kubernetes/kubernetes · error

unable to create pods, no labels

Error message

unable to create pods, no labels

What it means

createPods checks that the pod being created has at least one label before making the API Create call. Labels are required because controllers use label selectors to find and manage their pods. Without labels, the controller would create pods it can never reconcile, leading to orphaned resources. The pod's labels are copied from PodTemplateSpec.Labels via GetPodFromTemplate.

Source

Thrown at pkg/controller/controller_utils.go:594

	pod := &v1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Labels:       desiredLabels,
			Annotations:  desiredAnnotations,
			GenerateName: prefix,
			Finalizers:   desiredFinalizers,
		},
	}
	if controllerRef != nil {
		pod.OwnerReferences = append(pod.OwnerReferences, *controllerRef)
	}
	pod.Spec = *template.Spec.DeepCopy()
	return pod, nil
}

func (r RealPodControl) createPods(ctx context.Context, namespace string, pod *v1.Pod, object runtime.Object, controllerRef *metav1.OwnerReference) error {
	if len(labels.Set(pod.Labels)) == 0 {
		return fmt.Errorf("unable to create pods, no labels")
	}
	newPod, err := r.KubeClient.CoreV1().Pods(namespace).Create(ctx, pod, metav1.CreateOptions{})
	if err != nil {
		// only send an event if the namespace isn't terminating
		if !apierrors.HasStatusCause(err, v1.NamespaceTerminatingCause) {
			r.Recorder.Eventf(object, v1.EventTypeWarning, FailedCreatePodReason, "Error creating: %v", err)
		}
		return err
	}
	logger := klog.FromContext(ctx)
	if r.OnWrite != nil {
		r.OnWrite(newPod, controllerRef)
	}
	accessor, err := meta.Accessor(object)
	if err != nil {
		logger.Error(err, "parentObject does not have ObjectMeta")
		return nil
	}

View on GitHub (pinned to 94c1367642)

Solutions

1. Ensure the workload spec's spec.template.metadata.labels has at least one label.
2. Verify labels in the template satisfy spec.selector.matchLabels.
3. Check for admission webhooks that strip labels from pod templates.

Example fix

# before
spec:
  template:
    metadata: {}
    spec:
      containers:
        - name: app

# after
spec:
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
        - name: app

// Before creating pods, verify the template has labels
if len(template.Labels) == 0 {
    return fmt.Errorf("pod template must have at least one label")
}

When it happens

Trigger: RealPodControl.createPods is called with a pod whose .Labels map is empty or nil. The pod is built from GetPodFromTemplate which copies labels from PodTemplateSpec.Labels. If the workload spec's template has no labels, this triggers.

Common situations: A StatefulSet/ReplicaSet/DaemonSet/Job spec with spec.template.metadata.labels omitted or empty. A template where labels were stripped by a mutating admission webhook. A misconfigured manifest where the selector references labels that don't exist in the template.

Related errors

• controllerRef is nil
• controllerRef has empty APIVersion
• controllerRef has empty Kind
• controllerRef.Controller is not set to true
• controllerRef.BlockOwnerDeletion is not set

AI-assisted analysis of kubernetes/kubernetes@94c1367642 (2026-08-08). Data as JSON: /api/errors/330099d572b89852. Report an issue: GitHub.