Network Policy not applied when podSelector labels differ from selector in target service

[der-eismann]

What happened:
We started to use network policies like described in the guide. We locked down a pod to only allow access to certain other pods and while most of the policies worked fine, one outside pod was unreachable even though we allowed it.
We enabled network policy logs and weirdly enough we could see that the working pods were accessed through their pod IP while the blocked one was accessed through the service IP.

The network policy:

    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: service-a
      ports:
        - port: 8080
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: service-b
      ports:
        - port: 8080

Working connection to service-a using pod IP:
{"level":"debug","ts":"2026-02-23T14:19:09.129Z","caller":"runtime/asm_amd64.s:1693","msg":"Flow Info: Src IP: 172.22.27.90 Src Port: 59838 Dest IP: 172.22.26.253 Dest Port: 8080 Proto TCP Verdict ACCEPT Direction ingress, Tier DEFAULT"}
Broken connection to service-b using service IP:
{"level":"info","ts":"2026-02-23T14:09:22.250Z","caller":"runtime/asm_amd64.s:1693","msg":"Flow Info: Src IP: 172.22.27.90 Src Port: 41398 Dest IP: 10.10.134.38 Dest Port: 80 Proto TCP Verdict DENY Direction egress, Tier NETWORK_POLICY"}

We ensured that service-b has the label from the selector:

  labels:
    app: service-b
    app.kubernetes.io/instance: service-b-default
    app.kubernetes.io/name: service-b
    app.kubernetes.io/version: default

BUT: The k8s service for service-b used a different selector:

spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: service-b

After changing the network policy to use the same selector it suddenly started to work and access to service-b was allowed:

    - to:
        - podSelector:
            matchLabels:
              app: service-b
      ports:
        - port: 8080

Attach logs

What you expected to happen:

A working policy because it should count that the labels matching the target pod, not that the labels are equal to the k8s service.

How to reproduce it (as minimally and precisely as possible):

1. Have pod-a with multiple labels
2. Create a k8s service to access it using a label as selector
3. Create a network policy for a different pod-b to access it using a second label from pod-a as selector
4. See the policy not matching

Anything else we need to know?:

Environment:

• Kubernetes version (use kubectl version): v1.34.3-eks-ac2d5a0
• CNI Version: v1.21.1-eksbuild.1
• OS (e.g: cat /etc/os-release): Bottlerocket OS 1.53.0 (aws-k8s-1.34)
• Kernel (e.g. uname -a): 6.12.63 aws/amazon-vpc-cni-k8s#1 SMP PREEMPT_DYNAMIC Wed Jan 7 22:06:12 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux

[Issacwww]

Thx for reporting, We will investigate and reproduce it.

[cdirubbio]

Looked into this.. In my repro, we have denies to my Service Cluster IP as seen below:

> tail -f network-policy-agent.log | grep 10.100.52.106
{"level":"info","ts":"2026-03-18T19:52:26.902Z","caller":"runtime/asm_amd64.s:1693","msg":"Flow Info: Src IP: 172.31.101.179 Src Port: 56650 Dest IP: 10.100.52.106 Dest Port: 80 Proto TCP Verdict DENY Direction egress, Tier NETWORK_POLICY"}
{"level":"info","ts":"2026-03-18T19:52:43.542Z","caller":"runtime/asm_amd64.s:1693","msg":"Flow Info: Src IP: 172.31.101.179 Src Port: 56650 Dest IP: 10.100.52.106 Dest Port: 80 Proto TCP Verdict DENY Direction egress, Tier NETWORK_POLICY"}

This means there is no ClusterIP in the PolicyEndpoint (checked PE as well). In getMatchingServiceIPs function of resolvers/endpoints.go, we have following code:

        // do not add services if their pod selector is not matching with the pod selector defined in the network policy
        if !svcSelector.Matches(labels.Set(svc.Spec.Selector)) {

In NPC logs we can see this podSelector (and thus the ClusterIP) is skipped since service-b podselector != netPol podSelector:

"msg":"skipping pod selector mismatched service when populating EndpointInfo","serviceName":"service-b","serviceNamespace":"netpol-bug-repro","expectedPS":"app.kubernetes.io/name=service-b"}

## Service Selector
  selector:
 app: service-b

## NetworkPolicy Selector
      to:
      - podSelector:
          matchLabels:
            app.kubernetes.io/name: service-b

---

Given this, in the current state this is not supported.

[cdirubbio]

Readme pr merged, closing