private static Set<TrustedNode> trustedNodesForChildrenMatching(Node node, NodeList allNodes, Predicate<Node> childNodeSelector,
                                                                    Set<Integer> ports, IP.Space ipSpace) {
        if (node.type().isHost())
            throw new IllegalArgumentException("Host nodes cannot have NAT parents");

        boolean hasIp4 = node.ipConfig().primary().stream().anyMatch(IP::isV4);
        boolean hasIp6 = node.ipConfig().primary().stream().anyMatch(IP::isV6);
        return allNodes.stream()
                       .filter(n -> !n.type().isHost())
                       .filter(childNodeSelector)
                       .mapMulti((Node otherNode, Consumer<TrustedNode> consumer) -> {
                           consumer.accept(TrustedNode.of(otherNode, ports, ipSpace));

                           // And parent host if traffic from otherNode may be NATed
                           if (hasIp4 && otherNode.ipConfig().primary().stream().noneMatch(IP::isV4) ||
                               hasIp6 && otherNode.ipConfig().primary().stream().noneMatch(IP::isV6)) {
                               consumer.accept(TrustedNode.of(allNodes.parentOf(otherNode).orElseThrow(), ports, ipSpace));
                           }
                       })
                       .collect(Collectors.toSet());
    }
Returns the set of children matching the selector, and their parent host if traffic from child may be NATed
node-repository/src/main/java/com/yahoo/vespa/hosted/provision/node/NodeAcl.java