Bug 1745898 - [OCP][3.11][NetworkingPolicies] Pod to pod communication when using network policies
Summary: [OCP][3.11][NetworkingPolicies] Pod to pod communication when using network p...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 3.11.0
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: ---
: 3.11.z
Assignee: Jacob Tanenbaum
QA Contact: Anurag saxena
URL:
Whiteboard:
Depends On: 1816394
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-08-27 07:43 UTC by Xavier Morano
Modified: 2023-10-06 18:30 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1816388 (view as bug list)
Environment:
Last Closed: 2020-05-28 05:44:13 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift origin pull 24837 0 None closed [release-3.11] Bug 1745898: handle pod updates correctly in networkpolicy 2020-12-07 15:48:13 UTC
Red Hat Product Errata RHBA-2020:2215 0 None None None 2020-05-28 05:44:30 UTC

Description Xavier Morano 2019-08-27 07:43:39 UTC
Description of problem:
Working with Networking Policy as networking plugin, it's not possible to use more than one ingress selector, neither with OR / AND.

Version-Release number of selected component (if applicable):
OCP 3.11.51 / 3.11.104

How reproducible:
Always, with random behavior

Steps to Reproduce:
1. create two level structure : (1) APP, (2) DB
2. create networking policy for DB layer

   Using OR selector
   ...
   spec:
    ingress:
    - from:
      - podSelector:
          matchLabels:
            zone: DB
      - podSelector:
          matchLabels:
            zone: App
    podSelector:
      matchLabels:
        zone: DB
   ...

   or using AND selector
   ...
   spec:
    ingress:
    - from:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              zone: App
   podSelector:
     matchLabels:
       app: DB

 
3. Make a connection from layer (1) App to layer (2) DB

Actual results:
It shows a bit random behavior i.e. Middleware is able to connect to Database sometimes but if we re-deploy the Middleware deployment, it cant connect to Database at first and after some time like 4-5 restarts of container, it is able to connect to Database. 
This is a total random behavior, i.e. sometimes gets connected at once and sometimes takes 5 mins (4-5 restarts), sometimes 10 mins (7-8 restarts).

Expected results:
Connect as usual, at once.

Additional info:
* used different cloud providers: AWS / AZURE / On-Prem.
* used different DB servers: MySQL / Hazelcast

Comment 18 zhaozhanqi 2020-01-09 10:47:21 UTC
Thanks @jonas

hi, Anurag, could you help reproduce this bug if it is regression issue when fixing https://bugzilla.redhat.com/show_bug.cgi?id=1758235

Comment 52 errata-xmlrpc 2020-05-28 05:44:13 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:2215


Note You need to log in before you can comment on or make changes to this bug.