ACNP IngressPolicy not working for Flexible IPAM pods about antrea

[antoninbas]

Thanks for reporting this. It's not always the same subtest failing as far as I can tell, but I keep experiencing this issue with the Jenkins job.

[rajnkamr]

It seems to be consistently failing specially for destination pod as vlan IPAM pod with src pod selector configuration.

[rajnkamr]

apiVersion: crd.antrea.io/v1beta1
kind: ClusterNetworkPolicy
metadata:
name: acnp-with-drop-a
spec:
priority: 1
appliedTo:

• podSelector:
  matchLabels:
  pod: a
  ingress:
• action: Drop
  from:
• podSelector: {}
  enableLogging: true

wrt applied ingress drop policy , NAT is done when sending traffic from non vlan pod to vlan pod due to iptables rules added during docker bridge creation.
connntrack log shows the src ip being changed due to iptable rules
ovs-appctl dpctl/dump-conntrack
tcp,orig=(src=192.168.241.1,dst=192.168.241.100,sport=40800,dport=80),reply=(src=192.168.241.100,dst=192.168.241.1,sport=80,dport=40800),zone=4107,mark=4,protoinfo=(state=TIME_WAIT)
after removing iptable rules in kind test bed, ingress policy drop tests have passed