{"record":{"id":"f67cc6ed7ba9b066","repo":"kubernetes/kubernetes","slug":"field-label-does-not-support-subscript-s","errorCode":null,"errorMessage":"field label does not support subscript: %s","messagePattern":"field label does not support subscript: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apis/core/pods/helpers.go","lineNumber":71,"sourceCode":"\t}\n\treturn true\n}\n\n// ConvertDownwardAPIFieldLabel converts the specified downward API field label\n// and its value in the pod of the specified version to the internal version,\n// and returns the converted label and value. This function returns an error if\n// the conversion fails.\nfunc ConvertDownwardAPIFieldLabel(version, label, value string) (string, string, error) {\n\tif version != \"v1\" {\n\t\treturn \"\", \"\", fmt.Errorf(\"unsupported pod version: %s\", version)\n\t}\n\n\tif path, _, ok := fieldpath.SplitMaybeSubscriptedPath(label); ok {\n\t\tswitch path {\n\t\tcase \"metadata.annotations\", \"metadata.labels\":\n\t\t\treturn label, value, nil\n\t\tdefault:\n\t\t\treturn \"\", \"\", fmt.Errorf(\"field label does not support subscript: %s\", label)\n\t\t}\n\t}\n\n\tswitch label {\n\tcase \"metadata.annotations\",\n\t\t\"metadata.labels\",\n\t\t\"metadata.name\",\n\t\t\"metadata.namespace\",\n\t\t\"metadata.uid\",\n\t\t\"spec.nodeName\",\n\t\t\"spec.restartPolicy\",\n\t\t\"spec.serviceAccountName\",\n\t\t\"spec.schedulerName\",\n\t\t\"status.phase\",\n\t\t\"status.hostIP\",\n\t\t\"status.hostIPs\",\n\t\t\"status.podIP\",\n\t\t\"status.podIPs\":","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/pkg/apis/core/pods/helpers.go#L53-L89","documentation":"Thrown by ConvertDownwardAPIFieldLabel() when the label contains a subscript (e.g. 'metadata.annotations[foo]') but the subscripted base path is not 'metadata.annotations' or 'metadata.labels'. Only those two fields support subscripted access in downward-API field selectors; any other subscripted path is unsupported.","triggerScenarios":"Querying pods with a field selector like 'spec.containers[0].name=...' or 'status.podIP[0]=...'; the SplitMaybeSubscriptedPath detects a subscript and the switch falls into the default branch.","commonSituations":"Assuming any pod field supports array/map subscripts; building selectors dynamically and appending '[key]' to arbitrary fields.","solutions":["Use only 'metadata.annotations[<key>]' or 'metadata.labels[<key>]' for subscripted selectors.","For non-subscripted fields, drop the bracket syntax and use the flat path (e.g. 'metadata.name').","Review fieldpath.SplitMaybeSubscriptedPath behavior to confirm subscript is actually needed."],"exampleFix":"# before\nkubectl get pods --field-selector spec.containers[0].name=nginx\n\n# after\nkubectl get pods --field-selector metadata.labels[app]=nginx","handlingStrategy":"validation","validationCode":"func validateSubscriptedLabel(label string) error {\n    path, _, ok := fieldpath.SplitMaybeSubscriptedPath(label)\n    if !ok { return nil }\n    if path != \"metadata.annotations\" && path != \"metadata.labels\" {\n        return fmt.Errorf(\"field label does not support subscript: %s\", label)\n    }\n    return nil\n}","typeGuard":"func supportsSubscript(label string) bool {\n    path, _, ok := fieldpath.SplitMaybeSubscriptedPath(label)\n    return !ok || path == \"metadata.annotations\" || path == \"metadata.labels\"\n}","tryCatchPattern":null,"preventionTips":["Only use subscripts with metadata.annotations[...] and metadata.labels[...].","For other fields, use the flat path without brackets.","Validate selector strings before sending list/watch requests."],"tags":["kubernetes","pod","field-selector","downward-api","validation"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}