Pods unexpectedly stop calling service IP hosted in same namespace when using Network Policy

Issue

• Issue observed that in a namespace with Network Policy rules enabled, having a policy for allow-from-same namespace, pods will have different behaviors when calling service IPs hosted in the same namespace.

  • For Instance:
    Deployment1 with two pods (A/B) exists in one namespace.
    Deployment2 with 1 pod hosting a service and route exists in the same namespace
    Pod A will unexpectedly stop being able to call service IP of deployment2; Pod B will never lose access to calling service IP of deployment2.

• Pods intermittently fail to reach internal service addresses, but are able to be interacted with otherwise, and can reach upstream/external addresses including routes on the cluster.