do280-4.12 compreview grading of the networkpolicy

[fannullone]

the grading tool is reporting the following fail:

FAIL    Validating the network policy in the grading-project-klz project
        - Expected ingress selector not found: {'namespaceSelector': {'matchLabels': {'workshop': 'grading-project-klz'}}}

But I think that my formulation is correct:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: workshop
  namespace: do280
spec:
  ingress:
  - from:
    - podSelector: {}
    - namespaceSelector:
        matchLabels:
          policy-group.network.openshift.io/ingress: ""
  podSelector: {}
  policyTypes:
  - Ingress

In fact the policy is in namespace do280 and therefore 'from: podSelector: {}' select all and only pods of the same namespace, which is matching the requirement.
This is also according to the example in the documentation:
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.12/html-single/networki...

To make pods accept connections from other pods in the same project, but reject all other connections from pods in other projects, add the following NetworkPolicy object:

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-same-namespace
spec:
  podSelector: {}
  ingress:
  - from:
    - podSelector: {}

I tested my policy and works as expected.

[Chetan_Tiwary_]

@fannullone  are you talking about Ch10s03 comp- review lab   in DO280v4.12 ?

I can see this in step 12.2 :

Also paste an screenshot of the same - I will try to reproduce the same and will then escalate to the appropriate team.

[Chetan_Tiwary_]

step 11.3 says this : Configure network policies to allow only TCP ingress traffic on port 5432 to database pods from the beeper-api pods :

You mean to say both the network policies are wrong ? or is your solution satsifying the lab objective ?

Also do note that the grading script is hard coded to match names, namespaces, labels, app names , service names, router names , port number etc which is exclusively specified in the lab - make sure you give the exact same names of objects and values in the respective fields. 

[fannullone]

what I mean is that below spec is sufficient to meet the requirement and that it is not necessary to include a logical AND with namespaceSelector as ^^, because the policy is applied to the namespace workshop-support and so the nameSpaceSelector is automatically verified:

spec:
  ingress:
  - from:
    - podSelector: {}
    - namespaceSelector:
        matchLabels:
          policy-group.network.openshift.io/ingress: ""

[MalborBoss]

I've had the same observation. I think that he is talking about ch10s02:

There's no need to specify labelSelector of workshop: template-test to alllow traffic from the same namespace, because I believe that just '-podSelector: {}' by itself specifies that.