Bug 1752220

Description of problem: A network policy using both podSelector and NamespaceSelector is configured in a project. Ingress rules are created to match project and pod labels both which works fine. When another project label was overwritten to match networkpolicy, it didn't work.


Version-Release number of selected component (if applicable):4.2.0-0.nightly-2019-09-11-202233


How reproducible:Always


Steps to Reproduce:
1.Create 3 projects z1,z2 and z3
# oc label namespace z2 team=operations
# oc label namespace z3 team=openshift

2. Create pods in each project

3. Apply networkpolicy defined in "Additional Info" to project z1

4. create pods in all 3 projects which will have test-pods as labels 
#oc create -f https://raw.githubusercontent.com/openshift-qe/v3-testfiles/master/networking/list_for_pods.json

5. Try to access pod in z1 from project z3. Should fail
# oc rsh -n z3 pod
$ ping $z1_pod_ip

6. Label the project z3 to match networkpolicy in defined in "Additional info"
# oc label namespace z3 team=operations --overwrite

7. Try to access pod in project z1 from project z3. Should pass
# oc rsh -n z3 pod
$ ping $z1_pod_ip

8. Egress rule also fails but guess egress is not supported in OVN yet. Pls confirm

Actual results: Step 7 fails


Expected results:Step 7 should pass


Additional info:

kind: NetworkPolicy
apiVersion: extensions/v1beta1
metadata:
  name: namespace-pod-selector
spec:
  podSelector:
    matchLabels:
      name: test-pods
  policyTypes:
  - Ingress
  - Egress
  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            team: operations
        podSelector:
          matchLabels:
            name: test-pods
  egress:
    - to:
      - namespaceSelector:
          matchLabels:
            team: openshift
        podSelector:
          matchLabels:
            name: hello-pod