A frontend Deployment’s Pods are labeled app=web, but a NetworkPolicy that selects app=api only allows ingress from role=frontend. Clients still time out. What is the most likely policy cause?
Select an answer to reveal the explanation.
Short Explanation
Selectors are picky bouncers—they only wave through guests whose badges match exactly. If the allow rule looks for role=frontend but your Pods wear app=web without that role label, they never make the guest list. Fix the labels (or the selector) so the policy and the Pods agree.
Full Explanation
NetworkPolicy peer podSelectors must match labels on the source Pods for an ingress allow (and similarly for egress destinations). A mismatch means those Pods are not selected as allowed peers, so under deny-by-default isolation their traffic stays blocked. Services do not bypass NetworkPolicy peer matching, Pod labels are evaluated for peers, and ingress is not automatically open within a namespace once policies isolate the target Pods.