Fix Broken Deployment YAML

Original Prepium workshop · Tested on Kubernetes v1.35.8 on 8 September 2026; NetworkPolicy checks used Calico v3.32.2. This example is separate from the simulator task above. Use a disposable cluster where you are allowed to create a namespace.

Fix a Deployment that the API rejects

A syntactically valid YAML file can still describe an invalid Deployment. In this workshop, the selector asks for app: workshop-web, but the Pod template creates app: wrong-label. The Deployment cannot manage the Pods it describes.

1. Reproduce the failure

Create the namespace, save the following as deployment-broken.yaml, then ask the server to validate it. Server dry-run checks admission without persisting this Deployment.

kubectl create namespace prepium-tutorial
kubectl apply --dry-run=server -f deployment-broken.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: workshop-web
  namespace: prepium-tutorial
spec:
  replicas: 2
  selector:
    matchLabels:
      app: workshop-web
  template:
    metadata:
      labels:
        app: wrong-label
    spec:
      containers:
        - name: web
          image: nginx:1.27-alpine
          ports:
            - containerPort: 80

The error includes selector does not match template labels. Read the field path with it: spec.template.metadata.labels. This identifies the mismatch; changing indentation at random will not fix it.

2. Diagnose from the outside in

Confirm apps/v1 and Deployment, then inspect the nested schema with kubectl explain deployment.spec.template. Compare the Deployment's selector with the labels inside the Pod template. The labels on the Deployment's own metadata are a different object and do not replace Pod labels.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: workshop-web
  namespace: prepium-tutorial
spec:
  replicas: 2
  selector:
    matchLabels:
      app: workshop-web
  template:
    metadata:
      labels:
        app: workshop-web
    spec:
      containers:
        - name: web
          image: nginx:1.27-alpine
          ports:
            - containerPort: 80

3. Prove the rollout

kubectl apply --dry-run=server -f deployment-fixed.yaml
kubectl apply -f deployment-fixed.yaml
kubectl -n prepium-tutorial rollout status deployment/workshop-web --timeout=120s
kubectl -n prepium-tutorial get pods -l app=workshop-web
kubectl -n prepium-tutorial get deployment workshop-web

Expect two ready Pods and Deployment availability of two. An accepted apply does not prove that images can be pulled or Pods can be scheduled. If rollout times out, inspect kubectl -n prepium-tutorial describe pods -l app=workshop-web and the events before editing the manifest again.

Example checks

This table is an instructional example, not a promise about the live task's point weights. In Prepium, inspect the task's actual grading feedback to see the requirements and missing checks.

Try another failure

In a new copy, put containers directly under template instead of template.spec. Use strict server validation to identify the invalid field, then correct the nesting. Keep this experiment in the disposable namespace.

When finished: kubectl delete namespace prepium-tutorial. This removes every resource in this tutorial namespace.

Reference: Kubernetes Deployment documentation. Continue with rolling updates and rollback or Service selector troubleshooting.