Kubernetes networkpolicy multiple match labels

Question

We have a default deny-all-egress policy for all pods and we have an egress-internet policy like below

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-external-egress-internet
spec:
  podSelector:
    matchLabels:
      egress: internet
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0

Now, if I try to add multiple labels under spec/podselector/matchlabels everything breaks. Is there a way for this network policy to get implemented on pods with label egress: internet OR foo:bar.

A pod with just foo:bar as label should be allowed but it's not working that way.

Answer 1

You can add multiple key-values to podSelector.matchLabels.
See https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/10-allowing-traffic-with-multiple-selectors.md

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: redis-allow-services
spec:
  podSelector:
    matchLabels:
      app: bookstore
      role: db
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: bookstore
          role: search
    - podSelector:
        matchLabels:
          app: bookstore
          role: api
    - podSelector:
        matchLabels:
          app: inventory
          role: web

Answer 2

Thats tricky because matchLabels does not take multiple key&value pairs and matchExpressions will be ANDed. There are two possible ways (workarounds):

1. Create another networkpolicy (along with the existing one) where matchLabels contains foo:bar.

   [or]

2. add a new label(common) to both the workloads and use that in podSelector