Skip processing unrelated namespace peers for Network Policy

When network policy object contains peers from namespace which is not on
subject's user defined network, then it doesn't make sense to add that
peer namespace into OVN's network policy ACL, because those namespaces
are isolated already. Hence this commit avoids processing such peers in
network policy namespace peer handler.

Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>

go-controller/pkg/ovn/base_network_controller_policy.go

@@ -1400,6 +1400,14 @@ func (bnc *BaseNetworkController) handlePeerNamespaceSelectorAdd(np *networkPoli
 	var errors []error
 	for _, obj := range objs {
 		namespace := obj.(*kapi.Namespace)
+		netinfo, err := bnc.getActiveNetworkForNamespace(namespace.Name)
+		if err != nil {
+			return fmt.Errorf("could not get active network for namespace %s: %v", namespace.Name, err)
+		}
+		if bnc.GetNetworkName() != netinfo.GetNetworkName() {
+			np.RUnlock()
+			return nil
+		}
 		// addNamespaceAddressSet is safe for concurrent use, doesn't require additional synchronization
 		nsUpdated, err := gp.addNamespaceAddressSet(namespace.Name, bnc.addressSetFactory)
 		if err != nil {
@@ -1436,6 +1444,14 @@ func (bnc *BaseNetworkController) handlePeerNamespaceSelectorDel(np *networkPoli
 	updated := false
 	for _, obj := range objs {
 		namespace := obj.(*kapi.Namespace)
+		netinfo, err := bnc.getActiveNetworkForNamespace(namespace.Name)
+		if err != nil {
+			return fmt.Errorf("could not get active network for namespace %s: %v", namespace.Name, err)
+		}
+		if bnc.GetNetworkName() != netinfo.GetNetworkName() {
+			np.RUnlock()
+			return nil
+		}
 		// delNamespaceAddressSet is safe for concurrent use, doesn't require additional synchronization
 		if gp.delNamespaceAddressSet(namespace.Name) {
 			updated = true