<p>The .spec.selector field defines how the Deployment finds which Pods to manage.  But we also defines labels inside template then what is the extra things we are getting with .spec.selectors field because Deployment can find the Pods to be managed with the label defined in template also ?</p>
<p>In the below code how can the pod with &quot;label occloud.oracle.com/open-network-policy: allow&quot;  is managed by deployment as it is not described in spec.selectors</p>
<pre><code>---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cheeseshop
spec:
  replicas: 1
  progressDeadlineSeconds: 180
  selector:
     matchLabels:
       app.kubernetes.io/name: tutorial
       app.kubernetes.io/component: cheeseshop
  template:
     metadata:
       labels:
         app.kubernetes.io/name: tutorial
         app.kubernetes.io/component: cheeseshop
         occloud.oracle.com/open-network-policy: allow
       name: cheeseshop
   
</code></pre>

<p><code>spec.seletor</code> field is used by Deployment/Replicaset controllers. It must be a <strong>subset</strong> of the labels specified in the <code>podTemplate</code>. That is why you may have additional labels in your pods. But they will still be managed by the deployment.</p>
<p><code>spec.selector</code> is also used to check is any existing <code>ReplicaSet</code> already matched these conditions. If the <code>Deployment controller</code> found an orphan <code>ReplicaSet</code>, it will be used by the deployment instead of creating a new one.
See <a href="https://github.com/kubernetes/kubernetes/blob/master/pkg/controller/deployment/deployment_controller.go#L222" rel="noreferrer">https://github.com/kubernetes/kubernetes/blob/master/pkg/controller/deployment/deployment_controller.go#L222</a></p>
