NetworkPolicy doesn't match labels as expected.

[CherrySuryp]

Hello K3S community!
I encountered an issue with NetworkPolicy configuration.
I'm trying to understand if it's my error or something wrong with cluster itself so thanks in advance for your help!

K3s Version:

k3s --version
k3s version v1.30.5+k3s1 (9b586704)
go version go1.22.6

Node(s) CPU architecture, OS, and Version:

• OS: Ubuntu 20.04.6 LTS
• 1 master node, 2 worker nodes

Description:
I'm trying to configure Network Policy so app can access specific pods from any namespaces.

I wrote this configuration that should work following kubernetes documentation but it doesn't.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  namespace: grafana
  name: grafana-egress-policy
spec:
  podSelector:
    matchLabels:
      app: grafana
  ingress:
    - {}
  egress:
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              app.kubernetes.io/name: thanos-query
  policyTypes:
  - Egress
  - Ingress

I'm 100% sure that pods with presented labels are exist.

Moreover I also tried this configuration just to make sure that policies are working properly. And yeah! It is working as expected.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  namespace: grafana
  name: grafana-egress-policy
spec:
  podSelector:
    matchLabels:
      app: grafana
  ingress:
    - {}
  egress:
    - to:
        - namespaceSelector: {}
          podSelector: {}
  - Egress
  - Ingress

After it I tried configuring NetworkPolicy to allow access to one specific namespace with following yaml and it is not working also

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  namespace: grafana
  name: grafana-egress-policy
spec:
  podSelector:
    matchLabels:
      app: grafana
  ingress:
    - {}
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: prometheus
  policyTypes:
  - Egress
  - Ingress

So here's a question - maybe something wrong with matching mechanism or something like that? I double checked everything and it seems to me that something's not working as expected