This message was deleted.

I don’t think that extra nodeSelector is coming from Pulumi. Perhaps your cluster has an admission controller or similar that is adding it? You could debug with the following command:

kubectl get <kind> <name> -n <namespace> -o json --show-managed-fields

The result should have a

managedFields

property with more information about which controller set a particular field.