Verified this bug on 4.7.0-0.nightly-2021-03-11-002149 1. new project and create test podA with oc create -f https://raw.githubusercontent.com/openshift/verification-tests/master/testdata/networking/list_for_pods.json oc get pod -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES hello-pod2pgsv2 1/1 Running 0 9s 10.128.2.41 ip-10-0-171-150.us-east-2.compute.internal <none> <none> test-rc-j4m4t 1/1 Running 0 65s 10.128.2.40 ip-10-0-171-150.us-east-2.compute.internal <none> <none> oc get svc NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE test-service ClusterIP 172.30.146.95 <none> 27017/TCP 89s oc scale rc test-rc --replicas=1 2. Create another podB as client with same node 3. rsh podB and access podA by service ip nc 172.30.146.95 27017 -p 30000 4. open another terminal and sent another request to access podA by pod ip from podB nc 10.128.2.40 8080 -p 30000 5. rsh into sdn pod with same node $ oc rsh -n openshift-sdn sdn-4x279 Defaulting container name to sdn. Use 'oc describe pod/sdn-4x279 -n openshift-sdn' to see all of the containers in this pod. sh-4.4# conntrack -L | grep 10.128.2.40 tcp 6 431892 ESTABLISHED src=10.128.2.41 dst=172.30.146.95 sport=30000 dport=27017 src=10.128.2.40 dst=10.128.2.41 sport=8080 dport=30000 [ASSURED] mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1 tcp 6 431936 ESTABLISHED src=10.128.2.41 dst=10.128.2.40 sport=30000 dport=8080 src=10.128.2.40 dst=10.128.2.41 sport=8080 dport=27611 [ASSURED] mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1 conntrack v1.4.4 (conntrack-tools): 979 flow entries have been shown 6. sent another request to access podA by pod ip from podB but with different port, nc 10.128.2.40 8080 -p 30001 7. Check again in step 5 # conntrack -L | grep 10.128.2.40 tcp 6 431947 ESTABLISHED src=10.128.2.41 dst=172.30.146.95 sport=30000 dport=27017 src=10.128.2.40 dst=10.128.2.41 sport=8080 dport=30000 [ASSURED] mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1 tcp 6 431992 ESTABLISHED src=10.128.2.41 dst=10.128.2.40 sport=30000 dport=8080 src=10.128.2.40 dst=10.128.2.41 sport=8080 dport=27611 [ASSURED] mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1 tcp 6 431995 ESTABLISHED src=10.128.2.41 dst=10.128.2.40 sport=30001 dport=8080 src=10.128.2.40 dst=10.128.2.41 sport=8080 dport=30001 [ASSURED] mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1 conntrack v1.4.4 (conntrack-tools): 968 flow entries have been shown.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.7.3 bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:0821