Network: default egress policy Allow for Isolated networks on fresh installations (reopen of #13684)

[andrijapanicsb]

Description

This reopens #13684, which was merged as commit e0f3006764d00f18a59945861b50bf55d01f64eb and then reverted by #14116. The dev@ discussion on whether to change this default is still ongoing, so the change should not have landed on main yet. This PR restores the identical change for continued review (it is a revert of the revert — the diff is byte-for-byte the same as the merged #13684).

Reference:

• Original PR: Network: default egress policy Allow for Isolated networks on fresh installations #13684 (merged e0f3006764)
• Revert: Revert "Network: default egress policy Allow for Isolated networks on fresh installations" #14116 (8afd1148a2)

Background

Isolated guest networks created from the built-in default network offerings (DefaultIsolatedNetworkOfferingWithSourceNatService and DefaultIsolatedNetworkOffering) deny all egress by default, because they are seeded with a NetworkOfferingVO constructor that leaves egressdefaultpolicy at the Java primitive default (false = deny). Meanwhile createNetworkOffering without an explicit egressdefaultpolicy already defaults to allow, and VPC tiers (NetworkACL) allow egress out of the box. So the shipped defaults are inconsistent, and the default "simple Isolated network" is the surprising one — freshly deployed VMs cannot reach package mirrors, NTP, metadata, etc. until an allow-all egress rule is added.

Changes

• ConfigurationServerImpl seeds the two built-in Isolated network offerings with egress default policy Allow, on fresh installations only.
• AddNetworkOffering.vue default flipped from deny to allow, so the UI no longer sends an explicit deny that overrides the createNetworkOffering API default.
• NetworkOfferingVO.setEgressDefaultPolicy setter.
• Unit tests: ConfigurationServerImplTest (seeding) and CreateNetworkOfferingCmdTest (API default).

Backward compatibility

• Existing deployments are untouched. The default offerings are seeded once, at first initialization; upgrades do not re-seed them and persistDefaultNetworkOffering never updates existing rows. No data migration / upgrade SQL runs against existing network_offerings or networks.
• Only fresh installations get allow-by-default; the egressdefaultpolicy parameter and per-offering behaviour are unchanged.
• The egress_default_policy DB column default is intentionally not changed.

The one consideration is security posture on new clouds, which is exactly why there is an open dev@ discussion; this PR exists to keep the change reviewable while that concludes.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• build/CI

How Has This Been Tested?

Change is identical to the previously merged #13684. ConfigurationServerImplTest and CreateNetworkOfferingCmdTest cover the seeded default and the API default respectively.

[andrijapanicsb]

This reopens #13684, which was merged as e0f3006764 and then reverted by #14116. The change here is identical to what was merged.

The default egress policy change is still under discussion on the dev@ mailing list, so this should not be merged until that thread reaches consensus — it shouldn't land on main ahead of the discussion. Reopening it here only so the code stays reviewable in the meantime.

cc @DaanHoogland for visibility.

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 19.95%. Comparing base (1a48a87) to head (a5a937a).

Files with missing lines	Patch %	Lines
...in/java/com/cloud/offerings/NetworkOfferingVO.java	66.66%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #14300      +/-   ##
============================================
+ Coverage     19.91%   19.95%   +0.03%     
- Complexity    20199    20211      +12     
============================================
  Files          6373     6373              
  Lines        577230   577235       +5     
  Branches      70696    70696              
============================================
+ Hits         114950   115177     +227     
+ Misses       449713   449497     -216     
+ Partials      12567    12561       -6     

Flag	Coverage Δ
uitests	3.71% <ø> (ø)
unittests	21.22% <80.00%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[andrijapanicsb]

Thanks @DaanHoogland — ironically 😉 — for both merging and reverting this one, all without a heads-up. Jokes aside, no harm done and thanks for the quick revert. Maybe let's keep the merge button holstered until we're back from the beach next time 😄

On a serious note: I've reopened the identical change as #14300. It should stay parked until the dev@ [DISCUSS] thread concludes — please don't merge ahead of that.

[andrijapanicsb]

For reference, the dev@ discussion thread is here:
https://lists.apache.org/thread/t8kwx2y6yy38comy683v1pk688wxgrlk — [DISCUSS] Default egress policy Allow for Isolated networks on fresh installations

Let's keep this PR parked until that thread reaches consensus.

[Damans227]

this ui default also changes things for existing clouds, since admins making a new offering there now get allow unless they switch it. is that ok given the description says existing setups are untouched?