Bug 1757560 - Wrongly try to enforce Network Policies on SVCs without selectors and ports
Summary: Wrongly try to enforce Network Policies on SVCs without selectors and ports
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.2.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.2.z
Assignee: Maysa Macedo
QA Contact: Jon Uriarte
URL:
Whiteboard:
Depends On: 1756981
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-10-01 19:41 UTC by Ben Bennett
Modified: 2019-10-30 04:45 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1756981
Environment:
Last Closed: 2019-10-30 04:44:56 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Github openshift kuryr-kubernetes pull 45 0 None None None 2019-10-18 08:08:06 UTC
Red Hat Product Errata RHBA-2019:3151 0 None None None 2019-10-30 04:45:07 UTC

Description Ben Bennett 2019-10-01 19:41:33 UTC 
+++ This bug was initially created as a clone of Bug #1756981 +++

Description of problem:

When a Network Policy is enforced, an update of the SG of a LBaaS affected by the Network Policy is triggered. However, when checking if the k8s service should be affected by the Network Policy, services without selector are also taken into account and they shouldn't as Kuryr does not wires them.
Also it's assumed that the ports field will be always defined in the service specification and this might not always happen.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Run the Kubernetes Upstream Network Policy e2e test: "should enforce updated policy"
2.
3.

Actual results:


Expected results:


Additional info:

--- Additional comment from Ben Bennett on 2019-09-30 08:31:39 EDT ---

If this needs to be fixed in 4.2, then please clone this bug and set it to 4.2.z.  I don't think this is a release blocker.

--- Additional comment from Ben Bennett on 2019-10-01 15:40:39 EDT ---

Feels too late for 4.2.0. Let's fix this in 4.2.1.
Comment 4 Jon Uriarte 2019-10-25 13:33:46 UTC 
Verified on OCP 4.2.0-0.nightly-2019-10-25-021846 build on top of OSP 13 2019-10-01.1 puddle.

release image: registry.svc.ci.openshift.org/ocp/release@sha256:8f97aa21e1c0b2815ec7c86e4138362940a5dcbc292840ab4d6d5b67fedb173f

K8s NP (test/e2e/network/network_policy.go) tests passed.
Comment 6 errata-xmlrpc 2019-10-30 04:44:56 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:3151
Note You need to log in before you can comment on or make changes to this bug.