Single firewall rule add/remove

Target component

• CLI
• SDK
• Something else
• Not sure

Overview

In the API, the firewall rules are an all or nothing payload. This is to allow for avoiding the dueling administrators problem and also to make it so if someone wants to transform the set of rules, they don't have to figure out a series of steps that leave things accidentally open (imagine adding an allow and deny rule in the wrong order).

However, as a human trying to consume this, this is a bit easy to screw up. Because you end up writing a replacement for the whole set on the CLI, you end up usually forgetting something and end up removing your allow-ssh rule or similar as an accidental side effect.

While we don't have conditional PUTs in the API yet, it'd be nice if there was a form that basically did the read/modify/write for you. That is, if we said add rule x, the CLI and/or SDK would do a GET, add it to the json blob, and then do a PUT (in the future with an etag).

Implementation details

No response

Anything else you would like to add?

I'm not sure if this should just be a think in the CLI or also an operation in the SDK.

Start with the CLI firewall-rule command and the GET/PUT API flow described in the issue. Clarify whether the change belongs in the CLI, SDK, or both, then define completion as safely adding or removing one rule without unintentionally replacing the other existing rules.