1938960 – Permissive Egress NetworkPolicy (0.0.0.0/0) is blocking all traffic

Bug 1938960 - Permissive Egress NetworkPolicy (0.0.0.0/0) is blocking all traffic

Summary: Permissive Egress NetworkPolicy (0.0.0.0/0) is blocking all traffic

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	OpenShift Container Platform
Classification:	Red Hat
Component:	Networking
Sub Component:
Version:	4.6.z
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	medium
Target Milestone:	---
Target Release:	4.7.z
Assignee:	Michał Dulko
QA Contact:	Itzik Brown
Docs Contact:
URL:
Whiteboard:
Depends On:	1919398
Blocks:	1940141 1947343 1952429
TreeView+	depends on / blocked

Reported:	2021-03-15 11:04 UTC by OpenShift BugZilla Robot
Modified:	2021-04-22 09:37 UTC (History)
CC List:	11 users (show)
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Clones:	1940141 1952429 (view as bug list)
Environment:
Last Closed:	2021-04-05 13:56:19 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Github	openshift kuryr-kubernetes pull 480	None	open	[release-4.7] Bug 1938960: Do not default protocol to TCP for allow-all NPs	2021-03-15 11:05:03 UTC
Github	openshift kuryr-kubernetes pull 487	None	open	Bug 1938960: Ignore headless services in NP code	2021-03-24 14:17:14 UTC
Red Hat Product Errata	RHSA-2021:1005	None	None	None	2021-04-05 13:56:36 UTC

Comment 4 Itzik Brown 2021-03-24 14:16:01 UTC

Followed the verification steps in https://bugzilla.redhat.com/show_bug.cgi?id=1919398 using 4.7.0-0.nightly-2021-03-22-025559

2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging Traceback (most recent call last):
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/handlers/logging.py", line 37, in __call__
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     self._handler(event, *args, **kwargs)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/handlers/retry.py", line 80, in __call__
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     self._handler(event, *args, **kwargs)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/handlers/k8s_base.py", line 90, in __call__
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     self.on_present(obj)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/handlers/policy.py", line 40, in on_present
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     self._drv_policy.ensure_network_policy(policy)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/network_policy.py", line 52, in ensure_network_policy
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     policy)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/network_policy.py", line 132, in _get_security_group_rules_from_network_policy
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     i_rules, e_rules = self.parse_network_policy_rules(policy)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/network_policy.py", line 633, in parse_network_policy_rules
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     self._parse_sg_rules(egress_sg_rule_body_list, 'egress', policy)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/network_policy.py", line 535, in _parse_sg_rules
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     resource=resource)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/network_policy.py", line 602, in _create_svc_egress_sg_rule
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     cidr=cluster_ip)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/kuryr_kubernetes/controller/drivers/utils.py", line 268, in create_security_group_rule_body
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     if cidr and netaddr.IPNetwork(cidr).version == 6:
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging   File "/usr/lib/python3.6/site-packages/netaddr/ip/__init__.py", line 938, in __init__
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging     raise AddrFormatError('invalid IPNetwork %s' % addr)
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging netaddr.core.AddrFormatError: invalid IPNetwork None
2021-03-24 14:11:12.651 1 ERROR kuryr_kubernetes.handlers.logging

Comment 6 Itzik Brown 2021-03-25 12:57:35 UTC

Verified using the steps in https://bugzilla.redhat.com/show_bug.cgi?id=1919398

OSP16.1 - RHOS-16.1-RHEL-8-20210311.n.1
OCP - 4.7.0-0.nightly-2021-03-25-081137

Comment 10 errata-xmlrpc 2021-04-05 13:56:19 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.7.5 security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:1005

Note You need to log in before you can comment on or make changes to this bug.