Description of problem: Pods accept ingress traffic when there is a deny all policy. In this scenario we have multiple pods in a namespace. Each pod should have 2 labels, where each label is shared by 1-5 other pods Add a “deny-all” policy to each Namespace For each unique label in each Namespace, create a NetworkPolicy with that label as the podSelector, allowing traffic from pods with some other randomly-selected label. For ex: pod nginx-4-1-1 with labels "label1: foo-4 and label2: bar-4" should only accept traffic from pods with labels label1: foo-2 OR label2: bar-5. Is was observed that it also accepts traffic from pods with labels "label1: foo-4 and label2: bar-4". Version-Release number of selected component (if applicable): 4.11.0-0.nightly-2022-05-25-193227 How reproducible: Always Steps to Reproduce: 1. Described in description Actual results: The curls to pods with deny-all policy should fail/timeout Expected results: The curls succeeds for some pods Additional info:
Upstream fix has merged, downstream merge has been opened.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: OpenShift Container Platform 4.13.0 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2023:1326