Description of problem: We've noticed that in the gate: 2020-08-11 14:35:22.855 1 ERROR kuryr_kubernetes.handlers.logging [-] Failed to handle event {'type': 'MODIFIED', 'object': {'kind': 'NetworkPolicy', 'apiVersion': 'networking.k8s.io/v1', 'metadata': {'name': 'allow-client-a-via-named-port-egress-rule', 'namespace': 'network-policy-7835', 'selfLink': '/apis/networking.k8s.io/v1/namespaces/network-policy-7835/networkpolicies/allow-client-a-via-named-port-egress-rule', 'uid': '0d42d08d-a40a-42c5-be9c-0394aa7a435c', 'resourceVersion': '11244', 'generation': 1, 'creationTimestamp': '2020-08-11T14:32:40Z', 'annotations': {'openstack.org/kuryr-counter': 'e7635eba-7596-4d4e-a59e-5d6a0986dec2'}, 'finalizers': ['kuryr.openstack.org/networkpolicy-finalizer']}, 'spec': {'podSelector': {'matchLabels': {'pod-name': 'client-a'}}, 'egress': [{'ports': [{'protocol': 'TCP', 'port': 'serve-80'}, {'protocol': 'UDP', 'port': 53}]}], 'policyTypes': ['Ingress', 'Egress']}}}: kuryr_kubernetes.exceptions.K8sClientException: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"KuryrNetworkPolicy.openstack.org \"allow-client-a-via-named-port-egress-rule\" is invalid: spec.egressSgRules.affectedPods.podIP: Invalid value: \"null\": spec.egressSgRules.affectedPods.podIP in body must be of type string: \"null\"","reason":"Invalid","details":{"name":"allow-client-a-via-named-port-egress-rule","group":"openstack.org","kind":"KuryrNetworkPolicy","causes":[{"reason":"FieldValueInvalid","message":"Invalid value: \"null\": spec.egressSgRules.affectedPods.podIP in body must be of type string: \"null\"","field":"spec.egressSgRules.affectedPods.podIP"}]},"code":422} Basically this seems to be possible to happen when when pods are getting created and have no IP yet. We shouldn't care about those pods. Version-Release number of selected component (if applicable): How reproducible: Quite random. Steps to Reproduce: Running NP e2e tests and confirming that above isn't showing up in kuryr-controller logs should be sufficient. Actual results: Expected results: Additional info:
Verified on 4.6.0-0.nightly-2020-09-05-015624 over RHOS-16.1-RHEL-8-20200831.n.1 with OVN-Octavia. NP tests run without restarts and all passed. # Kuryr pods before running NP tests - ANSIBLE MANAGED BLOCK NAME READY STATUS RESTARTS AGE kuryr-cni-2zrkf 1/1 Running 1 32m kuryr-cni-59clz 1/1 Running 0 55m kuryr-cni-jt5bp 1/1 Running 0 32m kuryr-cni-kd765 1/1 Running 0 55m kuryr-cni-n97d5 1/1 Running 1 33m kuryr-cni-tzb4s 1/1 Running 0 55m kuryr-controller-7b6cdb86dd-wpx2x 1/1 Running 1 55m # END ANSIBLE MANAGED BLOCK # Kuryr pods after running NP tests - ANSIBLE MANAGED BLOCK NAME READY STATUS RESTARTS AGE kuryr-cni-2zrkf 1/1 Running 1 130m kuryr-cni-59clz 1/1 Running 0 153m kuryr-cni-jt5bp 1/1 Running 0 130m kuryr-cni-kd765 1/1 Running 0 153m kuryr-cni-n97d5 1/1 Running 1 132m kuryr-cni-tzb4s 1/1 Running 0 153m kuryr-controller-7b6cdb86dd-wpx2x 1/1 Running 1 153m # END ANSIBLE MANAGED BLOCK The mentioned exception is not observed. $ oc logs -n openshift-kuryr kuryr-controller-7b6cdb86dd-wpx2x | grep 'in body must be of type string' $ oc logs -n openshift-kuryr kuryr-controller-7b6cdb86dd-wpx2x -p | grep 'in body must be of type string' $ NP test results attached. Ref: https://rhos-ci-staging-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/job/DFG-osasinfra-shiftstack_on_vms-ocp_verification-osp16.1-ocp4.5/22//artifact/np_test_results/
Created attachment 1713972 [details] NP results
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:4196