Public-health API Pods should accept ingress from any Pod running in namespaces labeled team=intake. Which NetworkPolicy peer selector expresses that?
Select an answer to reveal the explanation.
Short Explanation
Need a whole labeled neighborhood to reach the API? Use namespaceSelector on that label — not nodeSelector or topology tricks.
Full Explanation
NetworkPolicy ingress peers can select entire namespaces via namespaceSelector based on namespace labels, allowing any Pod in those namespaces (or further narrowed with podSelector). Workload scheduling fields and ExternalName Services do not define NetworkPolicy peers.