<p>if we have a pod in one namespace created for eg app-space, pod name: busybox
and if the pod is not having any labels on it, can we apply network policy ?
<a href="https://i.stack.imgur.com/nIVr7.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/nIVr7.png" alt="enter image description here" /></a></p>
<p>how does the namespace selector field  highlighted in yellow work?</p>
<p>does this mean that any pod with labels project=myproject will only be allowed in that namespace?</p>

<p>There are 2 places in netpol where label selectors are used..</p>
<ol>
<li>.spec.podselector.MatchLabels</li>
</ol>
<p>in the example above that label selector is. role=db</p>
<p>That selector determines which pod the netpol is going to get applied to.  Also, remember that netpol is a namespaced object ( you can check that out from doing kubectl api-resources).   So, since the value of metadata.namespace is default, this policy will apply to any pod in the default namespace that has labe=db</p>
<p>2). The optional namespace selector in the spec.ingress[*].namespaceSelector.matchLabels</p>
<p>In the example you show this is project=myproject. ( this could be on the egress side to as spec.egress[*].namespaceSelector.matchLabels)</p>
<p>This label selector means from who the traffic is allowed (for the ingress example)</p>
<p>So, in the example above it's allowed  for the namespace whose label is project=myproject</p>
<p>Remember you can label a ns also.</p>
<p>for instance:  kubectl label ns project  project=myproject</p>
<p>The yaml for the ns project would then look like this:</p>
<pre><code>apiVersion: v1
kind: Namespace
metadata:
 name: project
 labels:
   project: myproject
</code></pre>
