Kubernetes labels define selection, not authorization

Thu, 09 Sep 2027 00:00:00 +0000

Labels are key-value metadata used to select Kubernetes objects. A Service selector, an operational query, and a workload controller can all rely on them, but each consumer has its own API and behavior. A label change can therefore alter group membership while leaving the underlying process healthy. Review labels as inputs to actual consumers rather than as purely descriptive stickers.

Know which selector language is in use

Label keys use a qualified-name syntax, and values have format and length constraints. A value may be empty; otherwise its permitted characters and endpoints are restricted, with a maximum of sixty-three characters. Labels are not a place for arbitrary paragraphs or unconstrained JSON. Use annotations for descriptive metadata, while still respecting annotation validation and consumer contracts.

Equality requirements can test that a key has a value, while set-based requirements support membership and existence tests. Multiple requirements in a selector are combined as conditions that must all hold. An important detail is inequality: track!=canary also matches an object with no track label. If absence is unacceptable, require the key to exist as well instead of assuming inequality implies its presence.

Selector forms differ between resources. A normal selector-based Service uses a map of equality requirements; it does not accept the complete set-expression language as arbitrary map values. Other APIs expose LabelSelector structures, and kubectl list queries accept selector expressions. Check the exact field’s schema before translating a convenient command-line query into a manifest.

When it breaks

A Service’s selector identifies matching Pods in its namespace, and the endpoint machinery tracks addresses and readiness. Matching labels alone do not prove that a server is ready or that its port is correct. With normal readiness behavior, available routing targets depend on endpoint conditions too. Inspect the relevant EndpointSlices and application checks rather than stopping at a successful label query.

The publishNotReadyAddresses setting changes how readiness is treated for Service discovery. Do not assume an endpoint’s ready flag always proves the Pod passed its application probe under that setting. The fixture below uses the ordinary default and does not exercise this override.

Relabelling a healthy Pod can remove it from a Service without terminating it. Conversely, an overly broad selector can include a workload that was never intended as a backend. Changing labels on controller-managed Pods can also interact with ownership and reconciliation. Update the intended desired state through the responsible controller, and check all important consumers of a shared label before changing its meaning.

Selectors are not network authorization. A Pod excluded from one Service can remain reachable through its own address or another Service unless other controls prevent that access. NetworkPolicy, application authorization, and routing each solve different parts of the problem. Do not describe a selector as a guest list that denies all direct traffic to unselected Pods.

Check it quickly

Use a disposable Kubernetes cluster with kubectl and python:3.11-slim-bookworm available on the nodes. Save this as label-selectors.py and run python3 label-selectors.py KUBECONFIG_PATH CONTEXT with explicit test-cluster arguments. The script creates a unique namespace containing three standalone HTTP Pods and a Service, then removes it. The recorded server version was Kubernetes 1.34.11.

import json
import subprocess
import sys
import time
from uuid import uuid4

assert len(sys.argv) == 3, 'usage: python3 example.py DISPOSABLE_KUBECONFIG CONTEXT'
base = ['kubectl', '--kubeconfig', sys.argv[1], '--context', sys.argv[2], '--request-timeout=30s']
image = 'python:3.11-slim-bookworm'


def k(*args, payload=None, expected=0):
 result = subprocess.run(base + list(args), input=json.dumps(payload) if payload is not None else None,
 capture_output=True, text=True, timeout=150)
 if expected is not None:
 assert result.returncode == expected, result.stderr
 return result


def obj(namespace, kind, name=None, selector=None):
 args = ['get', kind, '-n', namespace, '-o', 'json']
 if name:
 args.append(name)
 if selector:
 args += ['-l', selector]
 return json.loads(k(*args).stdout)


def apply(namespace, data):
 return k('apply', '-n', namespace, '-f', '-', payload=data)


def wait_for(read, ready, seconds=120):
 until = time.monotonic() + seconds
 while time.monotonic() < until:
 value = read()
 if ready(value):
 return value
 time.sleep(0.5)
 raise AssertionError('expected Kubernetes condition did not arrive')


def pod_ready(pod):
 return any(c['type'] == 'Ready' and c['status'] == 'True'
 for c in pod.get('status', {}).get('conditions', []))


def spec(script='import time; time.sleep(600)'):
 return {'automountServiceAccountToken': False, 'terminationGracePeriodSeconds': 1,
 'containers': [{'name': 'app', 'image': image, 'imagePullPolicy': 'IfNotPresent',
 'command': ['python3', '-c', script],
 'resources': {'requests': {'cpu': '10m', 'memory': '24Mi'},
 'limits': {'cpu': '200m', 'memory': '96Mi'}}}]}

