Bug 2000186 - NetworkPolicy: allow from hostnetwork policy and allow from router (policy-group.network.openshift.io/ingress: "") does not work for network plugin openshiftSDN
Summary: NetworkPolicy: allow from hostnetwork policy and allow from router (policy-gr...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 4.7
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
: 4.9.0
Assignee: Aniket Bhat
QA Contact: zhaozhanqi
URL:
Whiteboard:
Depends On:
Blocks: 2005486
TreeView+ depends on / blocked
 
Reported: 2021-09-01 14:27 UTC by Arti Sood
Modified: 2021-10-18 17:51 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2005486 (view as bug list)
Environment:
Last Closed: 2021-10-18 17:50:51 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3759 0 None None None 2021-10-18 17:51:03 UTC

Description Arti Sood 2021-09-01 14:27:51 UTC
Description of problem:
Allow from hostnetwork policy should allow traffic to pods in a namespace from pods on host network. Currently such a policy works if network plugin in OVN but it does not work on SDN.

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. Create a project and create replicaset
oc create -f https://raw.githubusercontent.com/openshift/verification-tests/master/testdata/networking/list_for_pods.json

2. Create a default deny policy
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: default-deny
spec:
  podSelector: {}

3.Create allow from hostnetwork policy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-hostnetwork
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          policy-group.network.openshift.io/host-network: ""
  podSelector: {}
  policyTypes:
  - Ingress

4. rsh into multus on one of the master and curl IP address of the pod in the step #1 with its port

Actual results:
Do not get 200 OK response to curl request.

Expected results:
Expected to get 200 OK response to curl request.

Additional info:

http://ci-qe-openshift.usersys.redhat.com/userContent/cucushift/v3/2021/08/27/22:16:18/Check_allow_from_router_and_allow_from_hostnetwork_policy_are_functional_post_upgrade_-_prepare/console.html

Comment 2 Alexander Constantinescu 2021-09-06 15:18:27 UTC
I believe the feature is not supported for openshift-sdn. Aniket would know best, since he implemented the feature.

Comment 8 errata-xmlrpc 2021-10-18 17:50:51 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: OpenShift Container Platform 4.9.0 bug fix and security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:3759


Note You need to log in before you can comment on or make changes to this bug.