Cause: OpenShift's default network plugin has not been updated to implement the new NetworkPolicy features introduced upstream in Kubernetes (policies for controlling egress, and policies based on IP addresses rather than pods or namespaces). Consequence: In 3.9, creating a NetworkPolicy with an "ipBlock" section would cause nodes to crash, and creating a NetworkPolicy that contained only "egress" rules would erroneously cause ingress traffic to be blocked. Fix: The code is now aware of the unsupported NetworkPolicy features (though it does not yet implement them). Result: If a NetworkPolicy contains "ipBlock" rules, those rules are ignored. (This may cause the policy to be treated as "deny all" if the "ipBlock" rule was the only rule in the policy). If a NetworkPolicy contains only "egress" rules, it is ignored completely (and does not affect ingress).