From d4d8c51c12fe57176ba69bb13098fcc06bb25b82 Mon Sep 17 00:00:00 2001
From: Chris Tauchen <chris.tauchen@tigera.io>
Date: Thu, 8 Oct 2026 16:49:49 +0100
Subject: [PATCH 1/4] Recommend kubernetes.io/metadata.name in Calico 3.31-3.33

---
 .../_includes/content/_entityrule.mdx         |  2 +-
 .../about-network-policy.mdx                  |  2 +-
 .../calico-policy/calico-labels.mdx           | 26 +++++++++++--------
 .../_includes/content/_entityrule.mdx         |  2 +-
 .../about-network-policy.mdx                  |  2 +-
 .../calico-policy/calico-labels.mdx           | 26 +++++++++++--------
 .../_includes/content/_entityrule.mdx         |  2 +-
 .../about-network-policy.mdx                  |  2 +-
 .../calico-policy/calico-labels.mdx           | 26 +++++++++++--------
 9 files changed, 51 insertions(+), 39 deletions(-)

diff --git a/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx
index 10a6f77c1f..e29a5bbcfb 100644
--- a/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx
+++ b/calico_versioned_docs/version-3.31/_includes/content/_entityrule.mdx
@@ -16,7 +16,7 @@ for the rule as a whole to match a packet.
 | notNets           | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs                               |
 | selector          | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selectors)                      |         |
 | notSelector       | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selectors)                      |         |
-| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `projectcalico.org/name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selectors)                      |         |
+| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selectors)                      |         |
 | ports             | Positive match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
 | notPorts          | Negative match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
 | serviceAccounts   | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                        |                                                                                                           | [ServiceAccountMatch](#serviceaccountmatch) |         |
diff --git a/calico_versioned_docs/version-3.31/about/kubernetes-training/about-network-policy.mdx b/calico_versioned_docs/version-3.31/about/kubernetes-training/about-network-policy.mdx
index 0562817db5..60edaeda35 100644
--- a/calico_versioned_docs/version-3.31/about/kubernetes-training/about-network-policy.mdx
+++ b/calico_versioned_docs/version-3.31/about/kubernetes-training/about-network-policy.mdx
@@ -212,7 +212,7 @@ kind: GlobalNetworkPolicy
 metadata:
   name: default-app-policy
 spec:
-  namespaceSelector: has(projectcalico.org/name) && projectcalico.org/name not in {"kube-system", "calico-system", "calico-apiserver"}
+  namespaceSelector: has(kubernetes.io/metadata.name) && kubernetes.io/metadata.name not in {"kube-system", "calico-system", "calico-apiserver"}
   types:
     - Ingress
     - Egress
diff --git a/calico_versioned_docs/version-3.31/network-policy/get-started/calico-policy/calico-labels.mdx b/calico_versioned_docs/version-3.31/network-policy/get-started/calico-policy/calico-labels.mdx
index 1c01154fcf..d1c9297e47 100644
--- a/calico_versioned_docs/version-3.31/network-policy/get-started/calico-policy/calico-labels.mdx
+++ b/calico_versioned_docs/version-3.31/network-policy/get-started/calico-policy/calico-labels.mdx
@@ -4,11 +4,11 @@ description: Calico automatic labels for use with resources.
 
 # Calico automatic labels
 
-As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies. The labels make it easier to match resources in common ways (such as matching a namespace by name).
+As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies, and works with the labels Kubernetes applies automatically. The labels make it easier to match resources in common ways (such as matching a namespace by name).
 
 ## Labels for matching namespaces
 
-The label `projectcalico.org/name` is set to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
+Kubernetes sets the label `kubernetes.io/metadata.name` to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
 
 For example, the following GlobalNetworkPolicy applies to workloads with label, `color: red` in namespaces named, `"foo"` and `"bar"`. The policy allows ingress traffic to port 8080 from all workloads in a third namespace named, `"baz"`:
 
@@ -18,14 +18,14 @@ kind: GlobalNetworkPolicy
 metadata:
   name: foo-and-bar
 spec:
-  namespaceSelector: projectcalico.org/name in {"foo", "bar"}
+  namespaceSelector: kubernetes.io/metadata.name in {"foo", "bar"}
   selector: color == "red"
   types:
   - Ingress
   ingress:
   - action: Allow
     source:
-      namespaceSelector: projectcalico.org/name == "baz"
+      namespaceSelector: kubernetes.io/metadata.name == "baz"
     destination:
       ports:
       - 8080
@@ -52,7 +52,7 @@ means "resources in any namespace and non-namespaced resources that match foo ==
 Further,
 
    ```yaml
-   namespaceSelector: projectcalico.org/name == "some-namespace"
+   namespaceSelector: kubernetes.io/metadata.name == "some-namespace"
    selector: foo == "bar"
    ```
 is equivalent to:
@@ -64,11 +64,14 @@ is equivalent to:
 
 ### Labels for matching service accounts
 
-Similarly, the `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`.
+The `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`. Kubernetes has no equivalent automatic label for ServiceAccounts, so use `projectcalico.org/name` here.
 
-### Kubernetes labels for matching namespaces
+### The projectcalico.org/name label for namespaces {/* #projectcalico-name-label-for-namespaces */}
 
-Kubernetes also has [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), for example `kubernetes.io/metadata.name`. The Kubernetes namespace label serves the same purpose and can be used in the same way as the $[prodname] label. The `projectcalico.org/name` label predates the automatic Kubernetes label.
+$[prodname] also sets `projectcalico.org/name` to the name of the namespace, and it can be used in a `namespaceSelector` in the same way.
+It predates the Kubernetes [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling),
+and $[prodname] derives it as it reads the namespace rather than storing it on the object, so `kubectl get namespace --show-labels` does not show it.
+For matching namespaces, prefer `kubernetes.io/metadata.name`.
 
 ## Labels for matching workload endpoints
 
@@ -79,7 +82,7 @@ WorkloadEndpoints (which represent Pods in Kubernetes, or VM instances in OpenSt
 * `has(projectcalico.org/orchestrator)` matches only WorkloadEndpoints
 * `projectcalico.org/orchestrator == "k8s"` matches only Kubernetes Pods
 
-* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as the `projectcalico.org/name` label in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
+* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as matching `kubernetes.io/metadata.name` in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
 
 ```yaml
 apiVersion: projectcalico.org/v3
@@ -103,8 +106,9 @@ spec:
 
 $[prodname] labels must be used with the correct selector or the policy will not work as designed (and there are no error messages in the web console or when applying the YAML).
 
-| Calico label         | Usage requirements                                              | Use in these resources...           |
+| Label                | Usage requirements                                              | Use in these resources...           |
 | --------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
-| `projectcalico.org/name`                                     | Use with a **namespaceSelector** or **serviceAccountSelector**. | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `kubernetes.io/metadata.name`                                | Use with a **namespaceSelector**.                            | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `projectcalico.org/name`                                     | Use with a **serviceAccountSelector**, or with a **namespaceSelector** (prefer `kubernetes.io/metadata.name` for namespaces). | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
 | `projectcalico.org/namespace`                                | Use only with selectors. <br /><br />Use the label as the label name, and a namespace name as the value to compare against (for example projectcalico.org/namespace == "default"). | - Global network policy<br />- Staged global network policy<br /><br />Cluster-wide (non-namespaced) resources that apply to workload endpoint resources in all namespaces, and to host endpoint resources. |
 
diff --git a/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx
index 10a6f77c1f..e29a5bbcfb 100644
--- a/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx
+++ b/calico_versioned_docs/version-3.32/_includes/content/_entityrule.mdx
@@ -16,7 +16,7 @@ for the rule as a whole to match a packet.
 | notNets           | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs                               |
 | selector          | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selectors)                      |         |
 | notSelector       | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selectors)                      |         |
-| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `projectcalico.org/name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selectors)                      |         |
+| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selectors)                      |         |
 | ports             | Positive match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
 | notPorts          | Negative match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
 | serviceAccounts   | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                        |                                                                                                           | [ServiceAccountMatch](#serviceaccountmatch) |         |
diff --git a/calico_versioned_docs/version-3.32/about/kubernetes-training/about-network-policy.mdx b/calico_versioned_docs/version-3.32/about/kubernetes-training/about-network-policy.mdx
index 4e54c5d089..02a6e5ca33 100644
--- a/calico_versioned_docs/version-3.32/about/kubernetes-training/about-network-policy.mdx
+++ b/calico_versioned_docs/version-3.32/about/kubernetes-training/about-network-policy.mdx
@@ -212,7 +212,7 @@ kind: GlobalNetworkPolicy
 metadata:
   name: default-app-policy
 spec:
-  namespaceSelector: has(projectcalico.org/name) && projectcalico.org/name not in {"kube-system", "calico-system", "calico-apiserver"}
+  namespaceSelector: has(kubernetes.io/metadata.name) && kubernetes.io/metadata.name not in {"kube-system", "calico-system", "calico-apiserver"}
   types:
     - Ingress
     - Egress
diff --git a/calico_versioned_docs/version-3.32/network-policy/get-started/calico-policy/calico-labels.mdx b/calico_versioned_docs/version-3.32/network-policy/get-started/calico-policy/calico-labels.mdx
index bf19a137e4..d77cc9af6f 100644
--- a/calico_versioned_docs/version-3.32/network-policy/get-started/calico-policy/calico-labels.mdx
+++ b/calico_versioned_docs/version-3.32/network-policy/get-started/calico-policy/calico-labels.mdx
@@ -4,11 +4,11 @@ description: Reference list of automatic labels Calico Open Source attaches to r
 
 # Calico automatic labels
 
-As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies. The labels make it easier to match resources in common ways (such as matching a namespace by name).
+As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies, and works with the labels Kubernetes applies automatically. The labels make it easier to match resources in common ways (such as matching a namespace by name).
 
 ## Labels for matching namespaces
 
-The label `projectcalico.org/name` is set to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
+Kubernetes sets the label `kubernetes.io/metadata.name` to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
 
 For example, the following GlobalNetworkPolicy applies to workloads with label, `color: red` in namespaces named, `"foo"` and `"bar"`. The policy allows ingress traffic to port 8080 from all workloads in a third namespace named, `"baz"`:
 
@@ -18,14 +18,14 @@ kind: GlobalNetworkPolicy
 metadata:
   name: foo-and-bar
 spec:
-  namespaceSelector: projectcalico.org/name in {"foo", "bar"}
+  namespaceSelector: kubernetes.io/metadata.name in {"foo", "bar"}
   selector: color == "red"
   types:
   - Ingress
   ingress:
   - action: Allow
     source:
-      namespaceSelector: projectcalico.org/name == "baz"
+      namespaceSelector: kubernetes.io/metadata.name == "baz"
     destination:
       ports:
       - 8080
@@ -52,7 +52,7 @@ means "resources in any namespace and non-namespaced resources that match foo ==
 Further,
 
    ```yaml
-   namespaceSelector: projectcalico.org/name == "some-namespace"
+   namespaceSelector: kubernetes.io/metadata.name == "some-namespace"
    selector: foo == "bar"
    ```
 is equivalent to:
@@ -64,11 +64,14 @@ is equivalent to:
 
 ### Labels for matching service accounts
 
-Similarly, the `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`.
+The `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`. Kubernetes has no equivalent automatic label for ServiceAccounts, so use `projectcalico.org/name` here.
 
-### Kubernetes labels for matching namespaces
+### The projectcalico.org/name label for namespaces {/* #projectcalico-name-label-for-namespaces */}
 
-Kubernetes also has [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), for example `kubernetes.io/metadata.name`. The Kubernetes namespace label serves the same purpose and can be used in the same way as the $[prodname] label. The `projectcalico.org/name` label predates the automatic Kubernetes label.
+$[prodname] also sets `projectcalico.org/name` to the name of the namespace, and it can be used in a `namespaceSelector` in the same way.
+It predates the Kubernetes [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling),
+and $[prodname] derives it as it reads the namespace rather than storing it on the object, so `kubectl get namespace --show-labels` does not show it.
+For matching namespaces, prefer `kubernetes.io/metadata.name`.
 
 ## Labels for matching workload endpoints
 
@@ -79,7 +82,7 @@ WorkloadEndpoints (which represent Pods in Kubernetes, or VM instances in OpenSt
 * `has(projectcalico.org/orchestrator)` matches only WorkloadEndpoints
 * `projectcalico.org/orchestrator == "k8s"` matches only Kubernetes Pods
 
-* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as the `projectcalico.org/name` label in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
+* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as matching `kubernetes.io/metadata.name` in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
 
