Loading...

XML

Word

Printable

Type: Bug
Resolution: Duplicate
Priority: Undefined
Fix Version/s: None
Affects Version/s: 4.18.0
Component/s: Networking / ovn-kubernetes
Labels:
- SDN:OVNK:UserDefinedNetworks:Primary

Regression:
None
Blocked:
False
Blocked Reason:

Hide

None

Show
None

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

Description of problem:

allow all namespace network policy with "namespaceSelector": { "matchLabels": {"team": "ocp"}} does not works .

Version-Release number of selected component (if applicable):

4.18.0

How reproducible:

Always

Steps to Reproduce:

1. Create two namespaces as follows:- e2e-test-networking-udn-pbkmh and e2e-test-networking-udn-999j4 One of them has a label

oc get ns -l team=ocp

NAME                            STATUS   AGE
e2e-test-networking-udn-999j4   Active   5h17m

2. Create l2 NAD in both.

oc -n e2e-test-networking-udn-pbkmh get network-attachment-definition l2-network-78292 -oyaml

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"k8s.cni.cncf.io/v1","kind":"NetworkAttachmentDefinition","metadata":{"annotations":{},"name":"l2-network-78292","namespace":"e2e-test-networking-udn-pbkmh"},"spec":{"config":"{\n  \"cniVersion\": \"0.3.1\",\n  \"name\": \"l2-network-test\",\n  \"type\": \"ovn-k8s-cni-overlay\",\n  \"topology\":\"layer2\",\n  \"subnets\": \"10.152.0.0/16\",\n  \"mtu\": 1300,\n  \"netAttachDefName\": \"e2e-test-networking-udn-pbkmh/l2-network-78292\",\n  \"role\": \"primary\"\n}\n"}}
  creationTimestamp: "2025-01-20T21:43:39Z"
  generation: 1
  name: l2-network-78292
  namespace: e2e-test-networking-udn-pbkmh
  resourceVersion: "440679"
  uid: 4a633cd5-ddc0-4af8-bc6f-5cf9046e0986
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "l2-network-test",
      "type": "ovn-k8s-cni-overlay",
      "topology":"layer2",
      "subnets": "10.152.0.0/16",
      "mtu": 1300,
      "netAttachDefName": "e2e-test-networking-udn-pbkmh/l2-network-78292",
      "role": "primary"
    }

oc -n e2e-test-networking-udn-999j4 get network-attachment-definition l2-network-78292 -oyaml

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"k8s.cni.cncf.io/v1","kind":"NetworkAttachmentDefinition","metadata":{"annotations":{},"name":"l2-network-78292","namespace":"e2e-test-networking-udn-999j4"},"spec":{"config":"{\n  \"cniVersion\": \"0.3.1\",\n  \"name\": \"l2-network-test\",\n  \"type\": \"ovn-k8s-cni-overlay\",\n  \"topology\":\"layer2\",\n  \"subnets\": \"10.152.0.0/16\",\n  \"mtu\": 1300,\n  \"netAttachDefName\": \"e2e-test-networking-udn-999j4/l2-network-78292\",\n  \"role\": \"primary\"\n}\n"}}
  creationTimestamp: "2025-01-20T21:43:51Z"
  generation: 1
  name: l2-network-78292
  namespace: e2e-test-networking-udn-999j4
  resourceVersion: "440761"
  uid: 158539c5-8ccf-410a-b995-2c502d383fa0
spec:
  config: |
    {
      "cniVersion": "0.3.1",
      "name": "l2-network-test",
      "type": "ovn-k8s-cni-overlay",
      "topology":"layer2",
      "subnets": "10.152.0.0/16",
      "mtu": 1300,
      "netAttachDefName": "e2e-test-networking-udn-999j4/l2-network-78292",
      "role": "primary"
    }

3. Create pods in both namespaces

oc -n e2e-test-networking-udn-pbkmh get pods

NAME                  READY   STATUS    RESTARTS   AGE
hello-pod-78292-2-0   1/1     Running   0          5h18m
hello-pod-78292-2-1   1/1     Running   0          5h18m

oc -n e2e-test-networking-udn-999j4 get pods

NAME                  READY   STATUS    RESTARTS   AGE
hello-pod-78292-3-0   1/1     Running   0          5h19m
hello-pod-78292-3-1   1/1     Running   0          5h19m

oc -n e2e-test-networking-udn-pbkmh exec -it hello-pod-78292-2-0 – ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if104: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1360 qdisc noqueue state UP group default 
    link/ether 0a:58:0a:80:02:5a brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.128.2.90/23 brd 10.128.3.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::858:aff:fe80:25a/64 scope link 
       valid_lft forever preferred_lft forever
3: ovn-udn1@if105: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1300 qdisc noqueue state UP group default 
    link/ether 0a:58:0a:98:00:05 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.152.0.5/16 brd 10.152.255.255 scope global ovn-udn1
       valid_lft forever preferred_lft forever
    inet6 fe80::858:aff:fe98:5/64 scope link 
       valid_lft forever preferred_lft forever

oc -n e2e-test-networking-udn-999j4 exec -it hello-pod-78292-3-0 – ip a

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if106: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1360 qdisc noqueue state UP group default 
    link/ether 0a:58:0a:80:02:5b brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.128.2.91/23 brd 10.128.3.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 fe80::858:aff:fe80:25b/64 scope link 
       valid_lft forever preferred_lft forever
3: ovn-udn1@if107: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1300 qdisc noqueue state UP group default 
    link/ether 0a:58:0a:98:00:0c brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.152.0.12/16 brd 10.152.255.255 scope global ovn-udn1
       valid_lft forever preferred_lft forever
    inet6 fe80::858:aff:fe98:c/64 scope link 
       valid_lft forever preferred_lft forever

