Best practice for access to kube-dns

[5nafu]

Hi,

in calico_versioned_docs/version-3.30/network-policy/policy-rules/service-policy.mdx#L53-L64 the example to allow access to kube-dns uses the service:

- action: Allow
  destination:
    services:
      name: kube-dns
      namespace: kube-system

on the other hand, calico_versioned_docs/version-3.30/network-policy/get-started/kubernetes-default-deny.mdx#L109-L120 accomplishes the same with a more complex rule using a label selector:

- action: Allow
  protocol: UDP
  destination:
    selector: 'k8s-app == "kube-dns"'
    ports:
    - 53
- action: Allow
  protocol: TCP
  destination:
    selector: 'k8s-app == "kube-dns"'
    ports:
    - 53

While I assume both to be working the same, from user perspective this might irritate when one only knows one variant and stumbles upon the other.

Should these example be adjusted to be the same? And if not: Which would be the preferred one from Calicos perspective?