 ```yaml
 apiVersion: projectcalico.org/v3
@@ -103,8 +106,9 @@ spec:
 
 $[prodname] labels must be used with the correct selector or the policy will not work as designed (and there are no error messages in the web console or when applying the YAML).
 
-| Calico label         | Usage requirements                                              | Use in these resources...           |
+| Label                | Usage requirements                                              | Use in these resources...           |
 | --------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
-| `projectcalico.org/name`                                     | Use with a **namespaceSelector** or **serviceAccountSelector**. | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `kubernetes.io/metadata.name`                                | Use with a **namespaceSelector**.                            | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `projectcalico.org/name`                                     | Use with a **serviceAccountSelector**, or with a **namespaceSelector** (prefer `kubernetes.io/metadata.name` for namespaces). | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
 | `projectcalico.org/namespace`                                | Use only with selectors. <br /><br />Use the label as the label name, and a namespace name as the value to compare against (for example projectcalico.org/namespace == "default"). | - Global network policy<br />- Staged global network policy<br /><br />Cluster-wide (non-namespaced) resources that apply to workload endpoint resources in all namespaces, and to host endpoint resources. |
 
diff --git a/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx b/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx
index 10a6f77c1f..e29a5bbcfb 100644
--- a/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx
+++ b/calico_versioned_docs/version-3.33/_includes/content/_entityrule.mdx
@@ -16,7 +16,7 @@ for the rule as a whole to match a packet.
 | notNets           | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs                               |
 | selector          | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selectors)                      |         |
 | notSelector       | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selectors)                      |         |
-| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `projectcalico.org/name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selectors)                      |         |
+| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selectors)                      |         |
 | ports             | Positive match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
 | notPorts          | Negative match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
 | serviceAccounts   | Match endpoints running under service accounts. If a `namespaceSelector` is also defined, the set of service accounts this applies to is limited to the service accounts in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                        |                                                                                                           | [ServiceAccountMatch](#serviceaccountmatch) |         |
diff --git a/calico_versioned_docs/version-3.33/about/kubernetes-training/about-network-policy.mdx b/calico_versioned_docs/version-3.33/about/kubernetes-training/about-network-policy.mdx
index 4e54c5d089..02a6e5ca33 100644
--- a/calico_versioned_docs/version-3.33/about/kubernetes-training/about-network-policy.mdx
+++ b/calico_versioned_docs/version-3.33/about/kubernetes-training/about-network-policy.mdx
@@ -212,7 +212,7 @@ kind: GlobalNetworkPolicy
 metadata:
   name: default-app-policy
 spec:
-  namespaceSelector: has(projectcalico.org/name) && projectcalico.org/name not in {"kube-system", "calico-system", "calico-apiserver"}
+  namespaceSelector: has(kubernetes.io/metadata.name) && kubernetes.io/metadata.name not in {"kube-system", "calico-system", "calico-apiserver"}
   types:
     - Ingress
     - Egress
diff --git a/calico_versioned_docs/version-3.33/network-policy/get-started/calico-policy/calico-labels.mdx b/calico_versioned_docs/version-3.33/network-policy/get-started/calico-policy/calico-labels.mdx
index bf19a137e4..d77cc9af6f 100644
--- a/calico_versioned_docs/version-3.33/network-policy/get-started/calico-policy/calico-labels.mdx
+++ b/calico_versioned_docs/version-3.33/network-policy/get-started/calico-policy/calico-labels.mdx
@@ -4,11 +4,11 @@ description: Reference list of automatic labels Calico Open Source attaches to r
 
 # Calico automatic labels
 
-As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies. The labels make it easier to match resources in common ways (such as matching a namespace by name).
+As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies, and works with the labels Kubernetes applies automatically. The labels make it easier to match resources in common ways (such as matching a namespace by name).
 
 ## Labels for matching namespaces
 
-The label `projectcalico.org/name` is set to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
+Kubernetes sets the label `kubernetes.io/metadata.name` to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
 
 For example, the following GlobalNetworkPolicy applies to workloads with label, `color: red` in namespaces named, `"foo"` and `"bar"`. The policy allows ingress traffic to port 8080 from all workloads in a third namespace named, `"baz"`:
 
@@ -18,14 +18,14 @@ kind: GlobalNetworkPolicy
 metadata:
   name: foo-and-bar
 spec:
-  namespaceSelector: projectcalico.org/name in {"foo", "bar"}
+  namespaceSelector: kubernetes.io/metadata.name in {"foo", "bar"}
   selector: color == "red"
   types:
   - Ingress
   ingress:
   - action: Allow
     source:
-      namespaceSelector: projectcalico.org/name == "baz"
+      namespaceSelector: kubernetes.io/metadata.name == "baz"
     destination:
       ports:
       - 8080
@@ -52,7 +52,7 @@ means "resources in any namespace and non-namespaced resources that match foo ==
 Further,
 
    ```yaml
-   namespaceSelector: projectcalico.org/name == "some-namespace"
+   namespaceSelector: kubernetes.io/metadata.name == "some-namespace"
    selector: foo == "bar"
    ```
 is equivalent to:
@@ -64,11 +64,14 @@ is equivalent to:
 
 ### Labels for matching service accounts
 
-Similarly, the `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`.
+The `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`. Kubernetes has no equivalent automatic label for ServiceAccounts, so use `projectcalico.org/name` here.
 
-### Kubernetes labels for matching namespaces
+### The projectcalico.org/name label for namespaces {/* #projectcalico-name-label-for-namespaces */}
 
-Kubernetes also has [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), for example `kubernetes.io/metadata.name`. The Kubernetes namespace label serves the same purpose and can be used in the same way as the $[prodname] label. The `projectcalico.org/name` label predates the automatic Kubernetes label.
+$[prodname] also sets `projectcalico.org/name` to the name of the namespace, and it can be used in a `namespaceSelector` in the same way.
+It predates the Kubernetes [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling),
+and $[prodname] derives it as it reads the namespace rather than storing it on the object, so `kubectl get namespace --show-labels` does not show it.
+For matching namespaces, prefer `kubernetes.io/metadata.name`.
 
 ## Labels for matching workload endpoints
 
@@ -79,7 +82,7 @@ WorkloadEndpoints (which represent Pods in Kubernetes, or VM instances in OpenSt
 * `has(projectcalico.org/orchestrator)` matches only WorkloadEndpoints
 * `projectcalico.org/orchestrator == "k8s"` matches only Kubernetes Pods
 
-* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as the `projectcalico.org/name` label in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
+* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as matching `kubernetes.io/metadata.name` in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
 
 ```yaml
 apiVersion: projectcalico.org/v3
@@ -103,8 +106,9 @@ spec:
 
 $[prodname] labels must be used with the correct selector or the policy will not work as designed (and there are no error messages in the web console or when applying the YAML).
 
-| Calico label         | Usage requirements                                              | Use in these resources...           |
+| Label                | Usage requirements                                              | Use in these resources...           |
 | --------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
-| `projectcalico.org/name`                                     | Use with a **namespaceSelector** or **serviceAccountSelector**. | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `kubernetes.io/metadata.name`                                | Use with a **namespaceSelector**.                            | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `projectcalico.org/name`                                     | Use with a **serviceAccountSelector**, or with a **namespaceSelector** (prefer `kubernetes.io/metadata.name` for namespaces). | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
 | `projectcalico.org/namespace`                                | Use only with selectors. <br /><br />Use the label as the label name, and a namespace name as the value to compare against (for example projectcalico.org/namespace == "default"). | - Global network policy<br />- Staged global network policy<br /><br />Cluster-wide (non-namespaced) resources that apply to workload endpoint resources in all namespaces, and to host endpoint resources. |
 

From b6b448d1e09c25d96871e52ad6b836fe008bc986 Mon Sep 17 00:00:00 2001
From: Chris Tauchen <chris.tauchen@tigera.io>
Date: Thu, 8 Oct 2026 16:49:49 +0100
Subject: [PATCH 2/4] Recommend kubernetes.io/metadata.name in Calico
 Enterprise 3.21-3.24

---
 .../_includes/content/_entityrule.mdx         |  2 +-
 .../beginners/calico-labels.mdx               | 23 ++++++++++---------
 .../network-policy/default-deny.mdx           |  2 +-
 .../network-policy/policy-best-practices.mdx  |  4 ++--
 .../networking/egress/egress-gateway-aws.mdx  |  8 +++----
 .../egress/egress-gateway-azure.mdx           |  8 +++----
 .../egress/egress-gateway-maintenance.mdx     |  4 ++--
 .../egress/egress-gateway-on-prem.mdx         |  8 +++----
 .../networking/egress/troubleshoot.mdx        |  4 ++--
 .../resources/egressgatewaypolicy.mdx         |  4 ++--
 .../resources/globalnetworkpolicy.mdx         |  2 +-
 .../resources/stagedglobalnetworkpolicy.mdx   |  2 +-
 .../_includes/content/_entityrule.mdx         |  2 +-
 .../beginners/calico-labels.mdx               | 23 ++++++++++---------
 .../network-policy/default-deny.mdx           |  2 +-
 .../network-policy/policy-best-practices.mdx  |  4 ++--
 .../networking/egress/egress-gateway-aws.mdx  |  8 +++----
 .../egress/egress-gateway-azure.mdx           |  8 +++----
 .../egress/egress-gateway-maintenance.mdx     |  4 ++--
 .../egress/egress-gateway-on-prem.mdx         |  8 +++----
 .../networking/egress/troubleshoot.mdx        |  4 ++--
 .../resources/egressgatewaypolicy.mdx         |  4 ++--
 .../resources/globalnetworkpolicy.mdx         |  2 +-
 .../resources/stagedglobalnetworkpolicy.mdx   |  2 +-
 .../_includes/content/_entityrule.mdx         |  2 +-
 .../beginners/calico-labels.mdx               | 23 ++++++++++---------
 .../network-policy/default-deny.mdx           |  2 +-
 .../network-policy/policy-best-practices.mdx  |  4 ++--
 .../networking/egress/egress-gateway-aws.mdx  |  8 +++----
 .../egress/egress-gateway-azure.mdx           |  8 +++----
 .../egress/egress-gateway-maintenance.mdx     |  4 ++--
 .../egress/egress-gateway-on-prem.mdx         |  8 +++----
 .../networking/egress/troubleshoot.mdx        |  4 ++--
 .../resources/egressgatewaypolicy.mdx         |  4 ++--
 .../resources/globalnetworkpolicy.mdx         |  2 +-
 .../resources/stagedglobalnetworkpolicy.mdx   |  2 +-
 .../_includes/content/_entityrule.mdx         |  2 +-
 .../beginners/calico-labels.mdx               | 23 ++++++++++---------
 .../network-policy/default-deny.mdx           |  2 +-
 .../network-policy/policy-best-practices.mdx  |  4 ++--
 .../networking/egress/egress-gateway-aws.mdx  |  8 +++----
 .../egress/egress-gateway-azure.mdx           |  8 +++----
 .../egress/egress-gateway-maintenance.mdx     |  4 ++--
 .../egress/egress-gateway-on-prem.mdx         |  8 +++----
 .../networking/egress/troubleshoot.mdx        |  4 ++--
 .../create-ingress-gateway.mdx                |  4 ++--
 .../resources/egressgatewaypolicy.mdx         |  4 ++--
 .../resources/globalnetworkpolicy.mdx         |  2 +-
 .../resources/stagedglobalnetworkpolicy.mdx   |  2 +-
 49 files changed, 146 insertions(+), 142 deletions(-)

diff --git a/calico-enterprise_versioned_docs/version-3.21-2/_includes/content/_entityrule.mdx b/calico-enterprise_versioned_docs/version-3.21-2/_includes/content/_entityrule.mdx
index c770ef194a..b0046b81b0 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/_includes/content/_entityrule.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/_includes/content/_entityrule.mdx
@@ -18,7 +18,7 @@ for the rule as a whole to match a packet.
 | notNets           | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs                               |
 | selector          | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selector)                       |         |
 | notSelector       | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selector)                       |         |
-| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `projectcalico.org/name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selector)                       |         |
+| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selector)                       |         |
 | ports             | Positive match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
 | domains           | Positive match on [domain names](#exact-and-wildcard-domain-names).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | List of [exact or wildcard domain names](#exact-and-wildcard-domain-names)                                | list of strings                             |
 | notPorts          | Negative match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/network-policy/beginners/calico-labels.mdx b/calico-enterprise_versioned_docs/version-3.21-2/network-policy/beginners/calico-labels.mdx
index b2a96e8349..c6b034942b 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/network-policy/beginners/calico-labels.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/network-policy/beginners/calico-labels.mdx
@@ -4,11 +4,11 @@ description: Calico Enterprise automatic labels for use with resources.
 
 # Calico Enterprise automatic labels
 
-As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies. The labels make it easier to match resources in common ways (such as matching a namespace by name).
+As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies, and works with the labels Kubernetes applies automatically. The labels make it easier to match resources in common ways (such as matching a namespace by name).
 
 ## Labels for matching namespaces
 
-The label `projectcalico.org/name` is set to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
+Kubernetes sets the label `kubernetes.io/metadata.name` to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
 
 For example, the following GlobalNetworkPolicy applies to workloads with label, `color: red` in namespaces named, `"foo"` and `"bar"`. The policy allows ingress traffic to port 8080 from all workloads in a third namespace named, `"baz"`:
 
@@ -18,14 +18,14 @@ kind: GlobalNetworkPolicy
 metadata:
   name: foo-and-bar
 spec:
-  namespaceSelector: projectcalico.org/name in {"foo", "bar"}
+  namespaceSelector: kubernetes.io/metadata.name in {"foo", "bar"}
   selector: color == "red"
   types:
   - Ingress
   ingress:
   - action: Allow
     source:
-      namespaceSelector: projectcalico.org/name == "baz"
+      namespaceSelector: kubernetes.io/metadata.name == "baz"
     destination:
       ports:
       - 8080
@@ -52,7 +52,7 @@ means "resources in any namespace and non-namespaced resources that match foo ==
 Further,
 
    ```yaml
-   namespaceSelector: projectcalico.org/name == "some-namespace"
+   namespaceSelector: kubernetes.io/metadata.name == "some-namespace"
    selector: foo == "bar"
    ```
 is equivalent to:
@@ -64,11 +64,11 @@ is equivalent to:
 
 ### Labels for matching service accounts
 
-Similarly, the `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`.
+The `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`. Kubernetes has no equivalent automatic label for ServiceAccounts, so use `projectcalico.org/name` here.
 
-### Kubernetes labels for matching namespaces
+### The projectcalico.org/name label for namespaces {/* #projectcalico-name-label-for-namespaces */}
 
-Kubernetes also has [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), for example `kubernetes.io/metadata.name`. The Kubernetes namespace label serves the same purpose and can be used in the same way as the $[prodname] label. The `projectcalico.org/name` label predates the automatic Kubernetes label.
+$[prodname] also sets `projectcalico.org/name` to the name of the namespace, and it can be used in a `namespaceSelector` in the same way. It predates the Kubernetes [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), and $[prodname] derives it as it reads the namespace rather than storing it on the object, so `kubectl get namespace --show-labels` does not show it. For matching namespaces, prefer `kubernetes.io/metadata.name`.
 
 ## Labels for matching workload endpoints
 
@@ -79,7 +79,7 @@ WorkloadEndpoints (which represent Pods in Kubernetes, or VM instances in OpenSt
 * `has(projectcalico.org/orchestrator)` matches only WorkloadEndpoints
 * `projectcalico.org/orchestrator == "k8s"` matches only Kubernetes Pods
 
-* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as the `projectcalico.org/name` label in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
+* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as matching `kubernetes.io/metadata.name` in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
 
 ```yaml
 apiVersion: projectcalico.org/v3
@@ -117,8 +117,9 @@ If you enable [multiple networks](../../networking/configuring/multiple-networks
 
 $[prodname] labels must be used with the correct selector or the policy will not work as designed (and there are no error messages in the web console or when applying the YAML).
 
-| Calico label         | Usage requirements                                              | Use in these resources...           |
+| Label                | Usage requirements                                              | Use in these resources...           |
 | --------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
-| `projectcalico.org/name`                                     | Use with a **namespaceSelector** or **serviceAccountSelector**. | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `kubernetes.io/metadata.name`                                | Use with a **namespaceSelector**.                            | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `projectcalico.org/name`                                     | Use with a **serviceAccountSelector**, or with a **namespaceSelector** (prefer `kubernetes.io/metadata.name` for namespaces). | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
 | `projectcalico.org/namespace`                                | Use only with selectors. <br /><br />Use the label as the label name, and a namespace name as the value to compare against (for example projectcalico.org/namespace == "default"). | - Global network policy<br />- Staged global network policy<br /><br />Cluster-wide (non-namespaced) resources that apply to workload endpoint resources in all namespaces, and to host endpoint resources. |
 
