Labels and Annotations

Labels

• Key-value pairs for categorizing and selecting objects
• Used by Deployments, Services, NetworkPolicies for selectors
• Equality selectors: comma = AND, not OR; use in for OR

Selectors in YAML

# matchLabels: simple equality (AND for multiple keys)
selector:
  matchLabels:
    app: web
    env: prod

# matchExpressions: In, NotIn, Exists, DoesNotExist
selector:
  matchExpressions:
  - key: tier
    operator: In
    values: [frontend, backend]
  - key: env
    operator: NotIn
    values: [dev]
  - key: canary
    operator: DoesNotExist

Label commands

kubectl run myapp --image=nginx --labels=app=web,env=prod
kubectl get po --show-labels
kubectl get po -l app=web
kubectl get po -l 'tier in (frontend,backend)'
kubectl get po -l 'canary'                   # label exists
kubectl get po -l '!canary'                  # label does not exist
kubectl label pod mypod version=v2
kubectl label pod mypod version=v3 --overwrite
kubectl label pod mypod version-               # remove (trailing -)

Annotations

• Key-value metadata only: not queryable (-l does not work)
• No --annotations on kubectl run: YAML or kubectl annotate after create
• Uses: commit hash, author, release notes, on-call

Reserved annotations

• kubernetes.io/change-cause: rollout history
• pod-security.kubernetes.io/enforce: baseline: namespace Pod security

Labels vs annotations