A policy should allow ingress only from Pods labeled app=frontend inside namespaces labeled team=shop. Which peer structure requires both conditions?

1. One from entry containing both namespaceSelector and podSelector
2. An ingress rule with an empty from list omitted entirely
3. A namespaceSelector with matchLabels app=frontend only
4. Separate from entries for namespaceSelector and podSelector