A Kubernetes _____ is an abstraction that defines a logical set of Pods and a policy by which to access them.

A Selector is a mechanism used by Services (and other resources) to identify a set of Pods based on labels, but it is not the abstraction itself that defines the access policy.

A Controller (e.g., Deployment, ReplicaSet) manages the lifecycle and desired state of Pods, but it does not define the network access policy to a logical set of Pods.

A Kubernetes Service is an abstract way to expose an application running on a set of Pods as a network service. It defines a logical set of Pods, typically identified by a Label Selector, and a policy to access them (e.g., ClusterIP, NodePort, LoadBalancer).

A Job is a Kubernetes resource that creates one or more Pods and ensures a specified number of them successfully terminate, typically for batch processing, not for defining network access policies.