We want to disable ICMP on both worker and master nodes. While installing and configuring the Ingress Node Firewall Operator, we noticed that when creating the IngressNodeFirewallConfig (INFC) resource to get the DaemonSet pods running based on the nodeSelector, we can configure it for either master nodes or worker nodes, but not both at the same time. 
If we try to include both roles or create a separate INFC with a different name, it doesn’t work. If we keep either of it only then it works fine. There is no mention of it in the documentation.  

Step 1: Install the Ingress Node Firewall Operator

Step 2: Annotate the target namespace to allow privileged workloads
"oc annotate ns/openshift-ingress-node-firewall workload.openshift.io/allowed=management" 

Step 3: Created the IngressNodeFirewallConfig object. This configures the daemonset on selected nodes via a nodeSelector.

~~~
apiVersion: ingressnodefirewall.openshift.io/v1alpha1
kind: IngressNodeFirewallConfig
metadata:
  name: ingressnodefirewallconfig
  namespace: openshift-ingress-node-firewall
spec:
  nodeSelector:
    node-role.kubernetes.io/worker: ""
~~~

After applying this, the operator successfully deployed firewall pods to all worker nodes:
~~~
$ oc get pods -n openshift-ingress-node-firewall
NAME                                                        READY   STATUS    RESTARTS   AGE
ingress-node-firewall-controller-manager-6b8dcb8bc5-ghxqd   2/2     Running   0          27m
ingress-node-firewall-daemon-8mnmg                          3/3     Running   0          4s
ingress-node-firewall-daemon-cqsxz                          3/3     Running   0          4s
ingress-node-firewall-daemon-h8sd6                          3/3     Running   0          4s
~~~

Now tried creating INFC for both master and workers which doesn't work.
~~~
apiVersion: ingressnodefirewall.openshift.io/v1alpha1
kind: IngressNodeFirewallConfig
metadata:
  name: ingressnodefirewallconfig
  namespace: openshift-ingress-node-firewall
spec:
  nodeSelector:
    node-role.kubernetes.io/worker: ""
    node-role.kubernetes.io/master: ""
~~~  

Even creating a separate INFC with a different name doesn’t work.

    Want to disable ICMP for all the nodes i.e workers and masters both.