diff --git a/kuryr_kubernetes/controller/drivers/network_policy.py b/kuryr_kubernetes/controller/drivers/network_policy.py
index 205d12995..615f79b03 100644
--- a/kuryr_kubernetes/controller/drivers/network_policy.py
+++ b/kuryr_kubernetes/controller/drivers/network_policy.py
@@ -189,6 +189,9 @@ class NetworkPolicyDriver(base.NetworkPolicyDriver):
         cidrs = []
         namespace_label = urlencode(namespace_selector[
             'matchLabels'])
+        # NOTE(maysams): K8s API does not accept &, so we need to replace
+        # it with ',' or '%2C' instead
+        namespace_label = namespace_label.replace('&', ',')
         matching_namespaces = self.kubernetes.get(
             '{}/namespaces?labelSelector={}'.format(
                 constants.K8S_API_BASE, namespace_label)).get('items')
diff --git a/kuryr_kubernetes/controller/drivers/network_policy_security_groups.py b/kuryr_kubernetes/controller/drivers/network_policy_security_groups.py
index 8bc9a9031..4f7bae687 100644
--- a/kuryr_kubernetes/controller/drivers/network_policy_security_groups.py
+++ b/kuryr_kubernetes/controller/drivers/network_policy_security_groups.py
@@ -34,6 +34,9 @@ def _get_kuryrnetpolicy_crds(labels=None, namespace='default'):
             labels.pop('pod-template-hash', None)
             # removing pod-template-hash is necessary to fetch the proper list
             labels = urlencode(labels)
+            # NOTE(maysams): K8s API does not accept &, so we need to replace
+            # it with ',' or '%2C' instead
+            labels = labels.replace('&', ',')
             knp_path = '{}/{}/kuryrnetpolicies?labelSelector={}'.format(
                 constants.K8S_API_CRD_NAMESPACES, namespace, labels)
             LOG.debug("K8s API Query %s", knp_path)