A platform team wants a namespace-wide default-deny ingress NetworkPolicy in permits. Which podSelector shape applies the policy to every Pod in that namespace?
Select an answer to reveal the explanation.
Short Explanation
Empty braces here mean “everyone in this namespace,” not “nobody.” It’s the standard way to hang a default-deny coat on the whole floor. Pair that with empty ingress (or no allow rules) and you’ve closed the doors until you open specific allows.
Full Explanation
In NetworkPolicy, spec.podSelector: {} selects all Pods in the policy’s namespace. Combined with policyTypes that include Ingress and no ingress allow rules (or an empty ingress list depending on intent), this is the usual namespace-wide default-deny pattern. Omitting podSelector is invalid for a complete policy object; matchLabels wildcards like * are not a universal selector; and empty selector means all Pods, not none.