kubectl get -l

kubectl Label Selectors Reference

Label selectors are the primary mechanism for filtering and grouping Kubernetes resources. They are used by kubectl commands, Services, Deployments, NetworkPolicies, and nearly every controller in Kubernetes.

Equality-Based Selectors

The simplest form, using =, ==, and != operators:

# Exact match (= and == are equivalent)
kubectl get pods -l app=nginx
kubectl get pods -l app==nginx

# Not equal
kubectl get pods -l 'tier!=frontend'

# Multiple conditions (AND logic)
kubectl get pods -l app=nginx,tier=frontend

# Combined equality and inequality
kubectl get pods -l 'app=nginx,environment!=test'

Set-Based Selectors

More expressive filtering using in, notin, and existence checks:

# Match any of several values (OR within a key)
kubectl get pods -l 'environment in (staging, production)'

# Exclude specific values
kubectl get pods -l 'environment notin (test, development)'

# Label exists (any value)
kubectl get pods -l 'app'

# Label does not exist
kubectl get pods -l '!monitoring'

Combining Selectors

Multiple selectors separated by commas create AND conditions:

# Must be nginx AND in production AND have the monitored label
kubectl get pods -l 'app=nginx,environment in (production),monitored'

# Must be frontend, not in test, and have a version label
kubectl get pods -l 'tier=frontend,environment notin (test),version'

Showing Labels in Output

# Show all labels
kubectl get pods --show-labels
# NAME       READY   STATUS    LABELS
# my-pod     1/1     Running   app=nginx,tier=frontend,version=v1

# Show specific label values as columns
kubectl get pods -L app,tier
# NAME       READY   STATUS    APP     TIER
# my-pod     1/1     Running   nginx   frontend

# Combine selector with label columns
kubectl get pods -l app=nginx -L version,tier

Where Selectors Are Used

In kubectl Commands

# Get resources
kubectl get pods -l app=nginx

# Delete by selector
kubectl delete pods -l environment=test

# Describe by selector
kubectl describe pods -l app=my-app

# Logs by selector (single pod)
kubectl logs -l app=my-app --max-log-requests=10

# Exec is not selector-based (requires specific pod name)

In YAML Manifests

Services use equality-based selectors:

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: nginx        # equality-based only
    tier: frontend
  ports:
  - port: 80

Deployments use matchLabels (equality) and matchExpressions (set-based):

apiVersion: apps/v1
kind: Deployment
spec:
  selector:
    matchLabels:
      app: nginx
    matchExpressions:
    - key: environment
      operator: In
      values: [staging, production]
    - key: deprecated
      operator: DoesNotExist

In Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
spec:
  podSelector:
    matchLabels:
      app: database
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: backend

Selector Operators Reference

| Type | Operator | Syntax | Example | |------|----------|--------|---------| | Equality | = / == | key=value | app=nginx | | Equality | != | key!=value | tier!=test | | Set | in | key in (v1,v2) | env in (prod,staging) | | Set | notin | key notin (v1,v2) | env notin (test) | | Existence | exists | key | monitored | | Existence | not exists | !key | !deprecated |

matchExpressions Operators (YAML)

| Operator | Description | |----------|-------------| | In | Value is in the set | | NotIn | Value is not in the set | | Exists | Key exists (values must be empty) | | DoesNotExist | Key does not exist (values must be empty) |

Practical Patterns

# Find pods without resource limits
kubectl get pods -l '!resources-verified' -o name

# Select all production workloads
kubectl get all -l 'environment in (production)'

# Find canary deployments
kubectl get pods -l 'app=my-app,track=canary'

# Find pods belonging to a specific team
kubectl get pods -l 'team=platform' -A

# Count pods per label value
kubectl get pods -l app -o jsonpath='{range .items[*]}{.metadata.labels.app}{"\n"}{end}' | sort | uniq -c | sort -rn

Common Interview Patterns

The relationship between Deployment selectors and Pod labels is a frequent interview topic:

# View the selector a Deployment uses
kubectl get deploy my-app -o jsonpath='{.spec.selector.matchLabels}'

# View which pods it matches
kubectl get pods -l "$(kubectl get deploy my-app -o jsonpath='{.spec.selector.matchLabels}' | jq -r 'to_entries | map("\(.key)=\(.value)") | join(",")')"

Understanding selectors is fundamental to Kubernetes — they connect Services to Pods, Deployments to ReplicaSets, and define the scope of NetworkPolicies and PodDisruptionBudgets.