Labels and Selectors

apiVersion: apps/v1
kind: Deployment
metadata:
  name: checkout-api
  namespace: production
  labels:                                   # Labels on the Deployment object itself
    app.kubernetes.io/name: checkout-api    # Recommended standard label: app name
    app.kubernetes.io/version: "2.3.0"      # Recommended standard label: version
    app.kubernetes.io/component: api        # What role this component plays
    app.kubernetes.io/part-of: checkout     # The larger system this belongs to
    app.kubernetes.io/managed-by: helm      # What tool manages this object
spec:
  replicas: 3
  selector:
    matchLabels:
      app: checkout-api                     # Selector: own Pods with label app=checkout-api
      env: production                       # AND label env=production
                                            # Both labels must match — this is an AND condition
  template:
    metadata:
      labels:
        app: checkout-api                   # MUST match selector above — Kubernetes enforces this
        env: production                     # MUST match selector above
        version: "2.3.0"                    # Extra label for canary/traffic splitting later
        team: payments                      # Organisational label — which team owns this Pod
    spec:
      containers:
        - name: checkout-api
          image: company/checkout-api:2.3.0
          ports:
            - containerPort: 3000

kubectl get pods -l app=checkout-api
# -l: label selector flag — filters results to objects matching the label expression
# Returns all pods with label app=checkout-api regardless of namespace

kubectl get pods -l app=checkout-api,env=production
# Multiple labels: comma = AND — both labels must match
# This is equality-based selection: both must be exactly equal

kubectl get pods -l 'env in (production,staging)'
# Set-based: match pods in EITHER production OR staging environment
# Must quote the expression in single quotes in bash to avoid shell interpretation

kubectl get pods -l 'env in (production),team=payments'
# Mixing: set-based AND equality-based in the same selector — fully supported
# Returns pods that are in production AND belong to the payments team

kubectl get pods -l 'version notin (1.0,1.1)'
# notin: match pods whose version label is NOT in this set
# Useful for finding all non-legacy pods, or all pods running newer versions

kubectl get pods -l '!deprecated'
# !key: match objects that do NOT have this label at all
# Finds pods that haven't been tagged as deprecated — note the single quotes

kubectl get all -l app=checkout-api
# get all: returns Pods, Deployments, ReplicaSets, Services — everything matching the label
# The quickest way to see every object associated with a component

kubectl label pod checkout-api-6f8b9d-2xpkj hotfix=true
# label: imperatively add a label to an existing object without editing YAML
# Useful for temporary tagging during debugging — e.g. mark a Pod for special treatment

apiVersion: batch/v1            # Jobs live in the batch API group
kind: Job
metadata:
  name: db-migration-v3
spec:
  template:
    metadata:
      labels:
        app: db-migration
        run: v3
    spec:
      restartPolicy: Never      # Jobs use Never or OnFailure — not Always (which is for Deployments)
      nodeSelector:             # nodeSelector: simplest way to constrain which nodes a Pod runs on
        region: eu-west         # Only schedule on nodes labelled region=eu-west
        node-type: general      # AND node-type=general (not spot, not gpu)

      affinity:                 # affinity: more expressive node/pod placement rules (Lesson 48)
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:   # Hard requirement — must match
            nodeSelectorTerms:
              - matchExpressions:                           # matchExpressions: set-based node selection
                  - key: node-type                         # The label key to evaluate
                    operator: NotIn                        # Operator: In, NotIn, Exists, DoesNotExist
                    values:                                # The set of values to check against
                      - spot                               # Do NOT schedule on spot nodes
                      - preemptible                        # Do NOT schedule on preemptible nodes
                      - gpu                                # Do NOT schedule on gpu nodes

metadata:
  name: inventory-service
  labels:
    # --- Kubernetes Recommended Labels (understood by dashboards and tooling) ---
    app.kubernetes.io/name: inventory-service     # The name of the application
    app.kubernetes.io/instance: inventory-prod    # Unique instance name (useful for multiple envs)
    app.kubernetes.io/version: "4.1.2"            # Current version/tag of the application
    app.kubernetes.io/component: api              # Component role: api, worker, database, cache
    app.kubernetes.io/part-of: inventory-system   # The system this is a part of
    app.kubernetes.io/managed-by: helm            # Tool managing the lifecycle: helm, kubectl, argo

    # --- Organisational Labels (human-facing, not used by K8s for routing) ---
    team: inventory                               # Owning team — critical for multi-team clusters
    env: production                               # Environment: production, staging, development
    cost-centre: "CC-4412"                        # For chargeback/showback in FinOps pipelines
    on-call: inventory-oncall                     # PagerDuty rotation or Slack handle for alerts