<p>In the first yaml below, the second <code>podSelector</code> clause (under <code>to</code>) seems correctly formatted, with two spaces indent for <code>matchLabels</code>, consistent with standards and the rest of the yaml.</p>

<p>The second yaml  is identical, but <code>matchLabels</code> has four spaces. This format  follows <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">the  Kubernetes documentation.</a> (There are no tabs.)</p>

<p>Yet the first yaml <strong>fails</strong> <code>kubectl</code> validation with  <em>error validating "p.yaml": error validating data: ValidationError(NetworkPolicy.spec.egress[0].to[0]): unknown field "matchLabels" in io.k8s.api.networking.v1.NetworkPolicyPeer</em>, and the second <strong>passes</strong> validation.  </p>

<p>This does not pass validation:</p>

<pre><code> apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
   name: internal-policy
 spec:
   podSelector:
     matchLabels:
       name: internal
   policyTypes:
   - Egress
   egress:
   - to:
     - podSelector:
       matchLabels:
         name: mysql
</code></pre>

<p>This passes validation:</p>

<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: internal-policy
spec:
  podSelector:
    matchLabels:
      name: internal
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchLabels:
          name: mysql
</code></pre>

Joshua Fox
<p>Well apparently <code>matchLabels</code> should be a key in the mapping value of <code>podSelector</code>, hence it must be more indented. This:</p>

<pre><code>- podSelector:
  matchLabels:
</code></pre>

<p>Places <code>matchLabels</code> on the same indentation level as <code>podSelector</code>, since the initial <code>-</code> is treated as part of the indentation as per YAML spec. Basically, there are two indentation levels defined here:</p>

<ul>
<li>The level of the sequence, starting with <code>-</code>. All subsequent sequence items must have their <code>-</code> at the same level.</li>
<li>The level of the mapping which is a value of the sequence, starting with <code>p</code>. All subsequent keys of the mapping must start at the same level.</li>
</ul>

<p>Therefore, if you want <code>matchLabels</code> to be nested in <code>podSelector</code>, you must indent it more:</p>

<pre><code>- podSelector:
    matchLabels:
</code></pre>
