Bug 1938960

Summary: Permissive Egress NetworkPolicy (0.0.0.0/0) is blocking all traffic
Product: OpenShift Container Platform Reporter: OpenShift BugZilla Robot <openshift-bugzilla-robot>
Component: NetworkingAssignee: Michał Dulko <mdulko>
Networking sub component: kuryr QA Contact: Itzik Brown <itbrown>
Status: CLOSED ERRATA Docs Contact:
Severity: medium    
Priority: unspecified CC: amuller, bbennett, chrisw, itbrown, juriarte, ltomasbo, mdulko, mpatercz, ralonsoh, rlobillo, scohen
Version: 4.6.z   
Target Milestone: ---   
Target Release: 4.7.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1940141 1952429 (view as bug list) Environment:
Last Closed: 2021-04-05 13:56:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1919398    
Bug Blocks: 1940141, 1947343, 1952429    

Comment 4 Itzik Brown 2021-03-24 14:16:01 UTC 
Followed the verification steps in https://bugzilla.redhat.com/show_bug.cgi?id=1919398 using 4.7.0-0.nightly-2021-03-22-025559

2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging Traceback (most recent call last):
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/handlers/logging.py", line 37, in __call__
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     self._handler(event, *args, **kwargs)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/handlers/retry.py", line 80, in __call__
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     self._handler(event, *args, **kwargs)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/handlers/k8s_base.py", line 90, in __call__
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     self.on_present(obj)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/handlers/policy.py", line 40, in on_present
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     self._drv_policy.ensure_network_policy(policy)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/network_policy.py", line 52, in ensure_network_policy
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     policy)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/network_policy.py", line 132, in _get_security_group_rules_from_network_policy
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     i_rules, e_rules = self.parse_network_policy_rules(policy)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/network_policy.py", line 633, in parse_network_policy_rules
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     self._parse_sg_rules(egress_sg_rule_body_list, 'egress', policy)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/network_policy.py", line 535, in _parse_sg_rules
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     resource=resource)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/network_policy.py", line 602, in _create_svc_egress_sg_rule
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     cidr=cluster_ip)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/utils.py", line 268, in create_security_group_rule_body
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     if cidr and netaddr.IPNetwork(cidr).version == 6:
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/netaddr/ip/__init__.py", line 938, in __init__
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     raise AddrFormatError('invalid IPNetwork %s' % addr)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging netaddr.core.AddrFormatError: invalid IPNetwork None
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging
Comment 6 Itzik Brown 2021-03-25 12:57:35 UTC 
Verified using the steps in https://bugzilla.redhat.com/show_bug.cgi?id=1919398

OSP16.1 - RHOS-16.1-RHEL-8-20210311.n.1
OCP - 4.7.0-0.nightly-2021-03-25-081137
Comment 10 errata-xmlrpc 2021-04-05 13:56:19 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.5 security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:1005