A platform team wants a namespace-wide default-deny ingress NetworkPolicy in permits. Which podSelector shape applies the policy to every Pod in that namespace?
Select an answer to reveal the explanation.
Short Explanation
Empty braces here mean “everyone in this namespace,” not “nobody.” It’s the standard way to hang a default-deny coat on the whole floor. Pair that with empty ingress (or no allow rules) and you’ve closed the doors until you open specific allows.
Full Explanation
To apply a namespace-wide default-deny ingress NetworkPolicy in permits, use an empty podSelector (podSelector: {}) so every Pod in that namespace is selected. The empty selector is the standard Kubernetes shape meaning “all Pods in this namespace,” which is exactly what platform teams want before layering explicit allows for municipal clients.
Omitting the podSelector field entirely so the API supposedly defaults to selecting nothing is the wrong approach for select-all and misunderstands the empty-selector pattern. Setting matchLabels to app: '' does not wildcard all applications—it matches the literal label value ''. Using matchExpressions NotIn on a fake key so no Pods match, then trying to invert with a second policy, is not the select-all pattern and actively fights the goal of covering every Pod.
Exam caveat: empty podSelector {} selects all Pods in the policy’s namespace; do not confuse that with an empty namespaceSelector inside a peer block (which means all namespaces as peers). Operational check: apply default-deny ingress with podSelector: {}, attempt curls between Pods in permits and confirm denial, then add specific allows for legitimate city clients. kubectl get networkpolicy -o yaml must show {}. Many city platform standards require this namespace default-deny as a prerequisite before application allows are merged.