Fix selector.matchLabels to not include version label

selector.matchLabels should use cfg.matchLabels without the version label,
since Kubernetes selectors can't be updated and should remain stable.
Previously selector.matchLabels was using labels which included the version
through cfg.labels, causing the selector to change when version changes.

Fixed by:
- Using cfg.matchLabels directly for selectors
- Adding component-specific labels explicitly in selector.matchLabels
- Not including cfg.labels (which contains version) in selectors

Author: Lillecarl

kubenix/builder.nix

@@ -87,7 +87,9 @@ in
       labels = cfg.labels // {
         "app.kubernetes.io/component" = "builder";
       };
-      matchLabels = cfg.matchLabels // labels;
+      matchLabels = cfg.matchLabels // {
+        "app.kubernetes.io/component" = "builder";
+      };
     in
     lib.mkIf (cfg.enable && cfg.builders.enable) {
       nix-csi.builders.nixConfig.settings.sandbox = cfg.builders.privilegedSandboxedBuilds;
@@ -205,7 +207,11 @@ in
                 metadata.labels = v2.labels;
                 spec = {
                   replicas = v.replicas;
-                  selector.matchLabels = cfg.matchLabels // v2.labels;
+                  selector.matchLabels = cfg.matchLabels // {
+                    "app.kubernetes.io/component" = "builder";
+                    "kubernetes.io/arch" = v.arch;
+                    "nix.csi/deployment" = n;
+                  };
                   template = podTemplate v2;
                 };
               }
@@ -298,7 +304,11 @@ in
             {
               metadata.labels = v2.labels;
               spec = {
-                selector.matchLabels = cfg.matchLabels // v2.labels;
+                selector.matchLabels = cfg.matchLabels // {
+                  "app.kubernetes.io/component" = "builder";
+                  "kubernetes.io/arch" = v.arch;
+                  "nix.csi/daemonset" = n;
+                };
                 template = lib.recursiveUpdate (podTemplate v2) {
                   spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms = [
                     {

kubenix/cache.nix

@@ -38,7 +38,9 @@ in
       labels = cfg.labels // {
         "app.kubernetes.io/component" = "cache";
       };
-      matchLabels = cfg.matchLabels // labels;
+      matchLabels = cfg.matchLabels // {
+        "app.kubernetes.io/component" = "cache";
+      };
     in
     lib.mkIf (cfg.enable && cfg.cache.enable) {
       kubernetes.resources.${cfg.namespace} = {

kubenix/daemonset.nix

@@ -27,7 +27,9 @@ in
       labels = cfg.labels // {
         "app.kubernetes.io/component" = "node";
       };
-      matchLabels = cfg.matchLabels // labels;
+      matchLabels = cfg.matchLabels // {
+        "app.kubernetes.io/component" = "node";
+      };
     in
     lib.mkIf cfg.enable {
       kubernetes.resources.${cfg.namespace} = {
@@ -38,7 +40,7 @@ in
               type = "RollingUpdate";
               rollingUpdate.maxUnavailable = 1;
             };
-            selector.matchLabels = labels;
+            selector.matchLabels = matchLabels;
             template = {
               metadata.labels = labels;
               metadata.annotations = {

kubenix/undeploy.nix

@@ -26,10 +26,13 @@ in
         labels = cfg.labels // {
           "app.kubernetes.io/component" = "cleanup";
         };
+        matchLabels = cfg.matchLabels // {
+          "app.kubernetes.io/component" = "cleanup";
+        };
       in
       {
         metadata.labels = labels;
-        spec.selector.matchLabels = cfg.matchLabels // labels;
+        spec.selector.matchLabels = matchLabels;
         spec.template = {
           metadata.labels = labels;
           spec = {