Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 2092567

Summary: Network policy is not being applied as expected
Product: OpenShift Container Platform Reporter: Mohit Sheth <msheth>
Component: NetworkingAssignee: Surya Seetharaman <surya>
Networking sub component: ovn-kubernetes QA Contact: Anurag saxena <anusaxen>
Status: CLOSED ERRATA Docs Contact:
Severity: medium    
Priority: medium CC: anbhat, andbartl, philipp.dallig, smalleni
Version: 4.11   
Target Milestone: ---   
Target Release: 4.13.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: perfscale-ovn
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-17 22:46:53 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mohit Sheth 2022-06-01 19:59:56 UTC 
Description of problem:
Pods accept ingress traffic when there is a deny all policy.

In this scenario we have multiple pods in a namespace. 
Each pod should have 2 labels, where each label is shared by 1-5 other pods
Add a “deny-all” policy to each Namespace
For each unique label in each Namespace, create a NetworkPolicy with that label as the podSelector, allowing traffic from pods with some other randomly-selected label.

For ex: pod nginx-4-1-1 with labels "label1: foo-4 and label2: bar-4" should only accept traffic from pods with labels label1: foo-2 OR label2: bar-5. Is was observed that it also accepts traffic from pods with labels  "label1: foo-4 and label2: bar-4".

Version-Release number of selected component (if applicable):
4.11.0-0.nightly-2022-05-25-193227

How reproducible:
Always

Steps to Reproduce:
1. Described in description


Actual results:
The curls to pods with deny-all policy should fail/timeout

Expected results:
The curls succeeds for some pods

Additional info:
Comment 4 Surya Seetharaman 2022-11-16 08:21:52 UTC 
Upstream fix has merged, downstream merge has been opened.
Comment 12 errata-xmlrpc 2023-05-17 22:46:53 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: OpenShift Container Platform 4.13.0 security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:1326