crowdsecurity/crowdsec · error

invalid selector %q in kubernetes acquisition: %w

Error message

invalid selector %q in kubernetes acquisition: %w

What it means

Validate rejects a kubernetes acquisition config whose selector is not a parseable Kubernetes label selector. labels.Parse fails on malformed expressions like 'app=,' or unbalanced parentheses, aborting datasource setup.

Source

Thrown at pkg/acquisition/modules/kubernetes/config.go:63

		c.Namespace = "default"
	}

	if c.Mode == "" {
		c.Mode = configuration.TAIL_MODE
	}
	if c.KubeConfigFile == "" {
		if home, err := os.UserHomeDir(); err == nil {
			c.KubeConfigFile = filepath.Join(home, ".kube", "config")
		}
	}
}

func (c *Configuration) Validate() error {
	if c.Selector == "" {
		return errors.New("selector must be set in kubernetes acquisition")
	}
	if _, err := labels.Parse(c.Selector); err != nil {
		return fmt.Errorf("invalid selector %q in kubernetes acquisition: %w", c.Selector, err)
	}
	if c.Mode != configuration.TAIL_MODE {
		return fmt.Errorf("unsupported mode %q in kubernetes acquisition, only %q is supported", c.Mode, configuration.TAIL_MODE)
	}
	return nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	cfg, err := ConfigurationFromYAML(yamlConfig)
	if err != nil {
		return err
	}

	if s.logger != nil {
		s.logger.Tracef("Kubernetes configuration: %+v", cfg)
	}

	s.config = cfg

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the selector syntax, e.g. selector: app=nginx or selector: environment in (prod,staging)
2. Test the selector with kubectl get pods -l '<selector>'

When it happens

Trigger: Thrown at pkg/acquisition/modules/kubernetes/config.go:63 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/98991db832f4360b. Report an issue: GitHub.