NetworkPolicy: Why are pod selectors used over "service selectors"?
Pods is the deployment unit in Kubernetes and it is also the unit that gets a single unique IP address within the cluster.
You can access Pods without going via a Service. A Service is mostly there to get a &quot;stable&quot; address for an application, where the traffic is then load balanced to any Pod representing the Service. Both Pods and Services gets a DNS name in the cluster.
A Service has a selector to identify what Pods belong to the Service, but a Pod can receive traffic from multiple Services. In the same way a NetworkPolicy has a selector to select the Pods where it is applied.
Since a Pod is the smallest unit in Kubernetes, that gets its own unique network address it also makes sense to add the network security (e.g. Network Policies) at this level.