Kubernetes Network Policies not enforced

[marrobi]

Is this a request for help?:

Yes

h component (CNI/IPAIs this an ISSUE or FEATURE REQUEST? (choose one):

Issue

Which release version?:

azure-npm:v0.0.3

Which component (CNI/IPAM/CNM/CNS):

Network Policy Manager

Which Operating System (Linux/Windows):

Linux - AKS

Which Orchestrator and version (e.g. Kubernetes, Docker)

Kubernetes

What happened:

Deployed https://github.com/Azure/acs-engine/blob/master/parts/k8s/addons/kubernetesmasteraddons-azure-npm-daemonset.yaml . Tried https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md. Pod still accessible from other namespaces. Samples using pod selectors do seem to work.

What you expected to happen:

Traffic to be blocked from outside the namespace.

How to reproduce it (as minimally and precisely as possible):

Deploy AKs with advanced networking. Deploy https://github.com/Azure/acs-engine/blob/master/parts/k8s/addons/kubernetesmasteraddons-azure-npm-daemonset.yaml . Follow: https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md.

[saiyan86]

@marrobi Could you please share the policy definition yaml with me? Thanks!

[marrobi]

Is here: https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/04-deny-traffic-from-other-namespaces.md

[saiyan86]

@marrobi Thanks for the feedback! This issue is fixed in Azure/acs-engine#3426.

[marrobi]

Thanks for the fast turnaround!

[saiyan86]

@marrobi No problem. Your feedback is very valuable to us!