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/network-policy/default-deny.mdx b/calico-enterprise_versioned_docs/version-3.21-2/network-policy/default-deny.mdx
index 765613cace..e582dea262 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/network-policy/default-deny.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/network-policy/default-deny.mdx
@@ -30,7 +30,7 @@ kind: GlobalNetworkPolicy
 metadata:
   name: deny-app-policy
 spec:
-  namespaceSelector: has(projectcalico.org/name) && projectcalico.org/name not in {"kube-system", "calico-system", "tigera-system"}
+  namespaceSelector: has(kubernetes.io/metadata.name) && kubernetes.io/metadata.name not in {"kube-system", "calico-system", "tigera-system"}
   types:
   - Ingress
   - Egress
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/network-policy/policy-best-practices.mdx b/calico-enterprise_versioned_docs/version-3.21-2/network-policy/policy-best-practices.mdx
index 95e8d58b03..74f4fccd3d 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/network-policy/policy-best-practices.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/network-policy/policy-best-practices.mdx
@@ -144,7 +144,7 @@ The following policy is a global network policy for a microservice that limits a
 15     - action: Allow
 16       protocol: TCP
 17       source:
-18         namespaceSelector: projectcalico.org/name == "sso"
+18         namespaceSelector: kubernetes.io/metadata.name == "sso"
 19         ports:
 20           - '443'
 21           - '80'
@@ -188,7 +188,7 @@ The following policy is a global network policy for a microservice that limits a
 59     - action: Allow
 60       protocol: TCP
 61       source:
-62         namespaceSelector: projectcalico.org/name == "warehouse"
+62         namespaceSelector: kubernetes.io/metadata.name == "warehouse"
 63       destination:
 64         ports:
 65           - '1433'
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-aws.mdx b/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-aws.mdx
index 371bfc2d07..fe593aaeb3 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-aws.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-aws.mdx
@@ -852,7 +852,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -868,7 +868,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -902,14 +902,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-azure.mdx b/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-azure.mdx
index 2b655f181f..ab26975f69 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-azure.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-azure.mdx
@@ -504,7 +504,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -520,7 +520,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -554,14 +554,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-maintenance.mdx b/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-maintenance.mdx
index b6aec39ce9..28e6760cb5 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-maintenance.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-maintenance.mdx
@@ -132,7 +132,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: poll-my-own-annotations
   namespace: default
 spec:
@@ -214,7 +214,7 @@ spec:
         app: annotation-aware-workload
       annotations:
         egress.projectcalico.org/selector: egress-code == 'red'
-        egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+        egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
     spec:
       containers:
         - name: application-container
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-on-prem.mdx b/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-on-prem.mdx
index 6da6dd71e1..62b4522ab5 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-on-prem.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/egress-gateway-on-prem.mdx
@@ -391,7 +391,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -407,7 +407,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -441,14 +441,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/troubleshoot.mdx b/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/troubleshoot.mdx
index 76aca6e4a6..368d7e05d4 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/troubleshoot.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/networking/egress/troubleshoot.mdx
@@ -169,12 +169,12 @@ spec:
       cidr: 11.0.0.0/8
     description: "Gateway to on prem"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'blue'"
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
 ```
 
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/egressgatewaypolicy.mdx b/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/egressgatewaypolicy.mdx
index 3cd371bfa5..6b9dbf6ccc 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/egressgatewaypolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/egressgatewaypolicy.mdx
@@ -29,12 +29,12 @@ spec:
       cidr: 11.0.0.0/8
     description: "Gateway to on prem"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'blue'"
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     gatewayPreference: PreferNodeLocal
 ```
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/globalnetworkpolicy.mdx b/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/globalnetworkpolicy.mdx
index 53ce77d6a4..2fa160a5fa 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/globalnetworkpolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/globalnetworkpolicy.mdx
@@ -90,7 +90,7 @@ spec:
 | tier                   | Name of the [tier](tier.mdx) this policy belongs to.                                                                                                                                                                                 |                           | string                | `default`                                     |
 | selector               | Selects the endpoints to which this policy applies.                                                                                                                                                                                  |                           | [selector](#selector) | all()                                         |
 | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label.                                                               |                           | [selector](#selector) | all()                                         |
-| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
+| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `kubernetes.io/metadata.name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
 | types                  | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress`       | List of strings       | Depends on presence of ingress/egress rules\* |
 | ingress                | Ordered list of ingress rules applied by policy.                                                                                                                                                                                     |                           | List of [Rule](#rule) |                                               |
 | egress                 | Ordered list of egress rules applied by this policy.                                                                                                                                                                                 |                           | List of [Rule](#rule) |                                               |
diff --git a/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/stagedglobalnetworkpolicy.mdx b/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/stagedglobalnetworkpolicy.mdx
index 5355317b64..1d793fb9e9 100644
--- a/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/stagedglobalnetworkpolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.21-2/reference/resources/stagedglobalnetworkpolicy.mdx
@@ -83,7 +83,7 @@ spec:
 | tier                   | Name of the [tier](tier.mdx) this policy belongs to.                                                                                                                                                                                 |                           | string                | `default`                                     |
 | selector               | Selects the endpoints to which this policy applies.                                                                                                                                                                                  |                           | [selector](#selector) | all()                                         |
 | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label.                                                               |                           | [selector](#selector) | all()                                         |
-| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
+| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `kubernetes.io/metadata.name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
 | types                  | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress`       | List of strings       | Depends on presence of ingress/egress rules\* |
 | ingress                | Ordered list of ingress rules applied by policy.                                                                                                                                                                                     |                           | List of [Rule](#rule) |                                               |
 | egress                 | Ordered list of egress rules applied by this policy.                                                                                                                                                                                 |                           | List of [Rule](#rule) |                                               |
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/_includes/content/_entityrule.mdx b/calico-enterprise_versioned_docs/version-3.22-2/_includes/content/_entityrule.mdx
index 262ee725fa..cec9b09c54 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/_includes/content/_entityrule.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/_includes/content/_entityrule.mdx
@@ -18,7 +18,7 @@ for the rule as a whole to match a packet.
 | notNets           | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs                               |
 | selector          | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selector)                       |         |
 | notSelector       | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selector)                       |         |
-| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `projectcalico.org/name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selector)                       |         |
+| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selector)                       |         |
 | ports             | Positive match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
 | domains           | Positive match on [domain names](#exact-and-wildcard-domain-names).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | List of [exact or wildcard domain names](#exact-and-wildcard-domain-names)                                | list of strings                             |
 | notPorts          | Negative match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/network-policy/beginners/calico-labels.mdx b/calico-enterprise_versioned_docs/version-3.22-2/network-policy/beginners/calico-labels.mdx
index ae85a8d5fb..1575657d55 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/network-policy/beginners/calico-labels.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/network-policy/beginners/calico-labels.mdx
@@ -4,11 +4,11 @@ description: Reference list of automatic labels Calico Enterprise attaches to re
 
 # Calico Enterprise automatic labels
 
-As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies. The labels make it easier to match resources in common ways (such as matching a namespace by name).
+As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies, and works with the labels Kubernetes applies automatically. The labels make it easier to match resources in common ways (such as matching a namespace by name).
 
 ## Labels for matching namespaces
 
-The label `projectcalico.org/name` is set to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
+Kubernetes sets the label `kubernetes.io/metadata.name` to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
 
 For example, the following GlobalNetworkPolicy applies to workloads with label, `color: red` in namespaces named, `"foo"` and `"bar"`. The policy allows ingress traffic to port 8080 from all workloads in a third namespace named, `"baz"`:
 
@@ -18,14 +18,14 @@ kind: GlobalNetworkPolicy
 metadata:
   name: foo-and-bar
 spec:
-  namespaceSelector: projectcalico.org/name in {"foo", "bar"}
+  namespaceSelector: kubernetes.io/metadata.name in {"foo", "bar"}
   selector: color == "red"
   types:
   - Ingress
   ingress:
   - action: Allow
     source:
-      namespaceSelector: projectcalico.org/name == "baz"
+      namespaceSelector: kubernetes.io/metadata.name == "baz"
     destination:
       ports:
       - 8080
@@ -52,7 +52,7 @@ means "resources in any namespace and non-namespaced resources that match foo ==
 Further,
 
    ```yaml
-   namespaceSelector: projectcalico.org/name == "some-namespace"
+   namespaceSelector: kubernetes.io/metadata.name == "some-namespace"
    selector: foo == "bar"
    ```
 is equivalent to:
@@ -64,11 +64,11 @@ is equivalent to:
 
 ### Labels for matching service accounts
 
-Similarly, the `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`.
+The `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`. Kubernetes has no equivalent automatic label for ServiceAccounts, so use `projectcalico.org/name` here.
 
-### Kubernetes labels for matching namespaces
+### The projectcalico.org/name label for namespaces {/* #projectcalico-name-label-for-namespaces */}
 
-Kubernetes also has [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), for example `kubernetes.io/metadata.name`. The Kubernetes namespace label serves the same purpose and can be used in the same way as the $[prodname] label. The `projectcalico.org/name` label predates the automatic Kubernetes label.
+$[prodname] also sets `projectcalico.org/name` to the name of the namespace, and it can be used in a `namespaceSelector` in the same way. It predates the Kubernetes [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), and $[prodname] derives it as it reads the namespace rather than storing it on the object, so `kubectl get namespace --show-labels` does not show it. For matching namespaces, prefer `kubernetes.io/metadata.name`.
 
 ## Labels for matching workload endpoints
 
@@ -79,7 +79,7 @@ WorkloadEndpoints (which represent Pods in Kubernetes, or VM instances in OpenSt
 * `has(projectcalico.org/orchestrator)` matches only WorkloadEndpoints
 * `projectcalico.org/orchestrator == "k8s"` matches only Kubernetes Pods
 
-* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as the `projectcalico.org/name` label in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
+* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as matching `kubernetes.io/metadata.name` in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
 
 ```yaml
 apiVersion: projectcalico.org/v3
@@ -117,8 +117,9 @@ If you enable [multiple networks](../../networking/configuring/multiple-networks
 
 $[prodname] labels must be used with the correct selector or the policy will not work as designed (and there are no error messages in the web console or when applying the YAML).
 
-| Calico label         | Usage requirements                                              | Use in these resources...           |
+| Label                | Usage requirements                                              | Use in these resources...           |
 | --------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
-| `projectcalico.org/name`                                     | Use with a **namespaceSelector** or **serviceAccountSelector**. | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `kubernetes.io/metadata.name`                                | Use with a **namespaceSelector**.                            | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `projectcalico.org/name`                                     | Use with a **serviceAccountSelector**, or with a **namespaceSelector** (prefer `kubernetes.io/metadata.name` for namespaces). | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
 | `projectcalico.org/namespace`                                | Use only with selectors. <br /><br />Use the label as the label name, and a namespace name as the value to compare against (for example projectcalico.org/namespace == "default"). | - Global network policy<br />- Staged global network policy<br /><br />Cluster-wide (non-namespaced) resources that apply to workload endpoint resources in all namespaces, and to host endpoint resources. |
 
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/network-policy/default-deny.mdx b/calico-enterprise_versioned_docs/version-3.22-2/network-policy/default-deny.mdx
index e5f9d94ad7..5b65e27568 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/network-policy/default-deny.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/network-policy/default-deny.mdx
@@ -30,7 +30,7 @@ kind: GlobalNetworkPolicy
 metadata:
   name: deny-app-policy
 spec:
-  namespaceSelector: has(projectcalico.org/name) && projectcalico.org/name not in {"kube-system", "calico-system"}
+  namespaceSelector: has(kubernetes.io/metadata.name) && kubernetes.io/metadata.name not in {"kube-system", "calico-system"}
   types:
   - Ingress
   - Egress
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/network-policy/policy-best-practices.mdx b/calico-enterprise_versioned_docs/version-3.22-2/network-policy/policy-best-practices.mdx
index 43ff34fd2a..ed18b61d81 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/network-policy/policy-best-practices.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/network-policy/policy-best-practices.mdx
@@ -144,7 +144,7 @@ The following policy is a global network policy for a microservice that limits a
 15     - action: Allow
 16       protocol: TCP
 17       source:
-18         namespaceSelector: projectcalico.org/name == "sso"
+18         namespaceSelector: kubernetes.io/metadata.name == "sso"
 19         ports:
 20           - '443'
 21           - '80'
@@ -188,7 +188,7 @@ The following policy is a global network policy for a microservice that limits a
 59     - action: Allow
 60       protocol: TCP
 61       source:
-62         namespaceSelector: projectcalico.org/name == "warehouse"
+62         namespaceSelector: kubernetes.io/metadata.name == "warehouse"
 63       destination:
 64         ports:
 65           - '1433'
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-aws.mdx b/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-aws.mdx
index 802c25982f..45f13b4bf7 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-aws.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-aws.mdx
@@ -852,7 +852,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -868,7 +868,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -902,14 +902,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-azure.mdx b/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-azure.mdx
index 235b85bcde..fe6bbe2d2b 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-azure.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-azure.mdx
@@ -504,7 +504,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -520,7 +520,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -554,14 +554,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-maintenance.mdx b/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-maintenance.mdx
index a7dcdc1f1d..8a3adfa047 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-maintenance.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-maintenance.mdx
@@ -132,7 +132,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: poll-my-own-annotations
   namespace: default
 spec:
@@ -214,7 +214,7 @@ spec:
         app: annotation-aware-workload
       annotations:
         egress.projectcalico.org/selector: egress-code == 'red'
-        egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+        egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
     spec:
       containers:
         - name: application-container
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-on-prem.mdx b/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-on-prem.mdx
index 781b1a09e8..a494db142c 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-on-prem.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/egress-gateway-on-prem.mdx
@@ -391,7 +391,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -407,7 +407,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -441,14 +441,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/troubleshoot.mdx b/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/troubleshoot.mdx
index 7c72cfb6e5..2eccc018b6 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/troubleshoot.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/networking/egress/troubleshoot.mdx
@@ -169,12 +169,12 @@ spec:
       cidr: 11.0.0.0/8
     description: "Gateway to on prem"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'blue'"
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
 ```
 
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/egressgatewaypolicy.mdx b/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/egressgatewaypolicy.mdx
index 741e7ba629..aa652bd698 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/egressgatewaypolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/egressgatewaypolicy.mdx
@@ -29,12 +29,12 @@ spec:
       cidr: 11.0.0.0/8
     description: "Gateway to on prem"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'blue'"
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     gatewayPreference: PreferNodeLocal
 ```
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/globalnetworkpolicy.mdx b/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/globalnetworkpolicy.mdx
index e1f364e9ce..c72dc3f35d 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/globalnetworkpolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/globalnetworkpolicy.mdx
@@ -90,7 +90,7 @@ spec:
 | tier                   | Name of the [tier](tier.mdx) this policy belongs to.                                                                                                                                                                                 |                           | string                | `default`                                     |
 | selector               | Selects the endpoints to which this policy applies.                                                                                                                                                                                  |                           | [selector](#selector) | all()                                         |
 | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label.                                                               |                           | [selector](#selector) | all()                                         |
-| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
+| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `kubernetes.io/metadata.name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
 | types                  | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress`       | List of strings       | Depends on presence of ingress/egress rules\* |
 | ingress                | Ordered list of ingress rules applied by policy.                                                                                                                                                                                     |                           | List of [Rule](#rule) |                                               |
 | egress                 | Ordered list of egress rules applied by this policy.                                                                                                                                                                                 |                           | List of [Rule](#rule) |                                               |
diff --git a/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/stagedglobalnetworkpolicy.mdx b/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/stagedglobalnetworkpolicy.mdx
index e7f6ce2f16..06e87fdaa3 100644
--- a/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/stagedglobalnetworkpolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.22-2/reference/resources/stagedglobalnetworkpolicy.mdx
@@ -83,7 +83,7 @@ spec:
 | tier                   | Name of the [tier](tier.mdx) this policy belongs to.                                                                                                                                                                                 |                           | string                | `default`                                     |
 | selector               | Selects the endpoints to which this policy applies.                                                                                                                                                                                  |                           | [selector](#selector) | all()                                         |
 | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label.                                                               |                           | [selector](#selector) | all()                                         |
-| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
+| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `kubernetes.io/metadata.name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
 | types                  | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress`       | List of strings       | Depends on presence of ingress/egress rules\* |
 | ingress                | Ordered list of ingress rules applied by policy.                                                                                                                                                                                     |                           | List of [Rule](#rule) |                                               |
 | egress                 | Ordered list of egress rules applied by this policy.                                                                                                                                                                                 |                           | List of [Rule](#rule) |                                               |
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/_includes/content/_entityrule.mdx b/calico-enterprise_versioned_docs/version-3.23-2/_includes/content/_entityrule.mdx
index 7c6d5c7fbb..fa8681bc04 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/_includes/content/_entityrule.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/_includes/content/_entityrule.mdx
@@ -18,7 +18,7 @@ for the rule as a whole to match a packet.
 | notNets           | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs                               |
 | selector          | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selector)                       |         |
 | notSelector       | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selector)                       |         |
-| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `projectcalico.org/name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selector)                       |         |
+| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selector)                       |         |
 | ports             | Positive match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
 | domains           | Positive match on [domain names](#exact-and-wildcard-domain-names).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | List of [exact or wildcard domain names](#exact-and-wildcard-domain-names)                                | list of strings                             |
 | notPorts          | Negative match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/network-policy/beginners/calico-labels.mdx b/calico-enterprise_versioned_docs/version-3.23-2/network-policy/beginners/calico-labels.mdx
index a59d6766cf..7d41b31601 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/network-policy/beginners/calico-labels.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/network-policy/beginners/calico-labels.mdx
@@ -4,11 +4,11 @@ description: Reference list of automatic labels Calico Enterprise attaches to re
 
 # Calico Enterprise automatic labels
 
-As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies. The labels make it easier to match resources in common ways (such as matching a namespace by name).
+As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies, and works with the labels Kubernetes applies automatically. The labels make it easier to match resources in common ways (such as matching a namespace by name).
 
 ## Labels for matching namespaces
 
-The label `projectcalico.org/name` is set to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
+Kubernetes sets the label `kubernetes.io/metadata.name` to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
 
 For example, the following GlobalNetworkPolicy applies to workloads with label, `color: red` in namespaces named, `"foo"` and `"bar"`. The policy allows ingress traffic to port 8080 from all workloads in a third namespace named, `"baz"`:
 
@@ -18,14 +18,14 @@ kind: GlobalNetworkPolicy
 metadata:
   name: foo-and-bar
 spec:
-  namespaceSelector: projectcalico.org/name in {"foo", "bar"}
+  namespaceSelector: kubernetes.io/metadata.name in {"foo", "bar"}
   selector: color == "red"
   types:
   - Ingress
   ingress:
   - action: Allow
     source:
-      namespaceSelector: projectcalico.org/name == "baz"
+      namespaceSelector: kubernetes.io/metadata.name == "baz"
     destination:
       ports:
       - 8080
@@ -52,7 +52,7 @@ means "resources in any namespace and non-namespaced resources that match foo ==
 Further,
 
    ```yaml
-   namespaceSelector: projectcalico.org/name == "some-namespace"
+   namespaceSelector: kubernetes.io/metadata.name == "some-namespace"
    selector: foo == "bar"
    ```
 is equivalent to:
@@ -64,11 +64,11 @@ is equivalent to:
 
 ### Labels for matching service accounts
 
-Similarly, the `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`.
+The `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`. Kubernetes has no equivalent automatic label for ServiceAccounts, so use `projectcalico.org/name` here.
 
-### Kubernetes labels for matching namespaces
+### The projectcalico.org/name label for namespaces {/* #projectcalico-name-label-for-namespaces */}
 
-Kubernetes also has [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), for example `kubernetes.io/metadata.name`. The Kubernetes namespace label serves the same purpose and can be used in the same way as the $[prodname] label. The `projectcalico.org/name` label predates the automatic Kubernetes label.
+$[prodname] also sets `projectcalico.org/name` to the name of the namespace, and it can be used in a `namespaceSelector` in the same way. It predates the Kubernetes [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), and $[prodname] derives it as it reads the namespace rather than storing it on the object, so `kubectl get namespace --show-labels` does not show it. For matching namespaces, prefer `kubernetes.io/metadata.name`.
 
 ## Labels for matching workload endpoints
 
@@ -79,7 +79,7 @@ WorkloadEndpoints (which represent Pods in Kubernetes, or VM instances in OpenSt
 * `has(projectcalico.org/orchestrator)` matches only WorkloadEndpoints
 * `projectcalico.org/orchestrator == "k8s"` matches only Kubernetes Pods
 
-* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as the `projectcalico.org/name` label in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
+* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as matching `kubernetes.io/metadata.name` in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
 
 ```yaml
 apiVersion: projectcalico.org/v3
@@ -118,8 +118,9 @@ If you enable [multiple networks](../../networking/configuring/multiple-networks
 
 $[prodname] labels must be used with the correct selector or the policy will not work as designed (and there are no error messages in the web console or when applying the YAML).
 
