Default deny closed the namespace. Each allowance is an ingress rule on a policy that selects the receiving Pods.

Allow one source on one port

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-from-api
spec:
  podSelector:
    matchLabels:
      app: market-db
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: market-api
      ports:
        - port: 5432

Read it from the top: this policy is about market-db Pods. They may receive connections from Pods labelled app=market-api, on port 5432. Everything else stays dropped, because default deny still selects them too, and the policies add up.

Three kinds of source

Every namespace carries kubernetes.io/metadata.name: <its name>, so a namespaceSelector can name one without extra labelling.

One item or two

      from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ops
          podSelector:
            matchLabels:
              app: prober

One list item with both selectors means Pods labelled app=prober in the ops namespace. Put a dash in front of podSelector and it becomes two items: any Pod in ops, or any app=prober Pod in this namespace. The dash is the whole difference.

Open and closed rules

ingress: [] or no ingress at all means nothing comes in. ingress: [{}], one empty rule, means everything comes in. Used on a policy that selects the public web tier, it reopens that tier under a default deny.