Hey guys, I'm dealing with what's probably a simple issue, but can't tell what I'm doing wrong. I'm creating a Deployment of a Pod using the Python version of Pulumi. I'm trying to use a

nodeSelector

to restrict where the pod should be placed but I see Pulumi adding extra fields for me in the resulting YAML which leads to no node being selected during scheduling phase (please note the

node_selector

field in the Python snippet below). Does Pulumi add its own

nodegroup

selector as filtering criteria in addition to what I'm trying to filter on and if yes how do I prevent it from happening?

p_k8.apps.v1.Deployment(
        '{}-deployment-{}'.format(service, customer),
        metadata=p_k8.meta.v1.ObjectMetaArgs(
            name=app,
            namespace=name_space,
        ),
        spec=p_k8.apps.v1.DeploymentSpecArgs(
            replicas=1,
            strategy=p_k8.apps.v1.DeploymentStrategyArgs(
                type='RollingUpdate',
            ),
            selector=p_k8.meta.v1.LabelSelectorArgs(
                match_labels={
                    'app': app,
                },
            ),
            template=p_k8.core.v1.PodTemplateSpecArgs(
                metadata=p_k8.meta.v1.ObjectMetaArgs(
                    labels={
                        'app': app,
                    },
                ),
                spec=p_k8.core.v1.PodSpecArgs(
                    termination_grace_period_seconds=5,
                    image_pull_secrets=[{
                        'name': 'my-secrets',
                    }],
                    containers=[
                        p_k8.core.v1.ContainerArgs(...omitted...),
                    ],
                    node_selector={
                        '<http://kubernetes.io/os|kubernetes.io/os>': 'linux' # <--- This gets expanded into 2 selectors: a 'nodegroup' one and mine
                    },
                ),
            ),
        ))

The relevant section of the resulting yaml of the Pod which fails to be scheduled due to the extra

nodegroup

label added by Pulumi looks something like this. Why is the extra

nodegroup

label being added and how do I prevent it from happening?

I don’t think that extra nodeSelector is coming from Pulumi. Perhaps your cluster has an admission controller or similar that is adding it? You could debug with the following command:

kubectl get <kind> <name> -n <namespace> -o json --show-managed-fields

The result should have a

managedFields

property with more information about which controller set a particular field.