Loading page
About this tool
Test matchLabels and matchExpressions (In, NotIn, Exists, DoesNotExist) against sample pod labels instantly.
This tester evaluates a Kubernetes label selector — matchLabels plus matchExpressions with In, NotIn, Exists and DoesNotExist — against a sample set of pod labels, clause by clause, using the same semantics as k8s.io/apimachinery. It shows exactly which clause fails and why, including the frequently missed rule that NotIn also matches objects that lack the key entirely. Useful for anyone debugging Deployments, Services, NetworkPolicies or affinity rules that silently select nothing.
Open Kubernetes Label Selector Tester on AltFTool — it loads instantly in your browser.
Paste your code or data sample into the workspace.
Pick the format, conversion, or analysis you need.
Copy the polished result straight back into your project.
In, NotIn, Exists and DoesNotExist behave precisely as apimachinery evaluates them, including absent-key handling.
Every matchLabels pair and expression gets its own PASS/FAIL with a plain-language reason.
Rejects what the API rejects: In/NotIn without values, Exists with values, and malformed label keys over 63 characters.
Yes. The Kubernetes documentation states the NotIn operator also selects resources that do not have the label key, so a pod with no 'env' label matches env NotIn (prod). To require the key while excluding a value, combine NotIn with an Exists expression on the same key.
matchLabels is shorthand for exact key=value equality; matchExpressions adds the operators In, NotIn, Exists and DoesNotExist with a values list. They are not alternatives — the API ANDs every entry from both sections together, and a single matchLabels pair is equivalent to an In expression with one value.
Almost always a selector mismatch: the Service spec.selector must equal a subset of each pod's labels exactly, and it compares against pod labels, not Deployment labels. Test your selector against the pod template's labels (kubectl get pods --show-labels) — a one-character difference selects nothing without any error message.
The name segment of a key and any value are limited to 63 characters, must start and end alphanumeric, and may contain '-', '_' and '.' in between; keys can carry an optional DNS-subdomain prefix (like app.kubernetes.io/) of up to 253 characters ending in '/'. Values may also be empty, and In/NotIn expressions must list at least one value while Exists/DoesNotExist must list none.