Bug 1752220 - [OVN] Network Policy fails to work when project label gets overwritten
Summary: [OVN] Network Policy fails to work when project label gets overwritten
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.2.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.7.0
Assignee: Jacob Tanenbaum
QA Contact: Anurag saxena
URL:
Whiteboard:
Depends On:
Blocks: 1908803
TreeView+ depends on / blocked
 
Reported: 2019-09-14 19:06 UTC by Anurag saxena
Modified: 2021-02-24 15:11 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1908803 (view as bug list)
Environment:
Last Closed: 2021-02-24 15:10:48 UTC
Target Upstream Version:
Embargoed:
anusaxen: needinfo-


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift ovn-kubernetes pull 357 0 None closed Bug 1887456: 11-20-2020 merge 2021-02-11 19:27:58 UTC
Github ovn-org ovn-kubernetes pull 1850 0 None closed fix network policy when the namespace label changes 2021-02-11 19:27:58 UTC
Github ovn-org ovn-kubernetes pull 972 0 None closed Correct networkpolicy operation when using pod and namespace selector 2021-02-11 19:27:58 UTC
Red Hat Product Errata RHSA-2020:5633 0 None None None 2021-02-24 15:11:52 UTC

Description Anurag saxena 2019-09-14 19:06:57 UTC
Description of problem: A network policy using both podSelector and NamespaceSelector is configured in a project. Ingress rules are created to match project and pod labels both which works fine. When another project label was overwritten to match networkpolicy, it didn't work.


Version-Release number of selected component (if applicable):4.2.0-0.nightly-2019-09-11-202233


How reproducible:Always


Steps to Reproduce:
1.Create 3 projects z1,z2 and z3
# oc label namespace z2 team=operations
# oc label namespace z3 team=openshift

2. Create pods in each project

3. Apply networkpolicy defined in "Additional Info" to project z1

4. create pods in all 3 projects which will have test-pods as labels 
#oc create -f https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/networking/list_for_pods.json

5. Try to access pod in z1 from project z3. Should fail
# oc rsh -n z3 pod
$ ping $z1_pod_ip

6. Label the project z3 to match networkpolicy in defined in "Additional info"
# oc label namespace z3 team=operations --overwrite

7. Try to access pod in project z1 from project z3. Should pass
# oc rsh -n z3 pod
$ ping $z1_pod_ip

8. Egress rule also fails but guess egress is not supported in OVN yet. Pls confirm

Actual results: Step 7 fails


Expected results:Step 7 should pass


Additional info:

kind: NetworkPolicy
apiVersion: extensions/v1beta1
metadata:
  name: namespace-pod-selector
spec:
  podSelector:
    matchLabels:
      name: test-pods
  policyTypes:
  - Ingress
  - Egress
  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            team: operations
        podSelector:
          matchLabels:
            name: test-pods
  egress:
    - to:
      - namespaceSelector:
          matchLabels:
            team: openshift
        podSelector:
          matchLabels:
            name: hello-pod

Comment 1 Dan Winship 2019-09-14 19:41:37 UTC
> 8. Egress rule also fails but guess egress is not supported in OVN yet. Pls confirm

Egress rules (and CIDR rules) *should* work in ovn-kubernetes.

Comment 2 Jacob Tanenbaum 2019-12-04 15:23:10 UTC
Could you please retest I tested with 4.3.0-0.ci-2019-11-22-122829 and did not see this issue.

Comment 5 Ben Bennett 2020-05-20 15:49:06 UTC
What's the status of this?

Comment 6 Jacob Tanenbaum 2020-05-26 10:57:22 UTC
This is delayed based on an upcoming redesign of the network policy code. Once the code redesign gets created and merged I will make sure that this bug is fixed or fix it.

Comment 11 Anurag saxena 2020-12-01 21:53:13 UTC
Thanks @jtanenba for fixing it. It seems good on 4.7.0-0.nightly-2020-11-30-133734 as per steps followed from testcase OCP-21866 linked in this bug.
Ready for backport to earlier releases now :)

Comment 14 errata-xmlrpc 2021-02-24 15:10:48 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.0 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:5633


Note You need to log in before you can comment on or make changes to this bug.