fix: podSelector in networkpolicy should only consider pods in the sa…

…me ns
kubeovn · Dec 16, 2019 · 23cad46 · 23cad46
1 parent a479e6e
commit 23cad46
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/pkg/controller/network_policy.go b/pkg/controller/network_policy.go
@@ -479,7 +479,7 @@ func (c *Controller) podMatchNetworkPolicies(pod *corev1.Pod) []string {
 
 func isPodMatchNetworkPolicy(pod *corev1.Pod, podNs *corev1.Namespace, policy *netv1.NetworkPolicy, policyNs string) bool {
 	sel, _ := metav1.LabelSelectorAsSelector(&policy.Spec.PodSelector)
-	if sel.Matches(labels.Set(pod.Labels)) {
+	if podNs.Name == policyNs && sel.Matches(labels.Set(pod.Labels)) {
 		return true
 	}
 	for _, npr := range policy.Spec.Ingress {