liveBook · Manning

Pod selector

As explained in Acing the Certified Kubernetes Administrator Exam, Second Edition

A pod selector is a label-based selector that identifies the pods to which a Kubernetes network policy applies.

A pod selector identifies the pods governed by a NetworkPolicy by matching their labels. The selector appears under .spec.podSelector and determines where ingress or egress isolation applies. section 6.6

Use pod selectors to control policy scope:

  • Leave .spec.podSelector empty ({}) to select every pod in the namespace, commonly for default-deny policies. section 6.6
  • Combine multiple NetworkPolicies because their rules are additive; each policy can target different pods and policy types. section 6.6

Allow busybox to reach nginx

A NetworkPolicy with podSelector.matchLabels.run: nginx targets the nginx pod. Its ingress rule permits traffic from a pod selected by run: busybox on TCP port 80. A corresponding egress policy can select busybox and permit traffic to nginx.

How Acing the Certified Kubernetes Administrator Exam, Second Edition covers it

How deep it goes
Defines label matching, namespace-wide empty selectors, and additive policies, but stops short of detailed selector syntax.
Examples
Uses nginx and busybox labels, allow policies, and an empty default-deny selector.
What it assumes
Assumes familiarity with pods and labels while connecting label matching to NetworkPolicy scope.
What you can do after
Operate/configure NetworkPolicies that target selected pods and verify traffic with kubectl exec and wget.
How it connects
Links NetworkPolicy with labels, ingress, egress, namespace selectors, and IP blocks.
Cover of Acing the Certified Kubernetes Administrator Exam, Second Edition
liveBookmanning.com
Read Acing the Certified Kubernetes Administrator Exam, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Acing the Certified Kubernetes Administrator Exam, Second Edition. The section links point to the parts of the book it draws on.