A shared monitoring namespace must scrape app Pods in another namespace. Which NetworkPolicy source matches that whole monitoring namespace?
Select an answer to reveal the explanation.
Short Explanation
namespaceSelector is the "anyone wearing this building's badge" match. Label the monitoring namespace and allow it as an ingress source. RBAC admin rights or hostNetwork aren't NetworkPolicy peers.
Full Explanation
NetworkPolicy ingress/egress peers can use namespaceSelector to match Pods in namespaces with specific labels, which is the usual pattern for a shared monitoring namespace. A podSelector alone only matches Pods in the policy's namespace unless combined correctly with namespaceSelector. RBAC and hostNetwork do not implement CNI allow rules.