VMware NSX Container Plugin (NCP) rejects NetworkPolicies with "NETWORK_POLICY_VALIDATION_FAILED"

Products

• VMware NSX

Issue/Introduction

The VMware NSX Container Plugin (NCP) may reject Kubernetes NetworkPolicies in specific namespaces (such as openshift-logging), resulting in an error annotation. This prevents the enforcement of security policies and can block the installation of components like OpenShift logging.

• Symptoms: NetworkPolicies show the annotation ncp/error: NETWORK_POLICY_VALIDATION_FAILED.
• Error Message from NCP logs: nsx_ujo.ncp.k8s.network_policy_controller Network policy logging-loki-loki-allow under namespace openshift-logging not created. Reason: Network Policy spec not supported: Number of IN expressions exceed NSX limit of 1

Environment

• Product: VMware NSX 4.2.3.0
• Environment: Red Hat OpenShift
• Configuration: NCP translating Kubernetes NetworkPolicies into NSX Distributed Firewall (DFW) rules.

Cause

This issue is caused by a hardware and API limitation in NSX regarding the Kubernetes IN operator within selectors. NCP enforces a limit of one IN expression per selector to maintain NSX Manager API performance and hardware scale limits. When a NetworkPolicy (e.g., logging-loki-gateway-allow.yaml) contains multiple IN expressions, the translation fails.

Additionally, workarounds using Kyverno mutations may fail if the target namespace (e.g., openshift-logging) is included in a global exclusion list within the GitOps configuration.

Resolution

If you believe you have encountered this issue, contact Broadcom support and reference this KB article.