<p>The <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#networkpolicyingressrule-v1-networking-k8s-io" rel="nofollow noreferrer">K8s documentation on NetworkPolicy</a> states that if the <code>spec.ingress.from.ports</code> array is not specified, traffic is allowed from any <code>port</code> for the matching <code>peers</code> array:</p>
<blockquote>
<p>List of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. <strong>If this field is empty or missing, this rule matches all ports (traffic not restricted by port)</strong>. If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.</p>
</blockquote>
<p>But what if one of the <code>port</code> items inside of <code>ports</code> is created like this?</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: empty-port-item-network-policy
  namespace: some-namespace
spec:
  podSelector:
    matchLabels:
      app: front
  ingress:
    - from:
      - podSelector: {}

      ports:
        - {}
</code></pre>
<p>When I <code>describe</code> this NetworkPolicy, I don't get enough information (ignore <code>PodSelector=none</code>):</p>
<pre><code>Created on:   2023-01-02 18:58:32 +0200 IST
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
Spec:
  PodSelector:     app=front
  Allowing ingress traffic:
    To Port: &lt;nil&gt;/TCP
    From:
      PodSelector: &lt;none&gt;
  Not affecting egress traffic
  Policy Types: Ingress
</code></pre>
<p>What does <code>To Port: &lt;nil&gt;/TCP</code> mean here? Any port? all ports?</p>

zerohedge
<p>You are passing an empty array to the ports when using:</p>
<pre><code>  ports:
    - {}
</code></pre>
<p>This means that no ports are allowed. Everything is blocked.</p>
<p>When omitting the ports entry, you would allow traffic to all ports.
kubectl describe output:</p>
<pre><code>  Allowing ingress traffic:
    To Port: &lt;any&gt; (traffic allowed to all ports)
</code></pre>
<p>The yaml would be something like this:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: empty-port-item-network-policy
  namespace: some-namespace
spec:
  podSelector:
    matchLabels:
      app: front
  ingress:
    - from:
      - podSelector: {}
</code></pre>
