Bug 1421091 - [networkpolicy] Add both allow-to and allow-from policies to a single project will make the project works as flat network
Summary: [networkpolicy] Add both allow-to and allow-from policies to a single project...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 3.5.0
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
: ---
Assignee: Dan Winship
QA Contact: Meng Bo
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-02-10 10:23 UTC by Meng Bo
Modified: 2017-07-24 14:11 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
undefined
Clone Of:
Environment:
Last Closed: 2017-04-12 19:12:23 UTC
Target Upstream Version:


Attachments (Terms of Use)
openflow_rule (9.25 KB, text/plain)
2017-02-10 10:23 UTC, Meng Bo
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Origin (Github) 12972 0 None None None 2017-02-15 16:23:34 UTC
Red Hat Product Errata RHBA-2017:0884 0 normal SHIPPED_LIVE Red Hat OpenShift Container Platform 3.5 RPM Release Advisory 2017-04-12 22:50:07 UTC

Description Meng Bo 2017-02-10 10:23:35 UTC
Created attachment 1249013 [details]
openflow_rule

Description of problem:
Apply both allow-to and allow-from policies to a single project, it will make the pods in the project accept all the traffics.

Version-Release number of selected component (if applicable):
oc v3.5.0.18+9a5d1aa
kubernetes v1.5.2+43a9be4
ovs 2.5.0

How reproducible:
always

Steps to Reproduce:
1. Setup multinode env with openshift-ovs-networkpolicy plugin

2. Create two projects with pod

3. Add the annotation to project 1
# oc annotate namespace u1p1 net.beta.kubernetes.io/network-policy='{"ingress":{"isolation":"DefaultDeny"}}'

4. Apply the allow-to and allow-from policy to the project separately.
# oc get networkpolicy -n u1p1 -o yaml
apiVersion: v1
items:
- apiVersion: extensions/v1beta1 
  kind: NetworkPolicy
  metadata:
    creationTimestamp: 2017-02-10T10:08:06Z
    generation: 1
    name: allow-from-red
    namespace: u1p1
    resourceVersion: "22126"
    selfLink: /apis/extensions/v1beta1/namespaces/u1p1/networkpolicies/allow-from-red
    uid: d1602670-ef78-11e6-b7b7-525400dd3698
  spec:
    ingress:
    - from:
      - podSelector:
          matchLabels:
            type: red
    podSelector: {}
- apiVersion: extensions/v1beta1
  kind: NetworkPolicy
  metadata:
    creationTimestamp: 2017-02-10T10:08:01Z
    generation: 1
    name: allow-to-blue
    namespace: u1p1
    resourceVersion: "22123"
    selfLink: /apis/extensions/v1beta1/namespaces/u1p1/networkpolicies/allow-to-blue
    uid: ce14914f-ef78-11e6-b7b7-525400dd3698
  spec:
    ingress:
    - {}
    podSelector:
      matchLabels:
        type: blue
kind: List
metadata: {}
resourceVersion: ""
selfLink: ""

5. Try to access any pod in the project from inside or outside the project


Actual results:
5. All can access.

Expected results: 
Only the pod with label type=red can be accessed via pod inside the project and pod with label type=blue can be accessed globally.

Additional info:
Full openflow rules attached.

Comment 2 Troy Dawson 2017-02-24 20:48:11 UTC
This has been merged into ocp and is in OCP v3.5.0.34 or newer.

Comment 7 Meng Bo 2017-03-01 06:11:26 UTC
Tested on OCP v3.5.0.35, the issue fixed and all the policies works as expected.

Comment 9 errata-xmlrpc 2017-04-12 19:12:23 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0884


Note You need to log in before you can comment on or make changes to this bug.