Question

A namespace called 'payments' currently has no NetworkPolicies. You apply the following policy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict
  namespace: payments
spec:
  podSelector: {}
  policyTypes:
  - Ingress

After applying this manifest, users report that all pods in the 'payments' namespace can no longer receive any incoming connections, while outbound connections from those pods still work fine. What is the correct explanation of this behavior?

Accepted Answer

The empty podSelector selects all pods in the namespace, and because an Ingress policyType is declared with no ingress rules, all incoming traffic is denied while egress remains unaffected.

Answer

The empty podSelector matches no pods, so the policy has no effect; the connectivity loss must be caused by an unrelated CNI failure.

Answer

Declaring policyTypes: Ingress with no rules blocks both ingress and egress traffic for all selected pods, which is why inbound connections fail.

Answer

The policy denies ingress only to pods that already have an existing NetworkPolicy label; new pods without that label are unaffected.