-migration","sha":"2dab6c5be71b60206fc6afad74c7b6f9b23c3d38","user":{"login":"danwinship","id":96040,"avatar_url":"https://avatars.githubusercontent.com/u/96040?v=3","gravatar_id":"","url":"https://api.github.com/users/danwinship","html_url":"https://github.com/danwinship","followers_url":"https://api.github.com/users/danwinship/followers","following_url":"https://api.github.com/users/danwinship/following{/other_user}","gists_url":"https://api.github.com/users/danwinship/gists{/gist_id}","starred_url":"https://api.github.com/users/danwinship/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danwinship/subscriptions","organizations_url":"https://api.github.com/users/danwinship/orgs","repos_url":"https://api.github.com/users/danwinship/repos","events_url":"https://api.github.com/users/danwinship/events{/privacy}","received_events_url":"https://api.github.com/users/danwinship/received_events","type":"User","site_admin":false},"repo":{"id":36016405,"name":"origin","full_name":"danwinship/origin","owner":{"login":"danwinship","id":96040,"avatar_url":"https://avatars.githubusercontent.com/u/96040?v=3","gravatar_id":"","url":"https://api.github.com/users/danwinship","html_url":"https://github.com/danwinship","followers_url":"https://api.github.com/users/danwinship/followers","following_url":"https://api.github.com/users/danwinship/following{/other_user}","gists_url":"https://api.github.com/users/danwinship/gists{/gist_id}","starred_url":"https://api.github.com/users/danwinship/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danwinship/subscriptions","organizations_url":"https://api.github.com/users/danwinship/orgs","repos_url":"https://api.github.com/users/danwinship/repos","events_url":"https://api.github.com/users/danwinship/events{/privacy}","received_events_url":"https://api.github.com/users/danwinship/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/danwinship/origin","description":"OpenShift 3 - build, deploy, and manage your applications with Docker and Kubernetes","fork":true,"url":"https://api.github.com/repos/danwinship/origin","forks_url":"https://api.github.com/repos/danwinship/origin/forks","keys_url":"https://api.github.com/repos/danwinship/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/danwinship/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/danwinship/origin/teams","hooks_url":"https://api.github.com/repos/danwinship/origin/hooks","issue_events_url":"https://api.github.com/repos/danwinship/origin/issues/events{/number}","events_url":"https://api.github.com/repos/danwinship/origin/events","assignees_url":"https://api.github.com/repos/danwinship/origin/assignees{/user}","branches_url":"https://api.github.com/repos/danwinship/origin/branches{/branch}","tags_url":"https://api.github.com/repos/danwinship/origin/tags","blobs_url":"https://api.github.com/repos/danwinship/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/danwinship/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/danwinship/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/danwinship/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/danwinship/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/danwinship/origin/languages","stargazers_url":"https://api.github.com/repos/danwinship/origin/stargazers","contributors_url":"https://api.github.com/repos/danwinship/origin/contributors","subscribers_url":"https://api.github.com/repos/danwinship/origin/subscribers","subscription_url":"https://api.github.com/repos/danwinship/origin/subscription","commits_url":"https://api.github.com/repos/danwinship/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/danwinship/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/danwinship/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/danwinship/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/danwinship/origin/contents/{+path}","compare_url":"https://api.github.com/repos/danwinship/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/danwinship/origin/merges","archive_url":"https://api.github.com/repos/danwinship/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/danwinship/origin/downloads","issues_url":"https://api.github.com/repos/danwinship/origin/issues{/number}","pulls_url":"https://api.github.com/repos/danwinship/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/danwinship/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/danwinship/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/danwinship/origin/labels{/name}","releases_url":"https://api.github.com/repos/danwinship/origin/releases{/id}","deployments_url":"https://api.github.com/repos/danwinship/origin/deployments","created_at":"2015-05-21T14:09:10Z","updated_at":"2015-05-21T14:09:13Z","pushed_at":"2016-08-11T15:12:42Z","git_url":"git://github.com/danwinship/origin.git","ssh_url":"git@github.com:danwinship/origin.git","clone_url":"https://github.com/danwinship/origin.git","svn_url":"https://github.com/danwinship/origin","homepage":"http://www.openshift.org","size":312058,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"local-novxlan"}},"base":{"label":"openshift:master","ref":"master","sha":"70adfdf1542bb76f2937b693ca0d2a15bd8b30a7","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":22442668,"name":"origin","full_name":"openshift/origin","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/origin","description":"Enterprise-Ready Kubernetes for Developers","fork":false,"url":"https://api.github.com/repos/openshift/origin","forks_url":"https://api.github.com/repos/openshift/origin/forks","keys_url":"https://api.github.com/repos/openshift/origin/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/origin/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/origin/teams","hooks_url":"https://api.github.com/repos/openshift/origin/hooks","issue_events_url":"https://api.github.com/repos/openshift/origin/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/origin/events","assignees_url":"https://api.github.com/repos/openshift/origin/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/origin/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/origin/tags","blobs_url":"https://api.github.com/repos/openshift/origin/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/origin/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/origin/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/origin/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/origin/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/origin/languages","stargazers_url":"https://api.github.com/repos/openshift/origin/stargazers","contributors_url":"https://api.github.com/repos/openshift/origin/contributors","subscribers_url":"https://api.github.com/repos/openshift/origin/subscribers","subscription_url":"https://api.github.com/repos/openshift/origin/subscription","commits_url":"https://api.github.com/repos/openshift/origin/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/origin/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/origin/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/origin/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/origin/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/origin/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/origin/merges","archive_url":"https://api.github.com/repos/openshift/origin/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/origin/downloads","issues_url":"https://api.github.com/repos/openshift/origin/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/origin/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/origin/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/origin/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/origin/labels{/name}","releases_url":"https://api.github.com/repos/openshift/origin/releases{/id}","deployments_url":"https://api.github.com/repos/openshift/origin/deployments","created_at":"2014-07-30T20:04:05Z","updated_at":"2016-08-11T15:25:59Z","pushed_at":"2016-08-11T15:30:07Z","git_url":"git://github.com/openshift/origin.git","ssh_url":"git@github.com:openshift/origin.git","clone_url":"https://github.com/openshift/origin.git","svn_url":"https://github.com/openshift/origin","homepage":"http://www.openshift.org","size":561179,"stargazers_count":1583,"watchers_count":1583,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":971,"mirror_url":null,"open_issues_count":1086,"forks":971,"open_issues":1086,"watchers":1583,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/origin/pulls/10358"},"html":{"href":"https://github.com/openshift/origin/pull/10358"},"issue":{"href":"https://api.github.com/repos/openshift/origin/issues/10358"},"comments":{"href":"https://api.github.com/repos/openshift/origin/issues/10358/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/origin/pulls/10358/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/origin/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/origin/pulls/10358/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/origin/statuses/2dab6c5be71b60206fc6afad74c7b6f9b23c3d38"}}}}
{"actor":{"display_login":"smarterclayton"}}