Pods unexpectedly stop calling service IP hosted in same namespace when using Network Policy
Issue
-
Issue observed that in a namespace with
Network Policy
rules enabled, having a policy forallow-from-same namespace
, pods will have different behaviors when callingservice IPs
hosted in the same namespace.- For Instance:
Deployment1
with twopods
(A/B)
exists in one namespace.
Deployment2
with 1 pod hosting a service and route exists in the same namespace
Pod A
will unexpectedly stop being able to callservice IP
ofdeployment2
;Pod
B will never lose access to calling service IP ofdeployment2
.
- For Instance:
-
Pods intermittently fail to reach internal service addresses, but are able to be interacted with otherwise, and can reach upstream/external addresses including routes on the cluster.
Environment
-
Red Hat OpenShift Container Platform (RHOCP)
- 4
-
OVN-Kubernetes
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.