{"record":{"id":"828402ecab4f7cf2","repo":"helm/helm","slug":"invalid-label-selector-w","errorCode":null,"errorMessage":"invalid label selector: %w","messagePattern":"invalid label selector: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/kube/wait.go","lineNumber":205,"sourceCode":"\t\tselector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)\n\tcase *appsv1beta1.Deployment:\n\t\tselector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)\n\tcase *appsv1beta2.Deployment:\n\t\tselector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)\n\tcase *batchv1.Job:\n\t\tselector, err = metav1.LabelSelectorAsSelector(t.Spec.Selector)\n\tcase *corev1.Service:\n\t\tif len(t.Spec.Selector) == 0 {\n\t\t\treturn nil, fmt.Errorf(\"invalid service '%s': Service is defined without a selector\", t.Name)\n\t\t}\n\t\tselector = labels.SelectorFromSet(t.Spec.Selector)\n\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"selector for %T not implemented\", object)\n\t}\n\n\tif err != nil {\n\t\treturn selector, fmt.Errorf(\"invalid label selector: %w\", err)\n\t}\n\n\treturn selector, nil\n}\n\nfunc (hw *legacyWaiter) watchTimeout(t time.Duration) func(*resource.Info) error {\n\treturn func(info *resource.Info) error {\n\t\treturn hw.watchUntilReady(t, info)\n\t}\n}\n\n// WatchUntilReady watches the resources given and waits until it is ready.\n//\n// This method is mainly for hook implementations. It watches for a resource to\n// hit a particular milestone. The milestone depends on the Kind.\n//\n// For most kinds, it checks to see if the resource is marked as Added or Modified\n// by the Kubernetes event stream. For some kinds, it does more:","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/helm/helm/blob/2a29f1770b62844b27197d2507377361d45ad7c0/pkg/kube/wait.go#L187-L223","documentation":"Wraps the error from metav1.LabelSelectorAsSelector (pkg/kube/wait.go:205) during legacy --wait. The workload's spec.selector could not be converted into a valid labels.Selector — the selector in the manifest is structurally invalid (empty matchLabels AND empty matchExpressions, or malformed matchExpressions operators/values).","triggerScenarios":"helm install/upgrade --wait where a Deployment/Job carries a malformed spec.selector: selector: {} (nothing set), matchExpressions using an invalid operator (e.g. 'NotIn' instead of 'NotIn' casing issues, '==' style), or templating that renders matchLabels keys with invalid characters.","commonSituations":"Helm template conditionals that omit selector block entirely when a value is empty; copy-paste selectors with wrong operator names; YAML indentation putting matchExpressions under the wrong key so API deserialization yields an effectively-empty selector.","solutions":["Read the wrapped error — it states exactly what is invalid about the selector.","Fix spec.selector in the template: at least one matchLabels entry or a well-formed matchExpressions item.","Validate manifests before install: helm template . | kubectl apply --dry-run=server -f -.","Add a CI chart-test (helm lint plus template render) to catch empty selectors early."],"exampleFix":"# before: conditional renders an empty selector\nselector:\n  matchLabels:\n{{- if .Values.labels }}\n{{ toYaml .Values.labels | nindent 6 }}\n{{- end }}\n\n# after: always pin the app label\nselector:\n  matchLabels:\n    app.kubernetes.io/name: {{ include \"chart.name\" . }}","handlingStrategy":"validation","validationCode":"// Validate every workload selector before install\nfor _, doc := range manifests {\n\tswitch t := doc.(type) {\n\tcase *appsv1.Deployment:\n\t\tif t.Spec.Selector == nil || (len(t.Spec.Selector.MatchLabels) == 0 && len(t.Spec.Selector.MatchExpressions) == 0) {\n\t\t\treturn fmt.Errorf(\"deployment %s has empty selector\", t.Name)\n\t\t}\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := installWithWait(); err != nil && strings.Contains(err.Error(), \"invalid label selector\") {\n\t// fix the workload's spec.selector and redeploy\n}","preventionTips":["helm lint and server-side dry-run in CI to catch malformed selectors.","Template guards: fail chart rendering if selector blocks would be empty.","Use immutable selectors pinned to a stable label key."],"tags":["kubernetes","selector","validation","wait","templating"],"backgroundTag":null,"analyzedSha":"2a29f1770b62844b27197d2507377361d45ad7c0","analyzedAt":"2026-08-15T22:02:47.490Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}