namespace = 'notes-labels-' + uuid4().hex[:8]
k('create', 'namespace', namespace)
try:
 for name, role, track in [('a', 'reader', 'stable'), ('b', 'reader', 'canary'), ('c', 'writer', None)]:
 script = '''from http.server import BaseHTTPRequestHandler,HTTPServer
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 data=LABEL.encode();self.send_response(200);self.send_header('Content-Length',str(len(data)));self.end_headers();self.wfile.write(data)
 def log_message(self,*args): pass
HTTPServer(('0.0.0.0',8080),Handler).serve_forever()
'''.replace('LABEL', repr(name))
 podspec = spec(script)
 podspec['containers'][0]['readinessProbe'] = {'httpGet': {'path': '/', 'port': 8080}, 'periodSeconds': 1}
 labels = {'app': 'catalog', 'role': role}
 if track:
 labels['track'] = track
 apply(namespace, {'apiVersion': 'v1', 'kind': 'Pod', 'metadata': {'name': name, 'labels': labels}, 'spec': podspec})
 for name in ('a', 'b', 'c'):
 wait_for(lambda name=name: obj(namespace, 'pod', name), pod_ready)
 apply(namespace, {'apiVersion': 'v1', 'kind': 'Service', 'metadata': {'name': 'readers'},
 'spec': {'selector': {'app': 'catalog', 'role': 'reader'}, 'ports': [{'port': 80, 'targetPort': 8080}]}})
 def selected():
 slices = obj(namespace, 'endpointslices', selector='kubernetes.io/service-name=readers')['items']
 return {e['targetRef']['name'] for item in slices for e in item.get('endpoints', [])
 if e.get('conditions', {}).get('ready') and e.get('targetRef')}
 before = wait_for(selected, lambda names: names == {'a', 'b'})
 inequality = {p['metadata']['name'] for p in obj(namespace, 'pods', selector='app=catalog,track!=canary')['items']}
 assert inequality == {'a', 'c'}
 expression = {p['metadata']['name'] for p in obj(namespace, 'pods', selector='app in (catalog),role=reader')['items']}
 assert expression == {'a', 'b'}
 writer_ip = obj(namespace, 'pod', 'c')['status']['podIP']
 probe = 'from urllib.request import urlopen; print(urlopen(' + repr('http://'+writer_ip+':8080/') + ',timeout=3).read().decode())'
 assert k('exec', '-n', namespace, 'a', '--', 'python3', '-c', probe).stdout.strip() == 'c'
 k('label', 'pod', 'b', '-n', namespace, 'role=writer', '--overwrite')
 after = wait_for(selected, lambda names: names == {'a'})
 assert pod_ready(obj(namespace, 'pod', 'b'))
 invalid = k('patch', 'pod', 'a', '-n', namespace, '--type=merge',
 '-p', json.dumps({'metadata': {'labels': {'notes.example/value': 'has spaces'}}}), expected=None)
 assert invalid.returncode != 0 and 'Invalid' in invalid.stderr
 print(json.dumps({'service_targets_before': sorted(before), 'service_targets_after': sorted(after),
 'inequality_also_matches_missing_key': sorted(inequality),
 'set_selector_matches': sorted(expression), 'excluded_pod_directly_reachable': True,
 'invalid_label_value_rejected': True}))
finally:
 k('delete', 'namespace', namespace, '--wait=true', '--timeout=90s')

Pods a and b have role=reader; c has role=writer. All share app=catalog and become ready through HTTP probes. Pod a has a stable track, b has canary, and c lacks track. The reader Service initially has ready targets a and b. A set-based query finds those readers, while track!=canary finds a and c, confirming the missing-key behavior.

An actual request from a to c’s Pod address returns c, even though c is excluded from the reader Service. Changing b’s role to writer then leaves only a in the Service’s ready endpoint set. Pod b remains ready. A separate patch containing spaces in a label value is rejected by the API. All assertions passed.

This verifies API selection, EndpointSlice changes, and direct reachability in the isolated test network. It does not test every controller’s adoption rules, enforce a NetworkPolicy, or benchmark Service traffic. Keep selection intent, endpoint readiness, and access policy independently observable when reviewing routing changes.

Sources

Kubernetes: Labels and Selectors, valid values, equality and set-based requirements, checked 2026-09-13.
Kubernetes: Services, selector-based backend discovery, checked 2026-09-13.
Kubernetes: EndpointSlices, endpoint identity and readiness conditions, checked 2026-09-13.

Selectors · XB Field Notes

Kubernetes labels define selection, not authorization

Know which selector language is in use

When it breaks

Check it quickly

Sources