NetworkPolicy podSelector matches on a running Pod's labels, re-evaluated continuously, not fixed at creation

Patch the label a restrictive NetworkPolicy selects on to a value outside its selector

The same running Pod, same IP, same containers, is no longer covered by that policy's ingress/egress rules

Traffic that was blocked moments earlier now flows, with no image or spec change at all