Typo caused difference in NetworkPolicy yaml file

Check following two networkpolicy yaml file, np1.yaml and np2.yaml:

# np1.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: np namespace: space1 spec: podSelector: {} policyTypes: - Egress egress: - to: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: space2 ports: - port: 53 protocol: UDP - port: 53 protocol: TCP 

# np2.yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: np namespace: space1 spec: podSelector: {} policyTypes: - Egress egress: - to: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: space2 - ports: - port: 53 protocol: TCP - port: 53 protocol: UDP 

Looks similar, but a tiny typo here caused some different results.
If we check carefully will find that in the np2.yaml, it gives two separated restrictions on egress:

1. allows traffic to all pods in the namespace space2 without specifying any ports.
2. allows traffic to any destination on ports 53 (TCP and UDP) -- DNS traffic.

The "-" indicates separate rules in YAML. In the np1.yaml, the two rules are logically OR: Traffic matches if it satisfies either the first rule (namespace match) or the second rule (ports match).

While in the np2.yaml, the to and ports are part of a single rule, which requires traffic to satisfy both constraints (namespace match and port match), literally it's an AND relationship.

In Summary, in np1.yaml it has two rules: egress.to and egress.ports; in np2.yaml there only one rule: egress.to, but under to field, there is a egress.to.ports field.