Bug 1890436 - [sig-network] NetworkPolicy [LinuxOnly] NetworkPolicy between server and client should deny ingress access to updated pod [Feature:NetworkPolicy]
Summary: [sig-network] NetworkPolicy [LinuxOnly] NetworkPolicy between server and clie...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.5
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
: ---
Assignee: Mohamed Mahmoud
QA Contact: zhaozhanqi
URL:
Whiteboard:
: 1890440 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-10-22 08:22 UTC by Miheer Salunke
Modified: 2021-05-12 19:40 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
[sig-network] NetworkPolicy [LinuxOnly] NetworkPolicy between server and client should deny ingress access to updated pod [Feature:NetworkPolicy]
Last Closed: 2021-05-12 19:40:15 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github kubernetes kubernetes pull 96476 0 None open Add retry to failed network policy tests 2021-02-15 16:10:46 UTC

Comment 3 Victor Pickard 2020-11-04 15:54:49 UTC 
*** Bug 1890440 has been marked as a duplicate of this bug. ***
Comment 4 Victor Pickard 2020-11-19 15:07:56 UTC 
I've added retry logic to the k8s E2E network policy tests to allow time for the policy flows to be installed. 

When running these tests in openshift on gcp platform, I can see an occasional retry on one of more of the tests. Out of 4-6 runs, I see 1 retry on 1-2 tests sometimes, and the test passes on the 1st retry.

There is a KEP in review from Dan Winship that aims to add a status object to the Network Policy. This KEP will take some time to be reviewed, approved, and implemented. Once that is done, the k8s network policy tests can be enhanced to check the net policy status before validating the policy is working as intended. 

The retry in this PR will suffice as a work around until the KEP is implemented and E2E tests updated.
Comment 5 Ben Parees 2020-12-21 16:54:27 UTC 
Still a relatively common failure being seen in 4.7 (1% of all failed jobs)
Comment 6 Victor Pickard 2021-02-03 17:32:45 UTC 
The upstream e2e tests for network policy have been rewritten, the PR linked is obsolete since it was not merged before the new tests went in to k8s.
Note You need to log in before you can comment on or make changes to this bug.