How to Fix a Kubernetes Selector Label Mismatch

What the error means

Kubernetes requires that a Deployment's spec.selector and spec.template.metadata.labels agree on every key-value pair in the selector. When they don't, kubectl apply returns:

The Deployment "web" is invalid:
spec.template.metadata.labels: Invalid value: map[string]string{"app":"webapp"}:
`selector` does not match template `labels`

The controller uses spec.selector to identify which pods belong to this Deployment. If the template produces pods with different labels, the controller would create pods it cannot claim - Kubernetes refuses to let that happen and rejects the manifest at apply-time.

A minimal example of the mismatch

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: web        # selector looks for app=web
  template:
    metadata:
      labels:
        app: webapp   # but pods get app=webapp - mismatch!
    spec:
      containers:
        - name: web
          image: nginx:latest

kubectl apply -f deployment.yaml will fail on this manifest every time.

How to fix it

Pick one label value and use it consistently in both places. The selector cannot be changed after a Deployment is created, so get it right at the start:

spec:
  selector:
    matchLabels:
      app: web        # selector
  template:
    metadata:
      labels:
        app: web      # template - now they match

Apply it again and Kubernetes accepts it:

kubectl apply -f deployment.yaml
kubectl rollout status deployment/web

Why Kubernetes is strict about this

The selector is immutable after creation - you cannot kubectl apply a changed selector on an existing Deployment. This strictness is intentional: if the selector could change freely, pods created under the old selector would become orphans (no controller managing them), leading to silent runaway ReplicaSets.

Tips for getting it right

• Copy-paste the label from the template into the selector, not the other way around. The template labels can carry extra metadata (e.g. version: v1); the selector only needs the stable identifying keys.
• Use kubectl apply --dry-run=client -f deployment.yaml to catch mismatches before touching the cluster.
• kubectl describe deployment web shows both the selector and the pod template labels side by side so you can spot the drift at a glance.