1
23%
master: 25%

Ran 17 Mar 2026 05:59AM UTC

Files 205

Run time 5s

Badge

Embed ▾

Committed 17 Mar 2026 05:56AM UTC coverage: 23.472% (+0.02%) from 23.456%

Job # 23180651498.1

Build Type

Pull #6461

github

Committed by

oilbeater

Commit Message

fix(controller): remove Service ClusterIP from NetworkPolicy address sets

NetworkPolicy egress ACLs use OVN's apply-after-lb=true option, which
means they execute after LB DNAT. At that stage, the destination IP is
already the Pod IP (not the Service ClusterIP). Adding Service ClusterIPs
to the egress allow address set is therefore unnecessary.

Worse, it causes a race condition: when LB logical flows are not yet
compiled by northd, ovn-trace sees the un-DNAT'd Service ClusterIP at
the after-lb ACL stage. Since the Service ClusterIP is in the allow
address set, the packet is incorrectly allowed through and routed to
the node instead of the target pod. This manifests as flaky e2e test
failures in "kubectl ko trace ... should work with network policy".

Remove the Service ClusterIP logic from fetchPolicySelectedAddresses()
and clean up the now-unused helper functions: shouldIncludeServiceIPs,
svcMatchPods, getProtocolSvcIP, and isSvcMatchPod.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

Pull Request Pull Request #6461: fix(controller): remove Service ClusterIP from NetworkPolicy address sets

Coverage Stats

12887 of 54903 relevant lines covered (23.47%)

0.27 hits per line

kubeovn / kube-ovn / 23180651498 / 1
23%
master: 25%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 23180651498.1

kubeovn / kube-ovn / 23180651498 / 1 23% master: 25%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 23180651498.1

kubeovn / kube-ovn / 23180651498 / 1
23%
master: 25%

README BADGES
x