{"record":{"id":"b17694ca198e8f31","repo":"cilium/cilium","slug":"invalid-selector-in-ciliumnodeconfig-s-w","errorCode":null,"errorMessage":"invalid selector in CiliumNodeConfig %s: %w","messagePattern":"invalid selector in CiliumNodeConfig (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/option/resolver/resolver.go","lineNumber":310,"sourceCode":"\t\treturn nil, nil, fmt.Errorf(\"could not get Node %s: %w\", nodeName, err)\n\t}\n\n\tmatching := map[string]ciliumv2.CiliumNodeConfig{}\n\n\t// track names separately, since we will compute \"priority\" by lexicographic sort\n\tvar matchingNames []string\n\n\tfor _, override := range overrides {\n\t\t// ignore empty overrides\n\t\tif len(override.Spec.Defaults) == 0 {\n\t\t\tcontinue\n\t\t}\n\n\t\t// if we're selecting on a list, then evaluate the node selector\n\t\tif name == \"\" && override.Spec.NodeSelector != nil {\n\t\t\tls, err := metav1.LabelSelectorAsSelector(override.Spec.NodeSelector)\n\t\t\tif err != nil { // unreachable\n\t\t\t\treturn nil, nil, fmt.Errorf(\"invalid selector in CiliumNodeConfig %s: %w\", override.Name, err)\n\t\t\t}\n\t\t\tif ls.Matches(labels.Set(node.Labels)) {\n\t\t\t\tmatching[override.Name] = override\n\t\t\t\tmatchingNames = append(matchingNames, override.Name)\n\t\t\t}\n\t\t} else if name != \"\" {\n\t\t\tmatching[override.Name] = override\n\t\t\tmatchingNames = append(matchingNames, override.Name)\n\t\t}\n\t}\n\n\t// Within overrides, lexicographical ordering determines priority.\n\tslices.Sort(matchingNames)\n\n\tout := make(map[string]string)\n\tfor _, name := range matchingNames {\n\t\tfor k, v := range matching[name].Spec.Defaults {\n\t\t\tif errs := apivalidation.IsConfigMapKey(k); len(errs) > 0 {","sourceCodeStart":292,"sourceCodeEnd":328,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/option/resolver/resolver.go#L292-L328","documentation":"Each listed CiliumNodeConfig's Spec.NodeSelector is converted to a label Selector via metav1.LabelSelectorAsSelector to test whether it matches this node's labels. Conversion of a valid stored CR is considered unreachable, but if it fails this error wraps the invalid selector, skipping all CNC matching.","triggerScenarios":"LabelSelectorAsSelector returns an error, e.g. selector containing invalid keys/values that bypass API validation (hand-crafted CRs, direct etcd writes, or CRs created before validation was enforced).","commonSituations":"CiliumNodeConfig objects created via a client that skipped server-side selector validation, CRs copied from other resources with malformed matchExpressions (bad operator names), or cluster upgrade mixing schema versions.","solutions":["Fix the NodeSelector on the offending CiliumNodeConfig (the name is in the message): use valid keys, values, and operators (In, NotIn, Exists, DoesNotExist)","Validate with kubectl: kubectl get ciliumnodeconfig <name> -o yaml and check spec.nodeSelector","Re-create the CR via kubectl apply so API validation runs","Upgrade cilium/client-go so LabelSelectorAsSelector handles the schema version in use"],"exampleFix":"// before\nnodeSelector:\n  matchExpressions:\n  - key: kubernetes.io/os\n    operator: equals   # invalid operator\n    values: [linux]\n// after\nnodeSelector:\n  matchExpressions:\n  - key: kubernetes.io/os\n    operator: In\n    values: [linux]","handlingStrategy":"validation","validationCode":"// Go: validate selectors of referenced CNCs before resolving\nl, _ := client.CiliumV2().CiliumNodeConfigs(ns).List(ctx, metav1.ListOptions{})\nfor _, c := range l.Items {\n    if c.Spec.NodeSelector != nil {\n        if _, err := metav1.LabelSelectorAsSelector(c.Spec.NodeSelector); err != nil {\n            return fmt.Errorf(\"CNC %s has invalid nodeSelector: %w\", c.Name, err)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"cfg, sources, err := resolver.ReadConfigSource(ctx, logger, client, nodeName, source)\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid selector in CiliumNodeConfig\") {\n        logger.Error(\"fix the NodeSelector on the named CiliumNodeConfig\", \"err\", err)\n    }\n    return err\n}","preventionTips":["Create CNCs only via kubectl apply so API selector validation runs","Use only valid matchExpressions operators (In, NotIn, Exists, DoesNotExist)","Lint CNC YAML against the cilium.io/v2 schema in CI","Re-apply old CRs after cluster upgrades to re-run validation"],"tags":["kubernetes","validation","label-selector"],"backgroundTag":"invalid-label-selector","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}