<p>In the basic example of the documentation for declaring a network policy:
<a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#the-networkpolicy-resource" rel="noreferrer">https://kubernetes.io/docs/concepts/services-networking/network-policies/#the-networkpolicy-resource</a></p>

<p>So this sets several rules, as per the documentation:</p>

<pre><code>So, the example NetworkPolicy:

- isolates “role=db” pods in the “default” namespace for both ingress
and egress traffic (if they weren’t already isolated)
- allows connections to TCP port 6379 of “role=db” pods in the “default”
namespace from any pod in the “default” namespace with the
label “role=frontend”
- allows connections to TCP port 6379 of “role=db” pods
in the “default” namespace from any pod in a namespace with
the label “project=myproject”
...
</code></pre>

<p>Does this means that the pods of "role=db" label can receive connections from:</p>

<ul>
<li>other pods with labels “role=frontend” AND namespace with label “project=myproject”; or</li>
<li>other pods with labels “role=frontend” OR namespace with label “project=myproject”.</li>
</ul>

<p>Thanks!</p>

<p>The <a href="https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/10-allowing-traffic-with-multiple-selectors.md" rel="nofollow noreferrer">kubernetes network recipe "<strong>ALLOW traffic from apps using multiple selectors</strong>"</a> is clear:</p>

<blockquote>
  <ul>
  <li>Rules specified in <strong><code>spec.ingress.from</code></strong> are <strong>OR</strong>'ed.</li>
  <li>This means the pods selected by the selectors are combined are whitelisted altogether.</li>
  </ul>
</blockquote>
