Question

A security engineer applies a NetworkPolicy in the 'payments' namespace with an empty podSelector ({}), policyTypes set to Ingress, and an ingress rule allowing traffic only from pods labeled app=gateway. After applying it, some existing pods in the 'payments' namespace that previously received traffic from other internal services can no longer be reached. What is the effect of this NetworkPolicy?

Accepted Answer

It selects all pods in the 'payments' namespace and restricts their ingress to only pods labeled app=gateway, dropping all other incoming traffic.

Answer

It applies only to pods labeled app=gateway and leaves all other pods in the namespace with unrestricted ingress.

Answer

It affects all pods across every namespace in the cluster because the empty podSelector has cluster-wide scope.

Answer

It has no effect because an empty podSelector is invalid and Kubernetes ignores the policy entirely.