Bug 1786300

Summary:	[Kuryr] LB sg update ignored upon NP enforcement
Product:	OpenShift Container Platform	Reporter:	Luis Tomas Bolivar <ltomasbo>
Component:	Networking	Assignee:	Maysa Macedo <mdemaced>
Networking sub component:	kuryr	QA Contact:	GenadiC <gcheresh>
Status:	CLOSED ERRATA	Docs Contact:
Severity:	high
Priority:	medium	CC:	gcheresh, itbrown, juriarte, mdemaced, xtian
Version:	4.3.0
Target Milestone:	---
Target Release:	4.3.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1786299	Environment:
Last Closed:	2020-01-23 11:19:28 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1786299
Bug Blocks:

Description Luis Tomas Bolivar 2019-12-24 09:49:32 UTC

+++ This bug was initially created as a clone of Bug #1786299 +++

If a Network Policy is enforced, while a load balancer is finalizing the creation, the endpoints could be not yet annotated with the load balancer state and the update of the lb security group is ignored causing a security breach.

Comment 2 Itzik Brown 2020-01-05 08:45:17 UTC

Hi,
Please add information about how to verify.

Comment 3 Maysa Macedo 2020-01-06 00:44:04 UTC

Hi Itzik,

The fix can be validated by verifying that the Upstream Network Policy test "should support a 'default-deny' policy [Feature:NetworkPolicy-01]" is green.

Comment 4 Luis Tomas Bolivar 2020-01-07 07:39:03 UTC

Cleaning up needinfo as Maysa already pointed out how to verify it

Comment 5 Jon Uriarte 2020-01-07 16:49:38 UTC

Verified in 4.3.0-0.nightly-2020-01-06-185654 build on top of OSP 13 2019-12-06.2 puddle.

The OCP installer finishes successfully:

 $ oc get clusterversion
 NAME      VERSION                             AVAILABLE   PROGRESSING   SINCE   STATUS
 version   4.3.0-0.nightly-2020-01-06-185654   True        False         175m    Cluster version is 4.3.0-0.nightly-2020-01-06-185654

And "should support a 'default-deny' policy [Feature:NetworkPolicy-01]" test case from upstream K8s NP tests passed two times:

•{"msg":"PASSED [sig-network] NetworkPolicy [LinuxOnly] NetworkPolicy between server and client should support a 'default-deny' policy [Feature:NetworkPolicy-01]","total":1,"completed":1,"skipped":2331,"failed":0}
10:49:32.171: INFO: Running AfterSuite actions on all nodes
Jan  7 10:49:32.171: INFO: Running AfterSuite actions on node 1
{"msg":"Test Suite completed","total":1,"completed":1,"skipped":4839,"failed":0}

Ran 1 of 4840 Specs in 224.777 seconds
SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 4839 Skipped
PASS

Comment 7 errata-xmlrpc 2020-01-23 11:19:28 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:0062