<p>Observe: the field value of <code>ingress</code> under <code>spec</code>.</p>

<p>Case 1: DENY all traffic to an application. Here ingress takes an empty array as its value.</p>

<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: web-deny-all
spec:
  podSelector:
    matchLabels:
      app: web
  ingress: [] # &lt;-- This DENIES ALL traffic
</code></pre>

<p>Case 2: ALLOW all traffic to an application. Here ingress takes a list item of empty map as its value. </p>

<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: web-allow-all
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - {}  # &lt;-- This ALLOWS ALL traffic
</code></pre>

<p>I'm just wondering that if I were to read out loud the assignment values of <code>ingress</code> of the above how do I read it?  </p>

<p>YAML has a couple of different ways to write lists (and for that matter most other objects).  This might become clearer if we write both using the same list syntax:</p>

<pre><code># deny-all
ingress: []

# allow-all
ingress: [{}]
</code></pre>

<p>Assume that one of these policies is the only one that matches the pod in question.  The first policy has no items in the <code>ingress</code> list, the second one.  <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#networkpolicyspec-v1-networking-k8s-io" rel="nofollow noreferrer">The NetworkPolicySpec API documentation</a> tells us</p>

<blockquote>
  <p>Traffic is allowed to a pod [...] if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod.</p>
</blockquote>

<p>So in the first case, the policy matches the pod, but there are no ingress rules, and therefore there isn't at least one ingress rule that matches, so traffic is denied.</p>

<p>In the second case there is a single rule, which is an empty <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#networkpolicyingressrule-v1-networking-k8s-io" rel="nofollow noreferrer">NetworkPolicyIngressRule</a>.  That has two fields, <code>from</code> and <code>ports</code>, but the documentation for both of those fields says</p>

<blockquote>
  <p>If this field is empty or missing, this rule matches all [sources or ports]</p>
</blockquote>

<p>So the empty-object rule matches all sources and all ports; and since there is a matching ingress rule, traffic is allowed.</p>