4. Create network policies in one of the namespace

oc -n e2e-test-networking-udn-pbkmh get networkpolicy

NAME                        POD-SELECTOR   AGE
allow-from-all-namespaces   <none>         5h13m
allow-from-same-namespace   <none>         5h13m–> Can be omiited
default-deny-ingress        <none>         5h14m

oc -n e2e-test-networking-udn-pbkmh get networkpolicy default-deny-ingress -oyaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  creationTimestamp: "2025-01-20T21:47:39Z"
  generation: 1
  name: default-deny-ingress
  namespace: e2e-test-networking-udn-pbkmh
  resourceVersion: "442337"
  uid: 48397644-ad44-41e2-91f1-3d7a4fb200b9
spec:
  podSelector: {}
  policyTypes:
  - Ingress

oc -n e2e-test-networking-udn-pbkmh get networkpolicy allow-from-all-namespaces -oyaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  creationTimestamp: "2025-01-20T21:49:12Z"
  generation: 2
  name: allow-from-all-namespaces
  namespace: e2e-test-networking-udn-pbkmh
  resourceVersion: "442988"
  uid: 4939ca62-ace0-4c10-b17f-150681195a41
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          team: ocp
    ports:
    - port: 8080
      protocol: TCP
  podSelector: {}
  policyTypes:
  - Ingress

Actual results:

Request from pod in the namespace with label fails.

oc -n e2e-test-networking-udn-999j4 exec -it hello-pod-78292-3-0 – curl -I 10.152.0.5:8080 --connect-timeout 5

curl: (28) Connection timeout after 5001 ms
command terminated with exit code 28

Expected results:

Request from pod in the namespace with label should work.

Additional info:

Please fill in the following template while reporting a bug and provide as much relevant information as possible. Doing so will give us the best chance to find a prompt resolution.

Affected Platforms:

Is it an

internal CI failure
customer issue / SD
internal RedHat testing failure

If it is an internal RedHat testing failure:

Please share a kubeconfig or creds to a live cluster for the assignee to debug/troubleshoot along with reproducer steps (specially if it's a telco use case like ICNI, secondary bridges or BM+kubevirt).

If it is a CI failure:

Did it happen in different CI lanes? If so please provide links to multiple failures with the same error instance
Did it happen in both sdn and ovn jobs? If so please provide links to multiple failures with the same error instance
Did it happen in other platforms (e.g. aws, azure, gcp, baremetal etc) ? If so please provide links to multiple failures with the same error instance
When did the failure start happening? Please provide the UTC timestamp of the networking outage window from a sample failure run
If it's a connectivity issue,
What is the srcNode, srcIP and srcNamespace and srcPodName?
What is the dstNode, dstIP and dstNamespace and dstPodName?
What is the traffic path? (examples: pod2pod? pod2external?, pod2svc? pod2Node? etc)

If it is a customer / SD issue:

Provide enough information in the bug description that Engineering doesn’t need to read the entire case history.
Don’t presume that Engineering has access to Salesforce.
Do presume that Engineering will access attachments through supportshell.
Describe what each relevant attachment is intended to demonstrate (failed pods, log errors, OVS issues, etc).
Referring to the attached must-gather, sosreport or other attachment, please provide the following details:
- If the issue is in a customer namespace then provide a namespace inspect.
- If it is a connectivity issue:
  - What is the srcNode, srcNamespace, srcPodName and srcPodIP?
  - What is the dstNode, dstNamespace, dstPodName and dstPodIP?
  - What is the traffic path? (examples: pod2pod? pod2external?, pod2svc? pod2Node? etc)
  - Please provide the UTC timestamp networking outage window from must-gather
  - Please provide tcpdump pcaps taken during the outage filtered based on the above provided src/dst IPs
- If it is not a connectivity issue:
  - Describe the steps taken so far to analyze the logs from networking components (cluster-network-operator, OVNK, SDN, openvswitch, ovs-configure etc) and the actual component where the issue was seen based on the attached must-gather. Please attach snippets of relevant logs around the window when problem has happened if any.

When showing the results from commands, include the entire command in the output.
For OCPBUGS in which the issue has been identified, label with “sbr-triaged”
For OCPBUGS in which the issue has not been identified and needs Engineering help for root cause, label with “sbr-untriaged”
Do not set the priority, that is owned by Engineering and will be set when the bug is evaluated
Note: bugs that do not meet these minimum standards will be closed with label “SDN-Jira-template”
For guidance on using this template please see
OCPBUGS Template Training for Networking components

Assignee:: Periyasamy Palanisamy

Reporter:: Arti Sood

QA Contact:: Anurag Saxena

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Created:: 2025/01/21 3:49 AM

Updated:: 2025/01/21 5:52 PM

Resolved:: 2025/01/21 5:49 PM

Details

Description

Attachments

Easy Agile Planning Poker

Activity

People

Dates