Unexpected behaviour with patch labelSelector

[willnewton]

What happened?

I've been trying to apply a patch by selecting a label that was added by kustomize and the it doesn't work. This may be expected behaviour but I can't find it documented anywhere.

If I comment out the labelSelector line then the patch gets applied but if I leave it in the patch is not applied.

What did you expect to happen?

My patch applied based on the label.

How can we reproduce it (as minimally and precisely as possible)?

# base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

labels:
 - includeSelectors: true
   pairs:
     service: myservice

resources:
  - deployment.yaml
  - config.yaml

# base/config.yaml
apiVersion: v1
data:
  ENV_VAR: old_content
kind: ConfigMap
metadata:
  labels:
    service: myservice
  name: myservice-env

# base/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myservice
spec:
  selector:
    matchLabels:
      service: myservice
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        service: myservice
    spec:
      containers:
        - env:
            - name: ENV_VAR
              valueFrom:
                configMapKeyRef:
                  key: ENV_VAR
                  name: myservice-env
          image: myservice
          name: myservice

# overlays/test/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
labels:
  - includeSelectors: true
    pairs:
      variant: test

resources:
  - ../../base

patches:
- patch: |-
    - op: replace
      path: /data/ENV_VAR
      value: new_content
  target:
    kind: ConfigMap
    name: myservice-env
    labelSelector: variant=test

Expected output

apiVersion: v1
data:
  ENV_VAR: new_content
kind: ConfigMap
metadata:
  labels:
    service: myservice
    variant: test
  name: myservice-env
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    service: myservice
    variant: test
  name: myservice
spec:
  selector:
    matchLabels:
      service: myservice
      variant: test
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        service: myservice
        variant: test
    spec:
      containers:
      - env:
        - name: ENV_VAR
          valueFrom:
            configMapKeyRef:
              key: ENV_VAR
              name: myservice-env
        image: myservice
        name: myservice

Actual output

apiVersion: v1
data:
  ENV_VAR: old_content
kind: ConfigMap
metadata:
  labels:
    service: myservice
    variant: test
  name: myservice-env
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    service: myservice
    variant: test
  name: myservice
spec:
  selector:
    matchLabels:
      service: myservice
      variant: test
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        service: myservice
        variant: test
    spec:
      containers:
      - env:
        - name: ENV_VAR
          valueFrom:
            configMapKeyRef:
              key: ENV_VAR
              name: myservice-env
        image: myservice
        name: myservice

Kustomize version

v5.6.0

Operating system

MacOS

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sda399]

Hi,
It is a matter of order of applying transformers. labels comes later after patches is done.
As a result your patches is looking for a ConfigMap that is not yet patched with the lablel variant: test