-| Calico label         | Usage requirements                                              | Use in these resources...           |
+| Label                | Usage requirements                                              | Use in these resources...           |
 | --------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
-| `projectcalico.org/name`                                     | Use with a **namespaceSelector** or **serviceAccountSelector**. | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `kubernetes.io/metadata.name`                                | Use with a **namespaceSelector**.                            | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `projectcalico.org/name`                                     | Use with a **serviceAccountSelector**, or with a **namespaceSelector** (prefer `kubernetes.io/metadata.name` for namespaces). | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
 | `projectcalico.org/namespace`                                | Use only with selectors. <br /><br />Use the label as the label name, and a namespace name as the value to compare against (for example projectcalico.org/namespace == "default"). | - Global network policy<br />- Staged global network policy<br /><br />Cluster-wide (non-namespaced) resources that apply to workload endpoint resources in all namespaces, and to host endpoint resources. |
 
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/network-policy/default-deny.mdx b/calico-enterprise_versioned_docs/version-3.23-2/network-policy/default-deny.mdx
index e5f9d94ad7..5b65e27568 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/network-policy/default-deny.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/network-policy/default-deny.mdx
@@ -30,7 +30,7 @@ kind: GlobalNetworkPolicy
 metadata:
   name: deny-app-policy
 spec:
-  namespaceSelector: has(projectcalico.org/name) && projectcalico.org/name not in {"kube-system", "calico-system"}
+  namespaceSelector: has(kubernetes.io/metadata.name) && kubernetes.io/metadata.name not in {"kube-system", "calico-system"}
   types:
   - Ingress
   - Egress
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/network-policy/policy-best-practices.mdx b/calico-enterprise_versioned_docs/version-3.23-2/network-policy/policy-best-practices.mdx
index 43ff34fd2a..ed18b61d81 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/network-policy/policy-best-practices.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/network-policy/policy-best-practices.mdx
@@ -144,7 +144,7 @@ The following policy is a global network policy for a microservice that limits a
 15     - action: Allow
 16       protocol: TCP
 17       source:
-18         namespaceSelector: projectcalico.org/name == "sso"
+18         namespaceSelector: kubernetes.io/metadata.name == "sso"
 19         ports:
 20           - '443'
 21           - '80'
@@ -188,7 +188,7 @@ The following policy is a global network policy for a microservice that limits a
 59     - action: Allow
 60       protocol: TCP
 61       source:
-62         namespaceSelector: projectcalico.org/name == "warehouse"
+62         namespaceSelector: kubernetes.io/metadata.name == "warehouse"
 63       destination:
 64         ports:
 65           - '1433'
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-aws.mdx b/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-aws.mdx
index 802c25982f..45f13b4bf7 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-aws.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-aws.mdx
@@ -852,7 +852,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -868,7 +868,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -902,14 +902,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-azure.mdx b/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-azure.mdx
index 235b85bcde..fe6bbe2d2b 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-azure.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-azure.mdx
@@ -504,7 +504,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -520,7 +520,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -554,14 +554,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-maintenance.mdx b/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-maintenance.mdx
index a7dcdc1f1d..8a3adfa047 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-maintenance.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-maintenance.mdx
@@ -132,7 +132,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: poll-my-own-annotations
   namespace: default
 spec:
@@ -214,7 +214,7 @@ spec:
         app: annotation-aware-workload
       annotations:
         egress.projectcalico.org/selector: egress-code == 'red'
-        egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+        egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
     spec:
       containers:
         - name: application-container
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-on-prem.mdx b/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-on-prem.mdx
index 781b1a09e8..a494db142c 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-on-prem.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/egress-gateway-on-prem.mdx
@@ -391,7 +391,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -407,7 +407,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -441,14 +441,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/troubleshoot.mdx b/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/troubleshoot.mdx
index 7c72cfb6e5..2eccc018b6 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/troubleshoot.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/networking/egress/troubleshoot.mdx
@@ -169,12 +169,12 @@ spec:
       cidr: 11.0.0.0/8
     description: "Gateway to on prem"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'blue'"
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
 ```
 
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/egressgatewaypolicy.mdx b/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/egressgatewaypolicy.mdx
index 741e7ba629..aa652bd698 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/egressgatewaypolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/egressgatewaypolicy.mdx
@@ -29,12 +29,12 @@ spec:
       cidr: 11.0.0.0/8
     description: "Gateway to on prem"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'blue'"
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     gatewayPreference: PreferNodeLocal
 ```
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/globalnetworkpolicy.mdx b/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/globalnetworkpolicy.mdx
index ffeb937339..20ba34f9bc 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/globalnetworkpolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/globalnetworkpolicy.mdx
@@ -90,7 +90,7 @@ spec:
 | tier                   | Name of the [tier](tier.mdx) this policy belongs to.                                                                                                                                                                                 |                           | string                | `default`                                     |
 | selector               | Selects the endpoints to which this policy applies.                                                                                                                                                                                  |                           | [selector](#selector) | all()                                         |
 | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label.                                                               |                           | [selector](#selector) | all()                                         |
-| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
+| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `kubernetes.io/metadata.name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
 | types                  | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress`       | List of strings       | Depends on presence of ingress/egress rules\* |
 | ingress                | Ordered list of ingress rules applied by policy.                                                                                                                                                                                     |                           | List of [Rule](#rule) |                                               |
 | egress                 | Ordered list of egress rules applied by this policy.                                                                                                                                                                                 |                           | List of [Rule](#rule) |                                               |
diff --git a/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/stagedglobalnetworkpolicy.mdx b/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/stagedglobalnetworkpolicy.mdx
index 7e4b8eb455..7317578b0c 100644
--- a/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/stagedglobalnetworkpolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.23-2/reference/resources/stagedglobalnetworkpolicy.mdx
@@ -83,7 +83,7 @@ spec:
 | tier                   | Name of the [tier](tier.mdx) this policy belongs to.                                                                                                                                                                                 |                           | string                | `default`                                     |
 | selector               | Selects the endpoints to which this policy applies.                                                                                                                                                                                  |                           | [selector](#selector) | all()                                         |
 | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label.                                                               |                           | [selector](#selector) | all()                                         |
-| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
+| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `kubernetes.io/metadata.name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
 | types                  | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress`       | List of strings       | Depends on presence of ingress/egress rules\* |
 | ingress                | Ordered list of ingress rules applied by policy.                                                                                                                                                                                     |                           | List of [Rule](#rule) |                                               |
 | egress                 | Ordered list of egress rules applied by this policy.                                                                                                                                                                                 |                           | List of [Rule](#rule) |                                               |
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/_includes/content/_entityrule.mdx b/calico-enterprise_versioned_docs/version-3.24-2/_includes/content/_entityrule.mdx
index 994dfcb0fb..8d2d218212 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/_includes/content/_entityrule.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/_includes/content/_entityrule.mdx
@@ -18,7 +18,7 @@ for the rule as a whole to match a packet.
 | notNets           | Negative match on CIDRs. Match packets with IP not in any of the listed CIDRs.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | List of valid IPv4 CIDRs or list of valid IPv6 CIDRs (IPv4 and IPv6 CIDRs shouldn't be mixed in one rule) | list of cidrs                               |
 | selector          | Positive match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selector)                       |         |
 | notSelector       | Negative match on selected endpoints. If a `namespaceSelector` is also defined, the set of endpoints this applies to is limited to the endpoints in the selected namespaces.                                                                                                                                                                                                                                                                                                                                                                                | Valid selector                                                                                            | [selector](#selector)                       |         |
-| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `projectcalico.org/name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selector)                       |         |
+| namespaceSelector | Positive match on selected namespaces. If specified, only workload endpoints in the selected Kubernetes namespaces are matched. Matches namespaces based on the labels that have been applied to the namespaces. Defines the scope that selectors will apply to, if not defined then selectors apply to the NetworkPolicy's namespace. Match a specific namespace by name using the `kubernetes.io/metadata.name` label. Select the non-namespaced resources like GlobalNetworkSet(s), host endpoints to which this policy applies by using `global()` selector. | Valid selector                                                                                            | [selector](#selector)                       |         |
 | ports             | Positive match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
 | domains           | Positive match on [domain names](#exact-and-wildcard-domain-names).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | List of [exact or wildcard domain names](#exact-and-wildcard-domain-names)                                | list of strings                             |
 | notPorts          | Negative match on the specified ports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                           | list of [ports](#ports)                     |         |
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/network-policy/beginners/calico-labels.mdx b/calico-enterprise_versioned_docs/version-3.24-2/network-policy/beginners/calico-labels.mdx
index a59d6766cf..7d41b31601 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/network-policy/beginners/calico-labels.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/network-policy/beginners/calico-labels.mdx
@@ -4,11 +4,11 @@ description: Reference list of automatic labels Calico Enterprise attaches to re
 
 # Calico Enterprise automatic labels
 
-As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies. The labels make it easier to match resources in common ways (such as matching a namespace by name).
+As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies, and works with the labels Kubernetes applies automatically. The labels make it easier to match resources in common ways (such as matching a namespace by name).
 
 ## Labels for matching namespaces
 
-The label `projectcalico.org/name` is set to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
+Kubernetes sets the label `kubernetes.io/metadata.name` to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
 
 For example, the following GlobalNetworkPolicy applies to workloads with label, `color: red` in namespaces named, `"foo"` and `"bar"`. The policy allows ingress traffic to port 8080 from all workloads in a third namespace named, `"baz"`:
 
@@ -18,14 +18,14 @@ kind: GlobalNetworkPolicy
 metadata:
   name: foo-and-bar
 spec:
-  namespaceSelector: projectcalico.org/name in {"foo", "bar"}
+  namespaceSelector: kubernetes.io/metadata.name in {"foo", "bar"}
   selector: color == "red"
   types:
   - Ingress
   ingress:
   - action: Allow
     source:
-      namespaceSelector: projectcalico.org/name == "baz"
+      namespaceSelector: kubernetes.io/metadata.name == "baz"
     destination:
       ports:
       - 8080
@@ -52,7 +52,7 @@ means "resources in any namespace and non-namespaced resources that match foo ==
 Further,
 
    ```yaml
-   namespaceSelector: projectcalico.org/name == "some-namespace"
+   namespaceSelector: kubernetes.io/metadata.name == "some-namespace"
    selector: foo == "bar"
    ```
 is equivalent to:
@@ -64,11 +64,11 @@ is equivalent to:
 
 ### Labels for matching service accounts
 
-Similarly, the `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`.
+The `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`. Kubernetes has no equivalent automatic label for ServiceAccounts, so use `projectcalico.org/name` here.
 
-### Kubernetes labels for matching namespaces
+### The projectcalico.org/name label for namespaces {/* #projectcalico-name-label-for-namespaces */}
 
-Kubernetes also has [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), for example `kubernetes.io/metadata.name`. The Kubernetes namespace label serves the same purpose and can be used in the same way as the $[prodname] label. The `projectcalico.org/name` label predates the automatic Kubernetes label.
+$[prodname] also sets `projectcalico.org/name` to the name of the namespace, and it can be used in a `namespaceSelector` in the same way. It predates the Kubernetes [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), and $[prodname] derives it as it reads the namespace rather than storing it on the object, so `kubectl get namespace --show-labels` does not show it. For matching namespaces, prefer `kubernetes.io/metadata.name`.
 
