GA network policy does not reject if there is not a single source pod matching a policy

[lorenz]

Version: c85e02a (current master)

How to reproduce:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
spec:
  podSelector:
    matchLabels:
      np-test: protected
  ingress:
    - from:
      - podSelector:
          matchLabels:
            np-test: allowed
      ports:
      - protocol: TCP
        port: 80

1. Run a pod (like nginx) with np-test: protected
2. Run a pod (something like busybox:musl) with np-test: allowed which which can successfully access the server
3. Run a pod without any labels which cannot access the server
4. Remove the np-test: allowed pod
5. Now the unlabeled pod can access the server

In iptables it seems like the issue is that on the network policy chain the source filter is dropped when there are no sources which fails open and not closed.

[bzub]

Thanks for the very detailed bug report! We're looking into it now.

[bzub]

I'm also seeing behavior where networkpolicy does not get enforced until a pod that matches ingress whitelist rules is created/labeled. It seems that perhaps this is the root issue, policy enforcement depends on a whitelist match resource existing first.

Here's a script that expects the networkpolicy manifest @lorenz posted, tests various scenarios, shows errors when expected behavior is not seen, and logs iptables and ipset between each test stage: https://gist.github.com/bzub/7d7f3f1704b2b7e04819c4b5232de8fb#file-np-test-sh

I've put the output of one run here: https://gist.github.com/bzub/7d7f3f1704b2b7e04819c4b5232de8fb#file-00-results-output-txt

and the detailed iptables/ipset logs are attached to this ticket here:
np-test-logs.tar.gz

[lorenz]

Confirmed working with the mentioned merge, thanks!

[murali-reddy]

Thanks @lorenz for confirming.