Kubernetes / Services, DNS & Traffic Routing
Diagnose a cross-namespace policy selector mismatch
A permitted application label alone may not match a policy that combines namespace and Pod selectors differently than intended.
Environment and inputs: Kubernetes · kubectl with supported client/server versions and delegated RBAC. Examples use namespace app unless noted. Check context, namespace, APIs and provider support first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
kubectl get namespaces --show-labels
kubectl -n app describe networkpolicy web-accessRead the result
The namespace labels and policy description help interpret the exact selector structure. Separate selector entries can mean different logic from fields in one entry.
Resolve and verify
Compare the approved caller namespace and Pod labels with the policy's actual semantics. Correct the specific selector and test a representative cross-namespace request.
Before changing production
Do not label every namespace as trusted or widen access to the whole cluster to resolve one mismatch.