 ## Labels for matching workload endpoints
 
@@ -79,7 +79,7 @@ WorkloadEndpoints (which represent Pods in Kubernetes, or VM instances in OpenSt
 * `has(projectcalico.org/orchestrator)` matches only WorkloadEndpoints
 * `projectcalico.org/orchestrator == "k8s"` matches only Kubernetes Pods
 
-* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as the `projectcalico.org/name` label in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
+* For WorkloadEndpoints that represent Kubernetes Pods, `projectcalico.org/namespace` contains the name of the pod's namespace. `projectcalico.org/namespace` predates the addition of `namespaceSelector` fields to GlobalNetworkPolicies; it serves the same purpose as matching `kubernetes.io/metadata.name` in a `namespaceSelector` field.  The following GlobalNetworkPolicy is exactly equivalent to the example shown in the Namespaces section:
 
 ```yaml
 apiVersion: projectcalico.org/v3
@@ -118,8 +118,9 @@ If you enable [multiple networks](../../networking/configuring/multiple-networks
 
 $[prodname] labels must be used with the correct selector or the policy will not work as designed (and there are no error messages in the web console or when applying the YAML).
 
-| Calico label         | Usage requirements                                              | Use in these resources...           |
+| Label                | Usage requirements                                              | Use in these resources...           |
 | --------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
-| `projectcalico.org/name`                                     | Use with a **namespaceSelector** or **serviceAccountSelector**. | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `kubernetes.io/metadata.name`                                | Use with a **namespaceSelector**.                            | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `projectcalico.org/name`                                     | Use with a **serviceAccountSelector**, or with a **namespaceSelector** (prefer `kubernetes.io/metadata.name` for namespaces). | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
 | `projectcalico.org/namespace`                                | Use only with selectors. <br /><br />Use the label as the label name, and a namespace name as the value to compare against (for example projectcalico.org/namespace == "default"). | - Global network policy<br />- Staged global network policy<br /><br />Cluster-wide (non-namespaced) resources that apply to workload endpoint resources in all namespaces, and to host endpoint resources. |
 
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/network-policy/default-deny.mdx b/calico-enterprise_versioned_docs/version-3.24-2/network-policy/default-deny.mdx
index e5f9d94ad7..5b65e27568 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/network-policy/default-deny.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/network-policy/default-deny.mdx
@@ -30,7 +30,7 @@ kind: GlobalNetworkPolicy
 metadata:
   name: deny-app-policy
 spec:
-  namespaceSelector: has(projectcalico.org/name) && projectcalico.org/name not in {"kube-system", "calico-system"}
+  namespaceSelector: has(kubernetes.io/metadata.name) && kubernetes.io/metadata.name not in {"kube-system", "calico-system"}
   types:
   - Ingress
   - Egress
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/network-policy/policy-best-practices.mdx b/calico-enterprise_versioned_docs/version-3.24-2/network-policy/policy-best-practices.mdx
index 43ff34fd2a..ed18b61d81 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/network-policy/policy-best-practices.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/network-policy/policy-best-practices.mdx
@@ -144,7 +144,7 @@ The following policy is a global network policy for a microservice that limits a
 15     - action: Allow
 16       protocol: TCP
 17       source:
-18         namespaceSelector: projectcalico.org/name == "sso"
+18         namespaceSelector: kubernetes.io/metadata.name == "sso"
 19         ports:
 20           - '443'
 21           - '80'
@@ -188,7 +188,7 @@ The following policy is a global network policy for a microservice that limits a
 59     - action: Allow
 60       protocol: TCP
 61       source:
-62         namespaceSelector: projectcalico.org/name == "warehouse"
+62         namespaceSelector: kubernetes.io/metadata.name == "warehouse"
 63       destination:
 64         ports:
 65           - '1433'
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-aws.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-aws.mdx
index 802c25982f..45f13b4bf7 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-aws.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-aws.mdx
@@ -852,7 +852,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -868,7 +868,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -902,14 +902,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-azure.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-azure.mdx
index 235b85bcde..fe6bbe2d2b 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-azure.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-azure.mdx
@@ -504,7 +504,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -520,7 +520,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -554,14 +554,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-maintenance.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-maintenance.mdx
index a7dcdc1f1d..8a3adfa047 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-maintenance.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-maintenance.mdx
@@ -132,7 +132,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: poll-my-own-annotations
   namespace: default
 spec:
@@ -214,7 +214,7 @@ spec:
         app: annotation-aware-workload
       annotations:
         egress.projectcalico.org/selector: egress-code == 'red'
-        egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+        egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
     spec:
       containers:
         - name: application-container
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-on-prem.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-on-prem.mdx
index e998ddeba9..ad6450fdf1 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-on-prem.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/egress-gateway-on-prem.mdx
@@ -391,7 +391,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -407,7 +407,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
@@ -441,14 +441,14 @@ spec:
     // callout-for-next-line
     gateway:
       // callout-for-next-line
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       // callout-for-next-line
       selector: "egress-code == 'blue'"
       // callout-for-next-line
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     // callout-for-next-line
     gatewayPreference: PreferNodeLocal
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/troubleshoot.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/troubleshoot.mdx
index 7c72cfb6e5..2eccc018b6 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/troubleshoot.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/egress/troubleshoot.mdx
@@ -169,12 +169,12 @@ spec:
       cidr: 11.0.0.0/8
     description: "Gateway to on prem"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'blue'"
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
 ```
 
