# In a NetworkPolicy ingress rule, what is the difference between putting namespaceSelector and podSelector in the same 'from' entry and putting them in two separate entries?

Kubernetes, Hard (Expert), Security. https://k8wiz.com/uquiz/in-a-networkpolicy-ingress-rule-what-is-the-difference-between-putting-namespaceselector-and-podselector-in-the-same-from-entry

- A. One entry means both must match (AND). Two entries mean either can match (OR)
- B. One entry means either can match (OR). Two entries mean both must match (AND)
- C. There is no difference
- D. The API server rejects two separate entries

**Answer:** One entry means both must match (AND). Two entries mean either can match (OR)

**Explanation:** Inside a single 'from' entry the selectors combine, so the source must be a matching pod in a matching namespace. As separate list items, each one is its own allow rule: any pod in a matching namespace, or a matching pod in the policy's own namespace. One missing '-' in the YAML turns one form into the other, which is a common cause of policies that allow far more than intended.