Change:
<!-- Please only use this template for submitting reports about flaky tests or jobs (pass or fail with no underlying change in code) in Kubernetes CI --Which jobs are flaking: A NetworkPolicy test in , not run in Kubernetes CI. Which test(s) are flaking: Testgrid link: Reason for failure: Its failure rate is 6.66% according to 30 latest tests in (a Kubernetes CNI) CI. The reason is, the test doesn't wait for the server Pod to be ready before testing traffic via its service, then even the NetworkPolicy allows it, the SYN packets will be rejected by iptables because the service has no endpoints at that moment. e2e log: server pod status: kube-proxy log: In short: 14:35:58.874 server Pod was created 14:36:00.916 server Pod became running 14:36:00.916 The traffic test against Service started, there was no endpoints for it at this moment so it was always rejected 14:36:10.921 The traffic test failed and terminated 14:36:10 server Pod became ready, Endpoints is updated 14:36:10.547 kube-proxy received Endpoints update and configured nat table The other tests don't have this problem because they all wait for server Pods to be ready, this test should do it too to avoid flakes.
/sig network These SIGs are my best guesses for this issue. Please comment if I am incorrect about one. I am a bot run by vllry. ‍
/assign
/triage unresolved Comment when the issue is assessed and confirmed. I am a bot run by vllry. ‍

Discussion:
// Creating pods and services in namespace-b nsBpodServerA, nsBserviceA = createServerPodAndService(f, nsB, "ns-b-server-a", []int{80}) <ins> defer cleanupServerPodAndService(f, nsBpodServerA, nsBserviceA) </ins> nsBpodServerB, nsBserviceB = createServerPodAndService(f, nsB, "ns-b-server-b", []int{80}) <ins> defer cleanupServerPodAndService(f, nsBpodServerB, nsBserviceB) </ins> // Wait for Server with Service in NS-A to be ready <del> framework.Logf("Waiting for servers to come up.") err = e2epod.WaitForPodRunningInNamespace(f.ClientSet, podServer) framework.ExpectNoError(err, "Error occurred while waiting for pod status in namespace: Running.") </del> <ins> framework.Logf("Waiting for servers to be ready.") err = e2epod.WaitTimeoutForPodReadyInNamespace(f.ClientSet, podServer.Name, podServer.Namespace, framework.PodStartTimeout) framework.ExpectNoError(err, "Error occurred while waiting for pod status in namespace: Ready.") </ins> // Wait for Servers with Services in NS-B to be ready <del> err = e2epod.WaitForPodRunningInNamespace(f.ClientSet, nsBpodServerA) framework.ExpectNoError(err, "Error occurred while waiting for pod status in namespace: Running.") </del> <ins> err = e2epod.WaitTimeoutForPodReadyInNamespace(f.ClientSet, nsBpodServerA.Name, nsBpodServerA.Namespace, framework.PodStartTimeout) framework.ExpectNoError(err, "Error occurred while waiting for pod status in namespace: Ready.") </ins> <del> err = e2epod.WaitForPodRunningInNamespace(f.ClientSet, nsBpodServerB) framework.ExpectNoError(err, "Error occurred while waiting for pod status in namespace: Running.") defer cleanupServerPodAndService(f, nsBpodServerA, nsBserviceA) defer cleanupServerPodAndService(f, nsBpodServerB, nsBserviceB) </del> <ins> err = e2epod.WaitTimeoutForPodReadyInNamespace(f.ClientSet, nsBpodServerB.Name, nsBpodServerB.Namespace, framework.PodStartTimeout) framework.ExpectNoError(err, "Error occurred while waiting for pod status in namespace: Ready.") </ins> ginkgo.By("Creating a network policy for the server which allows traffic only to a server in different namespace.") protocolUDP := v1.ProtocolUDP