Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-67015

Transition Multi-Network Policy away from iptables - fail to deploy MultiNetworkPolicy

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • 4.21
    • Networking / multus
    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • Important
    • None
    • None
    • Rejected
    • CNF Network Sprint 281
    • 1
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem: Running regression QE multi-network-policy test case 
      "Ingress/Egress Allow access only to a specific port/protocol", reportxml.ID("70040") on cluster using nftables in place of iptables. MultNetworkPolicy is not properly being deployed into nftables.
      Version-Release number of selected component (if applicable): 4.21

      How reproducible:

      https://issues.redhat.com/browse/CNF-20500?focusedId=28491386&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-28491386

      Steps to Reproduce:
      1. Deploy image from link
      2. Deploy multinetworkplocy supplied below
      3. Verify on ip netns to see policy

            A. crictl pods

            B. crictl inspectp 3b002f74fa725 | grep "/var/run/netns" | grep path | awk '{print $2}'

            C. ip netns exec 4cbab47d-859e-4ef5-9a6f-608195bf4a63nft list ruleset

      Actual results:

      The multinetworkpolicy was only pushed to the pod on worker0

      Expected results: 

      The multinetworkpolicy will be translated to all pods in the namespace.

      Additional info:

      $ oc get multi-networkpolicies.k8s.cni.cncf.io -A -o yaml
      apiVersion: v1
      items:

      • apiVersion: k8s.cni.cncf.io/v1beta1
          kind: MultiNetworkPolicy
          metadata:
            annotations:
              k8s.v1.cni.cncf.io/policy-for: sriovnetpolicy
            creationTimestamp: "2025-12-08T09:09:45Z"
            generation: 1
            name: verificationpolicy
            namespace: policy-tests
            resourceVersion: "1848110"
            uid: 4d3a59bf-0474-458f-a386-dd3db2d577f4
          spec:
            egress:
            - ports:
              - port: 5001
                protocol: SCTP
              to:
              - ipBlock:
                  cidr: 2001:1db8:85a3::3/128
                podSelector:
                  matchLabels:
                    pod: pod3
            ingress:
            - from:
              - podSelector:
                  matchLabels:
                    pod: pod2
              ports:
              - port: 5001
                protocol: SCTP
            podSelector:
              matchLabels:
                pod: pod1
            policyTypes:
            - Ingress
            - Egress
        kind: List
        metadata:
          resourceVersion: ""

              apanatto@redhat.com Andrea Panattoni
              gkopels@redhat.com Gregory Kopels
              None
              None
              Gregory Kopels Gregory Kopels
              None
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: