From 411ecca94de0d7272549b44d363ada174b753b0d Mon Sep 17 00:00:00 2001 From: Dan Winship Date: Mon, 15 May 2017 10:17:49 -0400 Subject: [PATCH] Clarify NetworkPolicy's "destination" podSelector a bit --- docs/concepts/services-networking/networkpolicies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/concepts/services-networking/networkpolicies.md b/docs/concepts/services-networking/networkpolicies.md index 56d6530214..ff2b2ee2e1 100644 --- a/docs/concepts/services-networking/networkpolicies.md +++ b/docs/concepts/services-networking/networkpolicies.md @@ -50,7 +50,7 @@ __Mandatory Fields__: As with all other Kubernetes config, a `NetworkPolicy` nee __spec__: `NetworkPolicy` [spec](https://github.com/kubernetes/kubernetes/tree/{{page.githubbranch}}/docs/devel/api-conventions.md#spec-and-status) has all the information needed to define a particular network policy in the given namespace. -__podSelector__: Each `NetworkPolicy` includes a `podSelector` which selects the grouping of pods to which the `ingress` rules in the policy apply. The example policy selects pods with the label "role=db". +__podSelector__: Each `NetworkPolicy` includes a `podSelector` which selects the grouping of pods to which the policy applies. Since `NetworkPolicy` currently only supports definining `ingress` rules, this `podSelector` essentially defines the "destination pods" for the policy. The example policy selects pods with the label "role=db". An empty `podSelector` selects all pods in the namespace. __ingress__: Each `NetworkPolicy` includes a list of whitelist `ingress` rules. Each rule allows traffic which matches both the `from` and `ports` sections. The example policy contains a single rule, which matches traffic on a single port, from either of two sources, the first specified via a `namespaceSelector` and the second specified via a `podSelector`.