Fix Pod Labels So NetworkPolicies Allow Traffic

Original Prepium guide · Written for Kubernetes v1.35 and checked against the official documentation on 6 October 2026. Use a disposable practice cluster. Its network plugin must enforce NetworkPolicy (Calico and Cilium do); without enforcement the objects are stored but have no effect.

NetworkPolicy is label matching: read the selectors before you touch anything

A NetworkPolicy never names Pods. It selects them by label, twice: the top-level podSelector picks the Pods it protects, and the selectors inside from or to pick the peers allowed to talk to them. So when traffic that "should" work is blocked, the policy may be perfectly correct and the labels on the Pods may be what is wrong. Learning to compare the two quickly is a core CKAD troubleshooting skill.

policy allow-picker (selects tier=inventory)
   from: podSelector tier=picker  ── port 80 ──→  inventory Pod (tier=inventory)
picker Pod labelled tier=pickr   ✗ not selected as a peer, so blocked

1. How a Pod becomes isolated

By default a Pod accepts traffic from anywhere. It becomes isolated for ingress as soon as any policy selects it and lists Ingress in policyTypes (a policy with no policyTypes counts as Ingress). From then on, only connections allowed by some policy's ingress rules get in. Policies never conflict: the allowed set is the union of every policy that applies. Egress works the same way on the sending side, and a connection must pass both the sender's egress and the receiver's ingress.

2. Reproduce a label mismatch

kubectl create namespace prepium-tutorial
kubectl -n prepium-tutorial run inventory --image=nginx:1.27-alpine --labels=tier=inventory
kubectl -n prepium-tutorial run picker --image=busybox:1.36 --labels=tier=pickr -- sleep 3600
kubectl -n prepium-tutorial run guest --image=busybox:1.36 --labels=tier=guest -- sleep 3600

Apply this policy. It is correct; the picker Pod's label has a typo.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-picker
  namespace: prepium-tutorial
spec:
  podSelector:
    matchLabels:
      tier: inventory
  policyTypes: ["Ingress"]
  ingress:
  - from:
    - podSelector:
        matchLabels:
          tier: picker
    ports:
    - protocol: TCP
      port: 80

IP=$(kubectl -n prepium-tutorial get pod inventory -o jsonpath='{.status.podIP}')
kubectl -n prepium-tutorial exec picker -- wget -T 3 -qO- "http://$IP" | head -n 3

The request fails, usually as a timeout: inventory is isolated and no Pod matches tier=picker.

3. Compare selectors with labels

kubectl -n prepium-tutorial describe networkpolicy allow-picker
kubectl -n prepium-tutorial get pods --show-labels
kubectl -n prepium-tutorial get pods -l tier=picker

describe shows how the API server read the selectors. Running each selector as a -l query is the fastest test: an empty result means the policy is pointing at nobody.

4. Fix the side that is wrong

If the policy expresses the intended design, correct the Pod, not the policy:

kubectl -n prepium-tutorial label pod picker tier=picker --overwrite
kubectl -n prepium-tutorial exec picker -- wget -T 3 -qO- "http://$IP" | head -n 3
kubectl -n prepium-tutorial exec guest  -- wget -T 3 -qO- "http://$IP"

The picker now gets the nginx page and the guest still times out, which proves the policy is enforcing rather than simply open. For Pods owned by a Deployment, change the labels in the Pod template instead. Relabelling a managed Pod by hand can take it out of its ReplicaSet's selector, and the ReplicaSet then creates a replacement with the old labels.

Common mistakes

• Splitting namespaceSelector and podSelector into two from entries. Two entries are OR; both selectors in one entry are AND.
• Widening a policy to make a test pass when the real fault was a label, quietly allowing traffic the design never intended.
• Forgetting egress. If the sender is isolated for egress, the receiver's ingress rule alone is not enough, and DNS lookups may need their own egress allowance.
• Testing only the allowed path. Without a denied control request you cannot tell enforcement from a plugin that ignores policies.

Cleanup: kubectl delete namespace prepium-tutorial. References: Network Policies, Declare Network Policy, ReplicaSet. Next, try writing an allow policy from scratch or namespace isolation.