<p>Kubernetes documentation <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#the-networkpolicy-resource" rel="nofollow noreferrer">example here</a> shows how a network policy can be applied  for a source specified by either a pod selector OR a namespace selector. Can I specify a source the fulfills both constraints at the same time.</p>

<p>e.g. Can a source be a pod with label "tier=web" which is deployed in namespace "ingress".</p>

<p><strong>P.S.</strong> For now, I have it working by adding namespace name as pod-labels.</p>

user6317694
<p>Yes, this is possible, but not immediately intuitive. If you look at the <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#behavior-of-to-and-from-selectors" rel="nofollow noreferrer">section below</a> the chunk you linked, it gives a pretty good explanation (this appears to have been added after you asked your question). The NetworkPolicy API documentation <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.12/#networkpolicy-v1-networking-k8s-io" rel="nofollow noreferrer">here</a> is generally helpful as well.</p>

<p>Basically, if you put each selector as two separate items in the list like the example does, it is using a logical OR. If you put them as two items in the same array element in the list (no dash in front of the second item) like the example below to AND the podSelector and namespaceSelector, it will work. It may help to see these in a yaml to json converter.</p>

<p>Here's an ingress chunk from their policy, modified to AND the conditions</p>

<pre><code>      ingress:
      - from:
        - namespaceSelector:
            matchLabels:
              project: myproject
          podSelector:
            matchLabels:
              role: frontend
</code></pre>

<p>This same sort of logic applies to using the <code>ports</code> rule if you use that alongside of the <code>to</code> or <code>from</code> statements. You'll notice in the example that they do not have a dash in front of <code>ports</code> under the ingress rule. If they had put a dash in front, it would OR the conditions of ingress and ports.</p>

<p>Here are some GitHub links from when they were discussing how to implement combining selectors:</p>

<ol>
<li>This comment may give a little more background. The API already supported the OR, so doing it otherwise would've broken some functionality for people with that implemented: <a href="https://github.com/kubernetes/kubernetes/issues/50451#issuecomment-336305625" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/50451#issuecomment-336305625</a></li>
<li><a href="https://github.com/kubernetes/kubernetes/pull/60452" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/pull/60452</a></li>
</ol>
