Service includes pods from across namespaces that have matching selectors.

[sangeethah]

Rancher Version: v1.1.0-dev5

Steps to create the problem:
Create service/rc/pod in 1 namespace.
Create the same set of service/rc/pod (using the same yml file) in another namespace.
When service is listed in UI (from any of the namespace), pods from both the namespaces are listed

> kubectl create namespace test1
namespace "test1" created
> kubectl create -f test1.yml --namespace==test1
Error from server: error when creating "test1.yml": namespaces "=test1" not found
Error from server: error when creating "test1.yml": namespaces "=test1" not found
> kubectl create -f test1.yml --namespace test1
service "k8test1" created
replicationcontroller "k8testrc1" created
> kubectl create namespace test2
namespace "test2" created
> kubectl create -f test1.yml --namespace test2
service "k8test1" created
replicationcontroller "k8testrc1" created

cat test1.yml

apiVersion: v1
kind: Service
metadata:
 name: k8test1
 labels:
   k8s-app: k8test1-service
spec:
 ports:
 - port: 81
   targetPort: 81
   protocol: TCP
   name: http
 selector:
   k8s-app: k8test1-service

---
apiVersion: v1
kind: ReplicationController
metadata:
 name: k8testrc1
spec:
 replicas: 2
 selector:
   k8s-app: k8test1-service
 template:
   metadata:
     labels:
       k8s-app: k8test1-service
   spec:
     terminationGracePeriodSeconds: 60
     containers:
     - name: testcontainer
       image: sangeetha/testnewhostrouting
       ports:
       - containerPort: 81

When ingress is created for this service , lb traffic gets redirected to all the pods ( from both the namespaces).

[sangeethah]

Tested with v1.2.0-pre1-rc4 and kubernetes 1.3.0 ( rancher/k8s:v1.3.0-rancher3).
This issue is still seen.
Create service/rc/pod in 1 namespace.
Create the same set of service/rc/pod (using the same yml file) in another namespace.
When service is listed in UI (from any of the namespace), pods from both the namespaces are listed.

[alena1108]

@vincent99 looks like UI needs to be fixed. Not sure what calculation it uses for displaying pods under service, but it does include pods with matching selectors cross namespaces.

We've put a fix on k8s agent to inject namespace info to the selector of the k8s service that we propagate to Rancher. So this way pods cross namespaces don't join the service. So in the DB, I'm seeing 2 pods behind the service; kubectl also shows only 2 endpoints. Yet UI includes 4 pods

[tfiduccia]

Version - master 8/2
Verified fixed