<p>We have a default deny-all-egress policy for all pods and we have an egress-internet policy like below</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-external-egress-internet
spec:
  podSelector:
    matchLabels:
      egress: internet
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
</code></pre>
<p>Now, if I try to add multiple labels under <code>spec/podselector/matchlabels</code> everything breaks. Is there a way for this network policy to get implemented on pods with label <code>egress: internet</code> OR <code>foo:bar</code>.</p>
<p>A pod with just <code>foo:bar</code> as label should be allowed but it's not working that way.</p>

mbxzxz
<p>You can add multiple key-values to podSelector.matchLabels.<br />
See <a href="https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/10-allowing-traffic-with-multiple-selectors.md" rel="nofollow noreferrer">https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/10-allowing-traffic-with-multiple-selectors.md</a></p>
<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: redis-allow-services
spec:
  podSelector:
    matchLabels:
      app: bookstore
      role: db
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: bookstore
          role: search
    - podSelector:
        matchLabels:
          app: bookstore
          role: api
    - podSelector:
        matchLabels:
          app: inventory
          role: web
</code></pre>
