{"action":"created","issue":{"url":"https://api.github.com/repos/weaveworks/weave/issues/3025","repository_url":"https://api.github.com/repos/weaveworks/weave","labels_url":"https://api.github.com/repos/weaveworks/weave/issues/3025/labels{/name}","comments_url":"https://api.github.com/repos/weaveworks/weave/issues/3025/comments","events_url":"https://api.github.com/repos/weaveworks/weave/issues/3025/events","html_url":"https://github.com/weaveworks/weave/issues/3025","id":237587148,"number":3025,"title":"Weave verison 1.9.8 does not allow for ingress pod selection in network policy application","user":{"login":"mmerrill3","id":13873803,"avatar_url":"https://avatars0.githubusercontent.com/u/13873803?v=3","gravatar_id":"","url":"https://api.github.com/users/mmerrill3","html_url":"https://github.com/mmerrill3","followers_url":"https://api.github.com/users/mmerrill3/followers","following_url":"https://api.github.com/users/mmerrill3/following{/other_user}","gists_url":"https://api.github.com/users/mmerrill3/gists{/gist_id}","starred_url":"https://api.github.com/users/mmerrill3/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mmerrill3/subscriptions","organizations_url":"https://api.github.com/users/mmerrill3/orgs","repos_url":"https://api.github.com/users/mmerrill3/repos","events_url":"https://api.github.com/users/mmerrill3/events{/privacy}","received_events_url":"https://api.github.com/users/mmerrill3/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2017-06-21T16:06:03Z","updated_at":"2017-06-22T09:08:51Z","closed_at":null,"body":"<!--\r\nHi, thank you for opening an issue!\r\nBefore hitting the button...\r\n\r\n** Is this a REQUEST FOR HELP? **\r\nIf so, please have a look at:\r\n- our FAQ: https://www.weave.works/docs/net/latest/faq/\r\n- our troubleshooting page: https://www.weave.works/docs/net/latest/troubleshooting/\r\n- our help page, to choose the best channel (Slack, etc.) to reach out: https://www.weave.works/help/\r\n\r\n** Is this a FEATURE REQUEST? **\r\nIf so, please search existing feature requests, and if you find a similar one, up-vote it and/or add your comments to it instead.\r\nIf you did not find a similar one, please describe in details:\r\n- why: your use-case, specific constraints you may have, etc.\r\n- what: the feature/behaviour/change you would like to see in Weave Net\r\nDo not hesitate, when appropriate, to share the exact commands or API you would like, and/or to share a diagram (e.g.: asciiflow.com): \"a picture is worth a thousand words\".\r\n\r\n** Is this a BUG REPORT? **\r\nPlease fill in as much of the template below as you can.\r\n\r\nThank you!\r\n-->\r\n\r\n## What you expected to happen?\r\n\r\nNetwork policies would work (like in version 1.9.5), but in version 1.9.8, when we use an ingress filter on network policies to select a pod (the \"from\" pod), traffic is blocked.\r\n\r\n## What happened?\r\nTraffic is blocked, the pod filter is not applied\r\n\r\n## How to reproduce it?\r\nSetup a namespace with ingress turned off.   Set NS to whatever namespace you are interested in\r\n\r\nkubectl annotate ns \"${NS}\" net.beta.kubernetes.io/network-policy='{\"ingress\":{\"isolation\":\"DefaultDeny\"}}'\r\n\r\nThis will block all inbound traffic.  Now, apply a network policy to allow traffic to a pod in this namespace.  This network policy will use a pod filter to only allow inbound traffic from pods that have certain labels.\r\n\r\nExample policy from our example, just change the labels to what you want:\r\n\r\n```\r\napiVersion: extensions/v1beta1\r\nkind: NetworkPolicy\r\nmetadata:\r\n  name: job-exporter\r\n  namespace: monitoring\r\nspec:\r\n  ingress:\r\n  - from:\r\n    - podSelector:\r\n        matchExpressions:\r\n        - key: app\r\n          operator: In\r\n          values:\r\n          - from-pod\r\n    ports:\r\n    - port: 8080\r\n      protocol: TCP\r\n  podSelector:\r\n    matchLabels:\r\n      app: my-pod\r\n\r\n```\r\n\r\nApply the policy.  You should see traffic being allowed from \"from-pod\" to \"my-pod\" on port 8080, TCP.  This does not work though.\r\n\r\n\r\n## Anything else we need to know?\r\nKubernetes is running in AWS.\r\n\r\n## Versions:\r\n<!-- Please paste in the output of these commands; 'kubectl' only if using Kubernetes -->\r\n```kubectl version\r\nClient Version: version.Info{Major:\"1\", Minor:\"6\", GitVersion:\"v1.6.1\", GitCommit:\"b0b7a323cc5a4a2019b2e9520c21c7830b7f708e\", GitTreeState:\"clean\", BuildDate:\"2017-04-03T23:37:53Z\", GoVersion:\"go1.8\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"6\", GitVersion:\"v1.6.5\", GitCommit:\"490c6f13df1cb6612e0993c4c14f2ff90f8cdbf3\", GitTreeState:\"clean\", BuildDate:\"2017-06-14T20:03:38Z\", GoVersion:\"go1.7.6\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```"},"comment":{"url":"https://api.github.com/repos/weaveworks/weave/issues/comments/310322688","html_url":"https://github.com/weaveworks/weave/issues/3025#issuecomment-310322688","issue_url":"https://api.github.com/repos/weaveworks/weave/issues/3025","id":310322688,"user":{"login":"bboreham","id":8125524,"avatar_url":"https://avatars1.githubusercontent.com/u/8125524?v=3","gravatar_id":"","url":"https://api.github.com/users/bboreham","html_url":"https://github.com/bboreham","followers_url":"https://api.github.com/users/bboreham/followers","following_url":"https://api.github.com/users/bboreham/following{/other_user}","gists_url":"https://api.github.com/users/bboreham/gists{/gist_id}","starred_url":"https://api.github.com/users/bboreham/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bboreham/subscriptions","organizations_url":"https://api.github.com/users/bboreham/orgs","repos_url":"https://api.github.com/users/bboreham/repos","events_url":"https://api.github.com/users/bboreham/events{/privacy}","received_events_url":"https://api.github.com/users/bboreham/received_events","type":"User","site_admin":false},"created_at":"2017-06-22T09:08:51Z","updated_at":"2017-06-22T09:08:51Z","body":"It's intentional that only local pods are added; we are only implementing ingress rules.\r\nHowever that is a change made between 1.9.5 and 1.9.6, and it broke a couple of other things, so definitely under suspicion.\r\n\r\nI'm just trying to recreate your scenario and finding the WEAVE-NPC iptables chains suspiciously blank - can you run `iptables-save` as root and post that too please?"}}
{"actor":{"display_login":"bboreham"}}