CKSKubernetes 1.35

Exercises

Exercise: the AND/OR selector trap

updated 2026-10-22 by seed

Host: controlplane · Time: 7 min · Domain: Cluster Setup

Task

In namespace prod:

  • Policy A must allow traffic to backend **from any Pod labelled tier=frontend in any namespace**.
  • Policy B must allow traffic to backend **only from Pods labelled tier=frontend that live in the namespace labelled app=orion**.

Acceptance criteria

  • A tier=frontend Pod in a namespace without the app=orion label reaches backend under A, and does not reach it under B.

Solution

# A — two list items = OR (namespaceSelector empty means "any namespace")
ingress:
- from:
  - podSelector: {matchLabels: {tier: frontend}}
---
# B — one list item with both selectors = AND
ingress:
- from:
  - namespaceSelector: {matchLabels: {app: orion}}
    podSelector: {matchLabels: {tier: frontend}}

The one-line difference: in B, podSelector is indented at the same level as
namespaceSelector, under the same -. In A it is a second -.

namespaceSelector: {} matches every namespace, including kube-system — which
is why "any namespace" also means "the one I did not think about".