<p>As I have seen few related posts but none answered my question, I thought I would ask a new question based on suggestions from other users as well <a href="https://stackoverflow.com/questions/64223630/job-invalid-selector-not-auto-generated/64224974?noredirect=1#comment117481868_64224974">here</a>.</p>
<p>I have the need to make a selector label for a network policy for a running cronjob that is responsible to connect to some other services within the cluster, as far as I know there is no easy straight forward way to make a selector label for the jobs pod as that would be problematic with duplicate job labels if they ever existed. Not sure why the cronjob can't have a selector itself, and then can be applied to the job and the pod.</p>
<p>also there might be a possibility to just set this cronjob in its own namespace and then allow all from that one namespace to whatever needed in the network policy but does not feel like the right way to overcome that problem.</p>
<p>Using k8s v1.20</p>

<p>First of all, to select pods (spawned by your <code>CronJob</code>) that should be allowed by the <code>NetworkPolicy</code> as ingress sources or egress destinations, you may set specific label for those pods.</p>
<p>You can easily set a label for <code>Jobs</code> spawned by <code>CronJob</code> using labels field (another example with an explanation can be found in the <a href="https://docs.openshift.com/container-platform/4.1/nodes/jobs/nodes-nodes-jobs.html#nodes-nodes-jobs-creating_nodes-nodes-jobs" rel="noreferrer">OpenShift CronJobs documentation</a>):</p>
<pre><code>---
apiVersion: batch/v1beta1
kind: CronJob
metadata:
  name: mysql-test
spec:
...
  jobTemplate:             
    spec:
      template:
        metadata:
          labels:          
            workload: cronjob # Sets a label for jobs spawned by this CronJob.
            type: mysql       # Sets another label for jobs spawned by this CronJob.
...
</code></pre>
<p>Pods spawned by this <code>CronJob</code> will have the labels <code>type=mysql</code> and <code>workload=cronjob</code>, using this labels you can create/customize your <code>NetworkPolicy</code>:</p>
<pre><code>$ kubectl get pods --show-labels
NAME                          READY   STATUS      RESTARTS   AGE    LABELS
mysql-test-1615216560-tkdvk   0/1     Completed   0          2m2s   ...,type=mysql,workload=cronjob
mysql-test-1615216620-pqzbk   0/1     Completed   0          62s    ...,type=mysql,workload=cronjob
mysql-test-1615216680-8775h   0/1     Completed   0          2s     ...,type=mysql,workload=cronjob

$ kubectl describe pod mysql-test-1615216560-tkdvk
Name:         mysql-test-1615216560-tkdvk
Namespace:    default
...
Labels:       controller-uid=af99e9a3-be6b-403d-ab57-38de31ac7a9d
              job-name=mysql-test-1615216560
              type=mysql
              workload=cronjob
...
</code></pre>
<p>For example this <code>mysql-workload</code> <code>NetworkPolicy</code> allows connections to all pods in the <code>mysql</code> namespace from any pod with the labels <code>type=mysql</code> and <code>workload=cronjob</code> (logical conjunction) in a namespace with the label <code>namespace-name=default</code> :<br />
<strong>NOTE:</strong> Be careful to use correct YAML (take a look at this <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#behavior-of-to-and-from-selectors" rel="noreferrer">namespaceSelector and podSelector example</a>).</p>
<pre><code>---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: mysql-workload
  namespace: mysql
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          namespace-name: default
      podSelector:
        matchLabels:
          type: mysql
          workload: cronjob
</code></pre>
<p>To use network policies, you must be using a networking solution which supports <code>NetworkPolicy</code>:</p>
<blockquote>
<p>Network policies are implemented by the network plugin. To use network policies, you must be using a networking solution which supports NetworkPolicy. Creating a NetworkPolicy resource without a controller that implements it will have no effect.</p>
</blockquote>
<p>You can learn more about creating Kubernetes <code>NetworkPolicies</code> in the <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="noreferrer">Network Policies documentation</a>.</p>
