Allow comments in security group specifications

[sdqali]

As security group specifications become fine grained, the specification file becomes harder to understand without any comments to show the intend of each rule.

For example, the security group applied on one of my spaces look like this:

[
  {"protocol":"tcp","destination":"<ip-foo>","ports":"3306"},
  {"protocol":"tcp","destination":"<some-ip>-<another-ip>","ports":"55882"},
  {"protocol":"tcp","destination":"<ip-bar>","ports":"443"}
]

There is no easy way to understand the intend behind each rule.

Allowing a comment field will greatly improve this. Like so:

[
  {"protocol":"tcp","destination":"<ip-foo>","ports":"3306", "comment": "Allow database connection to PostgreSQL at hosted-postgres-service.com"},
  {"protocol":"tcp","destination":"<some-ip>-<another-ip>","ports":"55882", "comment": "Allow logging to hosted-logging-service.com"},
  {"protocol":"tcp","destination":"<ip-bar>","ports":"443", "comment": "Allow monitoring service at hosted-monitoring-service.com"}
]

As things stand, if I were to attempt this, I will get the following error:

Server error, status code: 400, error code: 300001, message: The security group is invalid: rules rule number 1 contains the invalid field 'comment', rules rule number 2 contains the invalid field 'comment', rules rule number 3 contains the invalid field 'comment'

This is as intended.

The comment field should be marked as a valid field.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/95123330.

[zaksoup]

Hi @sdqali That seems like a good idea. I've asked our PM to prioritize a story in our backlog to get this feature done. We'd also be happy to merge in any pull request with this functionality!

Thanks!

Zak, CF Runtime Team

[sdqali]

Thank you, @zaksoup. I have a patch I will push shortly.

[sdqali]

Just noticed that I need to sign the CLA. Running it past my employer. :-)

[jpalermo]

Hi @sdqali,
Another option is to keep comments in your manifest.

This is still valid yaml, so it shouldn't cause any problems.

[
  # Allow database connection to PostgreSQL at hosted-postgres-service.com
  {"protocol":"tcp","destination":"<ip-foo>","ports":"3306"},
  # Allow logging to hosted-logging-service.com
  {"protocol":"tcp","destination":"<some-ip>-<another-ip>","ports":"55882"},
  # Allow monitoring service at hosted-monitoring-service.com
  {"protocol":"tcp","destination":"<ip-bar>","ports":"443"}
]

[zaksoup]

Hi @sdqali
Just wanted to follow up about the patch you said you might have?

[utako]

Hi @sdqali,

We have added this as a story. Let us know if you have that patch and submit a PR; otherwise, the feature will be completed eventually.

Thanks for bringing this to our attention,
@Quintaminant and @utako, CF CAPI Team