crowdsecurity/crowdsec · error

selector must be set in kubernetes acquisition

Error message

selector must be set in kubernetes acquisition

What it means

The kubernetes acquisition source tails pod logs matching a label selector; without a selector it would have to tail every pod in the cluster. Configuration.Validate() requires Selector to be non-empty so the watch is scoped to the pods you intend to collect from.

Source

Thrown at pkg/acquisition/modules/kubernetes/config.go:60

func (c *Configuration) SetDefaults() {
	if c.Namespace == "" {
		c.Namespace = "default"
	}

	if c.Mode == "" {
		c.Mode = configuration.TAIL_MODE
	}
	if c.KubeConfigFile == "" {
		if home, err := os.UserHomeDir(); err == nil {
			c.KubeConfigFile = filepath.Join(home, ".kube", "config")
		}
	}
}

func (c *Configuration) Validate() error {
	if c.Selector == "" {
		return errors.New("selector must be set in kubernetes acquisition")
	}
	if _, err := labels.Parse(c.Selector); err != nil {
		return fmt.Errorf("invalid selector %q in kubernetes acquisition: %w", c.Selector, err)
	}
	if c.Mode != configuration.TAIL_MODE {
		return fmt.Errorf("unsupported mode %q in kubernetes acquisition, only %q is supported", c.Mode, configuration.TAIL_MODE)
	}
	return nil
}

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	cfg, err := ConfigurationFromYAML(yamlConfig)
	if err != nil {
		return err
	}

	if s.logger != nil {
		s.logger.Tracef("Kubernetes configuration: %+v", cfg)

View on GitHub (pinned to 909b515798)

Solutions

1. Add a label selector to the acquisition YAML, e.g. selector: app=crowdsec-logs (Kubernetes label selector syntax, comma-separated).
2. Scope tightly to the pods whose logs you need rather than using a broad selector.
3. Verify the selector syntax with kubectl get pods -l '<selector>' before deploying.

Example fix

// before (yaml)
source: kubernetes
mode: tail

// after (yaml)
source: kubernetes
mode: tail
selector: app=nginx

if cfg.Selector == "" {
    return fmt.Errorf("kubernetes acquisition: selector is required")
}
if _, err := labels.Parse(cfg.Selector); err != nil {
    return fmt.Errorf("kubernetes acquisition: bad selector: %w", err)
}

When it happens

Trigger: Calling Validate() on a kubernetes Configuration whose Selector field is the empty string — typically a YAML config missing the `selector:` key.

Common situations: A new acquisition file where the user wrote only source: kubernetes and mode, assuming logs are collected cluster-wide; or a templated selector that rendered empty.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• listen_addr cannot be empty
• listen_port cannot be empty
• webhook_path cannot be empty
• mtls is selected, but ca_cert is not provided
• invalid auth_type: must be one of basic_auth, headers, mtls

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a20213724240f4b4. Report an issue: GitHub.