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/networking/ingress-gateway/create-ingress-gateway.mdx b/calico-enterprise_versioned_docs/version-3.24-2/networking/ingress-gateway/create-ingress-gateway.mdx
index c0070df513..f05c12c8da 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/networking/ingress-gateway/create-ingress-gateway.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/networking/ingress-gateway/create-ingress-gateway.mdx
@@ -105,13 +105,13 @@ You need to do the following:
        - action: Allow # DNS
          protocol: UDP
          destination:
-           namespaceSelector: 'projectcalico.org/name == "kube-system"'
+           namespaceSelector: 'kubernetes.io/metadata.name == "kube-system"'
            selector: 'k8s-app == "kube-dns"'
            ports: [53]
        - action: Allow # configuration from the gateway controller
          protocol: TCP
          destination:
-           namespaceSelector: 'projectcalico.org/name == "calico-system"'
+           namespaceSelector: 'kubernetes.io/metadata.name == "calico-system"'
            selector: 'app.kubernetes.io/name == "gateway-helm"'
            ports: [18000]
        - action: Allow # Kubernetes API server
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/egressgatewaypolicy.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/egressgatewaypolicy.mdx
index 741e7ba629..aa652bd698 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/egressgatewaypolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/egressgatewaypolicy.mdx
@@ -29,12 +29,12 @@ spec:
       cidr: 11.0.0.0/8
     description: "Gateway to on prem"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'blue'"
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
     gatewayPreference: PreferNodeLocal
 ```
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/globalnetworkpolicy.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/globalnetworkpolicy.mdx
index 81352ca277..f094a54d12 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/globalnetworkpolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/globalnetworkpolicy.mdx
@@ -90,7 +90,7 @@ spec:
 | tier                   | Name of the [tier](tier.mdx) this policy belongs to.                                                                                                                                                                                 |                           | string                | `default`                                     |
 | selector               | Selects the endpoints to which this policy applies.                                                                                                                                                                                  |                           | [selector](#selector) | all()                                         |
 | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label.                                                               |                           | [selector](#selector) | all()                                         |
-| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
+| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `kubernetes.io/metadata.name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
 | types                  | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress`       | List of strings       | Depends on presence of ingress/egress rules\* |
 | ingress                | Ordered list of ingress rules applied by policy.                                                                                                                                                                                     |                           | List of [Rule](#rule) |                                               |
 | egress                 | Ordered list of egress rules applied by this policy.                                                                                                                                                                                 |                           | List of [Rule](#rule) |                                               |
diff --git a/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/stagedglobalnetworkpolicy.mdx b/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/stagedglobalnetworkpolicy.mdx
index faba4f6cf7..d2d016c6bd 100644
--- a/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/stagedglobalnetworkpolicy.mdx
+++ b/calico-enterprise_versioned_docs/version-3.24-2/reference/resources/stagedglobalnetworkpolicy.mdx
@@ -83,7 +83,7 @@ spec:
 | tier                   | Name of the [tier](tier.mdx) this policy belongs to.                                                                                                                                                                                 |                           | string                | `default`                                     |
 | selector               | Selects the endpoints to which this policy applies.                                                                                                                                                                                  |                           | [selector](#selector) | all()                                         |
 | serviceAccountSelector | Selects the service account(s) to which this policy applies. Select all service accounts in the cluster with a specific name using the `projectcalico.org/name` label.                                                               |                           | [selector](#selector) | all()                                         |
-| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `projectcalico.org/name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
+| namespaceSelector      | Selects the namespace(s) to which this policy applies. Select a specific namespace by name using the `kubernetes.io/metadata.name` label.                                                                                                 |                           | [selector](#selector) | all()                                         |
 | types                  | Applies the policy based on the direction of the traffic. To apply the policy to inbound traffic, set to `Ingress`. To apply the policy to outbound traffic, set to `Egress`. To apply the policy to both, set to `Ingress, Egress`. | `Ingress`, `Egress`       | List of strings       | Depends on presence of ingress/egress rules\* |
 | ingress                | Ordered list of ingress rules applied by policy.                                                                                                                                                                                     |                           | List of [Rule](#rule) |                                               |
 | egress                 | Ordered list of egress rules applied by this policy.                                                                                                                                                                                 |                           | List of [Rule](#rule) |                                               |

From 1a210b0baa2adefc507973c41af5ca98a69cd187 Mon Sep 17 00:00:00 2001
From: Chris Tauchen <chris.tauchen@tigera.io>
Date: Thu, 8 Oct 2026 16:49:49 +0100
Subject: [PATCH 3/4] Recommend kubernetes.io/metadata.name in Calico Cloud
 23-2

---
 .../beginners/calico-labels.mdx               | 21 ++++++++++---------
 .../network-policy/policy-best-practices.mdx  |  4 ++--
 .../networking/egress/egress-gateway-aws.mdx  |  4 ++--
 .../egress/egress-gateway-azure.mdx           |  4 ++--
 .../egress/egress-gateway-maintenance.mdx     |  4 ++--
 .../egress/egress-gateway-on-prem.mdx         |  4 ++--
 .../networking/egress/troubleshoot.mdx        |  4 ++--
 7 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/calico-cloud_versioned_docs/version-23-2/network-policy/beginners/calico-labels.mdx b/calico-cloud_versioned_docs/version-23-2/network-policy/beginners/calico-labels.mdx
index 8bf360b47d..6a1c279ddc 100644
--- a/calico-cloud_versioned_docs/version-23-2/network-policy/beginners/calico-labels.mdx
+++ b/calico-cloud_versioned_docs/version-23-2/network-policy/beginners/calico-labels.mdx
@@ -4,11 +4,11 @@ description: Reference list of automatic labels Calico Cloud attaches to resourc
 
 # Calico Cloud automatic labels
 
-As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies. The labels make it easier to match resources in common ways (such as matching a namespace by name).
+As a convenience, $[prodname] provides immutable labels that are used for specific resources when evaluating selectors in policies, and works with the labels Kubernetes applies automatically. The labels make it easier to match resources in common ways (such as matching a namespace by name).
 
 ## Labels for matching namespaces
 
-The label `projectcalico.org/name` is set to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
+Kubernetes sets the label `kubernetes.io/metadata.name` to the name of the namespace. This allows for matching namespaces by name when using a `namespaceSelector` field.
 
 For example, the following GlobalNetworkPolicy applies to workloads with label, `color: red` in namespaces named, `"foo"` and `"bar"`. The policy allows ingress traffic to port 8080 from all workloads in a third namespace named, `"baz"`:
 
@@ -18,14 +18,14 @@ kind: GlobalNetworkPolicy
 metadata:
   name: foo-and-bar
 spec:
-  namespaceSelector: projectcalico.org/name in {"foo", "bar"}
+  namespaceSelector: kubernetes.io/metadata.name in {"foo", "bar"}
   selector: color == "red"
   types:
   - Ingress
   ingress:
   - action: Allow
     source:
-      namespaceSelector: projectcalico.org/name == "baz"
+      namespaceSelector: kubernetes.io/metadata.name == "baz"
     destination:
       ports:
       - 8080
@@ -52,7 +52,7 @@ means "resources in any namespace and non-namespaced resources that match foo ==
 Further,
 
    ```yaml
-   namespaceSelector: projectcalico.org/name == "some-namespace"
+   namespaceSelector: kubernetes.io/metadata.name == "some-namespace"
    selector: foo == "bar"
    ```
 is equivalent to:
@@ -64,11 +64,11 @@ is equivalent to:
 
 ### Labels for matching service accounts
 
-Similarly, the `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`.
+The `projectcalico.org/name` label is applied to ServiceAccounts and allows for matching by name in a `serviceAccountSelector`. Kubernetes has no equivalent automatic label for ServiceAccounts, so use `projectcalico.org/name` here.
 
-### Kubernetes labels for matching namespaces
+### The projectcalico.org/name label for namespaces {/* #projectcalico-name-label-for-namespaces */}
 
-Kubernetes also has [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), for example `kubernetes.io/metadata.name`. The Kubernetes namespace label serves the same purpose and can be used in the same way as the $[prodname] label. The `projectcalico.org/name` label predates the automatic Kubernetes label.
+$[prodname] also sets `projectcalico.org/name` to the name of the namespace, and it can be used in a `namespaceSelector` in the same way. It predates the Kubernetes [automatic labeling](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/#automatic-labelling), and $[prodname] derives it as it reads the namespace rather than storing it on the object, so `kubectl get namespace --show-labels` does not show it. For matching namespaces, prefer `kubernetes.io/metadata.name`.
 
 ## Labels for matching host endpoints
 
@@ -80,7 +80,8 @@ Kubernetes also has [automatic labeling](https://kubernetes.io/docs/concepts/ove
 
 $[prodname] labels must be used with the correct selector or the policy will not work as designed (and there are no error messages in the web console or when applying the YAML).
 
-| Calico label         | Usage requirements                                              | Use in these resources...           |
+| Label                | Usage requirements                                              | Use in these resources...           |
 | --------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
-| `projectcalico.org/name`                                     | Use with a **namespaceSelector** or **serviceAccountSelector**. | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `kubernetes.io/metadata.name`                                | Use with a **namespaceSelector**.                            | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
+| `projectcalico.org/name`                                     | Use with a **serviceAccountSelector**, or with a **namespaceSelector** (prefer `kubernetes.io/metadata.name` for namespaces). | - Network policy<br />- Staged network policy<br /><br />Namespaced resources that apply only to workload endpoint resources in the namespace.<br /> |
 | `projectcalico.org/namespace`                                | Use only with selectors. <br /><br />Use the label as the label name, and a namespace name as the value to compare against (for example projectcalico.org/namespace == "default"). | - Global network policy<br />- Staged global network policy<br /><br />Cluster-wide (non-namespaced) resources that apply to workload endpoint resources in all namespaces, and to host endpoint resources. |
diff --git a/calico-cloud_versioned_docs/version-23-2/network-policy/policy-best-practices.mdx b/calico-cloud_versioned_docs/version-23-2/network-policy/policy-best-practices.mdx
index b192def3ca..87ebe87b5c 100644
--- a/calico-cloud_versioned_docs/version-23-2/network-policy/policy-best-practices.mdx
+++ b/calico-cloud_versioned_docs/version-23-2/network-policy/policy-best-practices.mdx
@@ -143,7 +143,7 @@ The following policy is a global network policy for a microservice that limits a
 15     - action: Allow
 16       protocol: TCP
 17       source:
-18         namespaceSelector: projectcalico.org/name == "sso"
+18         namespaceSelector: kubernetes.io/metadata.name == "sso"
 19         ports:
 20           - '443'
 21           - '80'
@@ -187,7 +187,7 @@ The following policy is a global network policy for a microservice that limits a
 59     - action: Allow
 60       protocol: TCP
 61       source:
-62         namespaceSelector: projectcalico.org/name == "warehouse"
+62         namespaceSelector: kubernetes.io/metadata.name == "warehouse"
 63       destination:
 64         ports:
 65           - '1433'
diff --git a/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-aws.mdx b/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-aws.mdx
index b665860478..a1d10dd4d7 100644
--- a/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-aws.mdx
+++ b/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-aws.mdx
@@ -851,7 +851,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -867,7 +867,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
diff --git a/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-azure.mdx b/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-azure.mdx
index 3488339069..166e385eb7 100644
--- a/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-azure.mdx
+++ b/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-azure.mdx
@@ -503,7 +503,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -519,7 +519,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
diff --git a/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-maintenance.mdx b/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-maintenance.mdx
index fc0e0e0be3..97344c7e5b 100644
--- a/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-maintenance.mdx
+++ b/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-maintenance.mdx
@@ -117,7 +117,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: poll-my-own-annotations
   namespace: default
 spec:
@@ -196,7 +196,7 @@ spec:
         app: annotation-aware-workload
       annotations:
         egress.projectcalico.org/selector: egress-code == 'red'
-        egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+        egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
     spec:
       containers:
         - name: application-container
diff --git a/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-on-prem.mdx b/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-on-prem.mdx
index cafd493d09..d0cfbe26af 100644
--- a/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-on-prem.mdx
+++ b/calico-cloud_versioned_docs/version-23-2/networking/egress/egress-gateway-on-prem.mdx
@@ -390,7 +390,7 @@ By default, that selector can only match egress gateways in the same namespace.
 in a different namespace, specify a `namespaceSelector` annotation as well, like this:
 
 ```bash
-kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="projectcalico.org/name == 'default'"
+kubectl annotate ns <namespace> egress.projectcalico.org/namespaceSelector="kubernetes.io/metadata.name == 'default'"
 ```
 
 Egress gateway annotations have the same [syntax and range of expressions](../../reference/resources/networkpolicy.mdx#selector) as the selector fields in
@@ -406,7 +406,7 @@ kind: Pod
 metadata:
   annotations:
     egress.projectcalico.org/selector: egress-code == 'red'
-    egress.projectcalico.org/namespaceSelector: projectcalico.org/name == 'default'
+    egress.projectcalico.org/namespaceSelector: kubernetes.io/metadata.name == 'default'
   name: my-client,
   namespace: my-namespace,
 spec:
diff --git a/calico-cloud_versioned_docs/version-23-2/networking/egress/troubleshoot.mdx b/calico-cloud_versioned_docs/version-23-2/networking/egress/troubleshoot.mdx
index 489b464c5e..3f2ecd7a8c 100644
--- a/calico-cloud_versioned_docs/version-23-2/networking/egress/troubleshoot.mdx
+++ b/calico-cloud_versioned_docs/version-23-2/networking/egress/troubleshoot.mdx
@@ -169,12 +169,12 @@ spec:
       cidr: 11.0.0.0/8
     description: "Gateway to on prem"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'blue'"
       maxNextHops: 2
   - description: "Gateway to internet"
     gateway:
-      namespaceSelector: "projectcalico.org/name == 'default'"
+      namespaceSelector: "kubernetes.io/metadata.name == 'default'"
       selector: "egress-code == 'red'"
 ```
 

From 7ccef892ac1678be84a358893a849dba2364c5f5 Mon Sep 17 00:00:00 2001
From: Chris Tauchen <chris.tauchen@tigera.io>
Date: Thu, 8 Oct 2026 16:49:49 +0100
Subject: [PATCH 4/4] Use kubernetes.io/metadata.name in egress access controls
 use case

---
 use-cases/egress-access-controls.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/use-cases/egress-access-controls.mdx b/use-cases/egress-access-controls.mdx
index af2fb626c1..d1496a0bff 100644
--- a/use-cases/egress-access-controls.mdx
+++ b/use-cases/egress-access-controls.mdx
@@ -139,7 +139,7 @@ kind: GlobalNetworkPolicy
 metadata:
   name: deny-app-policy
 spec:
-  namespaceSelector: has(projectcalico.org/name) && projectcalico.org/name not in {"kube-system", "calico-system", "tigera-system"}
+  namespaceSelector: has(kubernetes.io/metadata.name) && kubernetes.io/metadata.name not in {"kube-system", "calico-system", "tigera-system"}
   types:
   - Ingress
   - Egress