[enterprise-4.8] Issue in file networking/network_policy/multitenant-network-policy.adoc

[jon2100]

Which section(s) is the issue in?

Create the following NetworkPolicy objects:

A policy named allow-from-openshift-ingress.

What needs fixing?

policy-group.network.openshift.io/ingress=""

should be
network.openshift.io/policy-group: ingress

[ctauchen]

@jon2100 thanks for submitting this!

It looks like you're talking about the procedure called Configuring multitenant isolation by using network policy, which I see here:

https://docs.openshift.com/container-platform/4.8/networking/network_policy/multitenant-network-policy.html#nw-networkpolicy-multitenant-isolation_multitenant-network-policy

According to the note underneath the procedure, you seem to be describing a legacy label that is no longer the preferred label.

The note reads:

policy-group.network.openshift.io/ingress="" is the preferred namespace selector label for OpenShift SDN. You can use the network.openshift.io/policy-group: ingress namespace selector label, but this is a legacy label.

For now, I'm closing this issue because the problem you mention is addressed immediately after the procedure. If I've misunderstood something, please let me know and we'll reopen the issue.

[jon2100]

Yes I did see that, however, when you run the command outlined in that setup it will error
@Helper ~]# cat << EOF| oc create -f -

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-openshift-ingress
spec:
ingress:

• from:
  • namespaceSelector:
    matchLabels:
    policy-group.network.openshift.io/ingress=""
    podSelector: {}
    policyTypes:
• Ingress
  EOF
  Error from server (BadRequest): error when creating "STDIN": NetworkPolicy in version "v1" cannot be handled as a NetworkPolicy: v1.NetworkPolicy.Spec: v1.NetworkPolicySpec.Ingress: []v1.NetworkPolicyIngressRule: v1.NetworkPolicyIngressRule.From: []v1.NetworkPolicyPeer: v1.NetworkPolicyPeer.NamespaceSelector: v1.LabelSelector.MatchLabels: ReadMapCB: expect { or n, but found ", error found in Basic navigation work completed #10 byte of ...|hLabels":"policy-gro|..., bigger context ...|s":[{"from":[{"namespaceSelector":{"matchLabels":"policy-group.network.openshift.io/ingress="""}}]|...

however, using the legacy label does not produce that error. Also in the documents here when defining "Default Network Policy" https://docs.openshift.com/container-platform/4.8/networking/network_policy/default-network-policy.html
it states
Step #2
In the template, add each NetworkPolicy object as an element to the object's parameter. The objects parameter accepts a collection of one or more objects.

In the following example, the objects parameter collection includes several NetworkPolicy objects.
objects:

• apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
  name: allow-from-same-namespace
  spec:
  podSelector: {}
  ingress:
  • from:
    • podSelector: {}
• apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
  name: allow-from-openshift-ingress
  spec:
  ingress:
  • from:
    • namespaceSelector:
      matchLabels:
      network.openshift.io/policy-group: ingress
      podSelector: {}
      policyTypes:
  • Ingress
    As you can see it's using what the other page using is the legacy label -
    So there is inconsistency in the docs and or a bug in OCP

[ctauchen]

Fair enough, @jon2100 . I've reopened this and get back to you with more information when I have it. Thanks!

[jboxman-rh]

@ctauchen, yeah, it should probably be policy-group.network.openshift.io/ingress: "" not =. The LHS is the key, the RHS is the value.

[ctauchen]

Thanks, @jboxman-rh. That's a simple fix. @jon2100, do you want to try that? policy-group.network.openshift.io/ingress: ""

@astoycos Any thoughts?

[jon2100]

Yes that works, just tried it and the policy was created without issue