matchExpressions ignored on pod selection

[t4lz]

When targeting target types that have multiple pods, we select a pod using the target object's label selector, however, it seems we are currently ignoring the matchExpressions field of the label selector, and only take the matchLabels field.

Impact

Those two fields are ANDed, so if a user defines a condition using both matchLabels and matchExpressions, we would ignore the restriction defined by the matchExpressions on selected pods, and in the worse case scenario we would select a pod from a different deployment/rollout/...

Also, we return an error if there are no matchLabels, but I think that's a valid case - when the label selector is defined based on match expressions alone.

Example for one of the places we only use selector.match_labels:

mirrord/mirrord/kube/src/api/runtime/deployment.rs

Lines 20 to 26 in 7b8dae6

	async fn get_labels(resource: &Self::Resource) -> Result<BTreeMap<String, String>> {
	resource
	.spec
	.as_ref()
	.and_then(|spec| spec.selector.match_labels.clone())
	.ok_or_else(|| KubeApiError::missing_field(resource, ".spec.selector.matchLabels"))
	}

Reproduction

no-expressions.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: no-exps
  labels:
    app: py-serv
spec:
  replicas: 1
  selector:
    matchLabels:
      app: py-serv
  template:
    metadata:
      labels:
        app: py-serv
    spec:
      containers:
        - name: py-serv
          image: ghcr.io/metalbear-co/mirrord-pytest:latest

has-expressions.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: has-exps
  labels:
    app: py-serv
spec:
  replicas: 1
  selector:
    matchLabels:
      app: py-serv
    matchExpressions:
      - { key: gotcha, operator: Exists }
  template:
    metadata:
      labels:
        app: py-serv
        gotcha: haha
    spec:
      containers:
        - name: py-serv
          image: ghcr.io/metalbear-co/mirrord-pytest:latest

If you define those two deployments, and run mirrord with the operator, targeting deploy/has-exps, agents will be created for both pods.

If you run without the operator, targeting deploy/has-exps, you might target the pod from the wrong deployment:

MIRRORD_PROGRESS_MODE=off MIRRORD_OPERATOR_ENABLED=false mirrord exec -t deploy/has-exps hostname
no-exps-7cdc865574-mpxtx

[linear]

MBE-401 `matchExpression`s ignored on pod selection