-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
4.22
-
None
Description of problem:
CVO should have default deny network policy to protect from unintended dataleaks/attacks from OCP 4.20
Version-Release number of selected component (if applicable):
4.22.0-ec.3
How reproducible:
everytime
Steps to Reproduce:
1.Install a 4.22 latest Cluster
%oc get clusterversionNAME VERSION AVAILABLE PROGRESSING SINCE STATUSversion 4.22.0-ec.3 True False 29m Cluster version is 4.22.0-ec.3
2. list CVO network Policies
Actual results:
%oc get NetworkPolicy -n openshift-cluster-version No resources found in openshift-cluster-version namespace.
Expected results:
% oc get networkpolicy -n openshift-cluster-version
NAME POD-SELECTOR AGE
default-deny <none> 41m
% oc describe networkpolicy default-deny -n openshift-cluster-version
Name: default-deny
Namespace: openshift-cluster-version
Created on: 2025-07-02 21:24:27 +0530 IST
Labels: <none>
Annotations: <none>
Spec:
PodSelector: <none> (Allowing the specific traffic to all pods in this namespace)
Allowing ingress traffic:
<none> (Selected pods are isolated for ingress connectivity)
Allowing egress traffic:
<none> (Selected pods are isolated for egress connectivity)
Policy Types: Ingress, Egress
%
Additional info: