DO280 - Question to Lab Ch10.2 - compreview-review

[Robert-Craven]

Hello, 

in the tasks for the compreview-review labs we have to configure also an "network policy template" for ingress traffic:

• Must accept traffic only from within the same workshop or from the ingress controller.

I copied the example for the ingress controller from the official RedHat documentation:

matchLabels:
   policy-group.network.openshift.io/ingress: ""

Chapter 20. Network policy OpenShift Container Platform 4.12 | Red Hat Customer Portal
20.1.1.1. Using the allow-from-router network policy

but the "grade-script" doesn't accept this code. It want the following code:

matchLabels:
  network.openshift.io/policy-group: ingress

Both codes should be working, or dosn't it?
My question is now how the exam script will accept this kind of answers?

Regards

[Chetan_Tiwary_]

Hello @Robert-Craven !
Thanks for reaching out !

If I understood it correctly :

To make a project allow only connections from the OpenShift Container Platform Ingress Controller, add the following NetworkPolicy  object :

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-openshift-ingress
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          network.openshift.io/policy-group: ingress
  podSelector: {}
  policyTypes:
  - Ingress

and to Use the following NetworkPolicy to allow external traffic regardless of the router configuration:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-router
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          policy-group.network.openshift.io/ingress: ""
  podSelector: {}
  policyTypes:
  - Ingress

As per the official documentation ( v4.12 )  here : https://docs.openshift.com/container-platform/4.12/networking/network_policy/about-network-policy.ht...  

[DRobitaille]

Can someone then explain to me technically  the note in the very next section in the Open Shift docs (https://docs.openshift.com/container-platform/4.12/networking/network_policy/multitenant-network-pol...) that really seem to imply that both syntax are the similar, but one is the legacy label, while the other is the prefered label to use?

====================

Note:

policy-group.network.openshift.io/ingress: "" is the preferred namespace selector label for OpenShift SDN. You can use the network.openshift.io/policy-group: ingress namespace selector label, but this is a legacy label.

===================

I just want to make sure I use the prefered way, and not use a legacy label, which I assume will go away at one point in the future.  And I assume both are essentially the same???

[Chetan_Tiwary_]

@alexcorcoles Could you help clarify as it is from DO280v4.12  ch10s02 step 9.5 

[alexcorcoles]

Oh, I am not familiar with this part. It seems that Wasim reported an issue about the possibility that we are using a deprecated label- hopefully this will get dealt with soon.

I would also like to explain that the people writing the courses do not have visibility into the exam. This is logical- we can take exams and it wouldn't be fair. However, the people writing the exams look at the courses, so hopefully (having some mistakes is unavoidable), exams are well-aligned with the courses.

[alexcorcoles]

Oh, I see Randy just mentioned that the issue has been dealt with

[Chetan_Tiwary_]

Thanks @alexcorcoles for checking anyways !

[Wasim_Raja]

@Robert-Craven Thank you for reporting, this is a known issue in current lab environment I have already raised this bug with the concerned team and we should get a fix for this soon.

And as far as exams are concerned please be rest assured that this issue will not impact exam environment in any way.

[Randy_Thomas · Accepted solution]

In edition 3 of the course, released on November 30, 2023, the preferred label is now the default used in the lecture and the lab:

policy-group.network.openshift.io/ingress: ""

The grading script has also be revised to accept either label.

[Chetan_Tiwary_]

Thanks @Randy_Thomas so this means either label is acceptable. 

FYI @Robert-Craven @DRobitaille