<p>We have a default deny-all-egress policy for all pods and we have an egress-internet policy like below</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-external-egress-internet
spec:
  podSelector:
    matchLabels:
      egress: internet
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
</code></pre>
<p>Now, if I try to add multiple labels under <code>spec/podselector/matchlabels</code> everything breaks. Is there a way for this network policy to get implemented on pods with label <code>egress: internet</code> OR <code>foo:bar</code>.</p>
<p>A pod with just <code>foo:bar</code> as label should be allowed but it's not working that way.</p>

<p>Thats tricky because <code>matchLabels</code> does not take multiple key&amp;value pairs and <code>matchExpressions</code> will be ANDed.
There are two possible ways (workarounds):</p>
<ol>
<li><p>Create another networkpolicy (along with existingone) where <code>matchLabels</code> contains <code>foo:bar</code>.</p>
<p>[or]</p>
</li>
<li><p>add a new label(common) to both the workloads and use that in <code>podSelector</code></p>
</li>
</ol>
