A namespace selector is a label-based NetworkPolicy selector that identifies namespaces whose pods may be included in ingress or egress rules. It combines with pod selectors, IP blocks, and ports for granular traffic filtering. section 6.6
Apply these rules when reading or writing NetworkPolicy manifests:
- Place namespaceSelector and podSelector in the same list item to require both conditions. section 6.6
- Place selectors in separate list items to make them alternatives; each item under ingress.from or egress.to is an OR condition. section 6.6
- Use the selector within ingress or egress rules to control which pod connections are permitted. section 6.6
Combining namespace and pod scope
A NetworkPolicy can allow incoming traffic to db pods in the default namespace only from frontend pods running in the myproject namespace, while also restricting node CIDRs and ports. section 6.6
