<p>I have kubectl job that is invalid. I am debugging it and I extracted it to yaml file and I can see this:</p>
<pre><code>apiVersion: batch/v1
kind: Job
metadata:
  creationTimestamp: 2020-03-19T21:40:11Z
  labels:
    app: vault-unseal-app
    job-name: vault-unseal-vault-unseal-1584654000
  name: vault-unseal-vault-unseal-1584654000
  namespace: infrastructure
  ownerReferences:
  - apiVersion: batch/v1beta1
    blockOwnerDeletion: true
    controller: true
    kind: CronJob
    name: vault-unseal-vault-unseal
    uid: c9965fdb-4fbb-11e9-80d7-061cf1426d5a
  resourceVersion: &quot;163413544&quot;
  selfLink: /apis/batch/v1/namespaces/infrastructure/jobs/vault-unseal-vault-unseal-1584654000
  uid: 35e63c20-6a2a-11ea-b577-069afd6d30d4
spec:
  backoffLimit: 0
  completions: 1
  parallelism: 1
  selector:
    matchLabels:
      app: vault-unseal-app
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: vault-unseal-app
        job-name: vault-unseal-vault-unseal-1584654000
    spec:
      containers:
      - env:
        - name: VAULT_ADDR
          value: http://vault-vault:8200
        - name: VAULT_SKIP_VERIFY
          value: &quot;1&quot;
        - name: VAULT_TOKEN
          valueFrom:
            secretKeyRef:
              key: vault_token
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_0
          valueFrom:
            secretKeyRef:
              key: unseal_key_0
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_1
          valueFrom:
            secretKeyRef:
              key: unseal_key_1
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_2
          valueFrom:
            secretKeyRef:
              key: unseal_key_2
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_3
          valueFrom:
            secretKeyRef:
              key: unseal_key_3
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_4
          valueFrom:
            secretKeyRef:
              key: unseal_key_4
              name: vault-unseal-vault-unseal
        image: blockloop/vault-unseal
        imagePullPolicy: Always
        name: vault-unseal
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      nodeSelector:
        nodePool: ci
      restartPolicy: OnFailure
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 5
status:
  conditions:
  - lastProbeTime: 2020-03-19T21:49:11Z
    lastTransitionTime: 2020-03-19T21:49:11Z
    message: Job has reached the specified backoff limit
    reason: BackoffLimitExceeded
    status: &quot;True&quot;
    type: Failed
  failed: 1
  startTime: 2020-03-19T21:40:11Z
</code></pre>
<p>When I run <code>kubectl create -f my_file.yaml</code>, I am getting this error:</p>
<pre><code>The Job &quot;vault-unseal-vault-unseal-1584654000&quot; is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{&quot;controller-uid&quot;:&quot;35262878-07bb-11eb-9b2c-0abca2a23428&quot;, &quot;app&quot;:&quot;vault-unseal-app&quot;}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: `selector` not auto-generated
</code></pre>
<p>Can someone suggest how to fix this?</p>
<p>Update:</p>
<p>After testing removal of <code>.spec.selector</code> I am getting error: <code>error: jobs.batch &quot;vault-unseal-vault-unseal-1584654000&quot; is invalid</code></p>
<p>This is how my config looks without <code>.spec.selector</code>:</p>
<pre><code># Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {&quot;apiVersion&quot;:&quot;batch/v1&quot;,&quot;kind&quot;:&quot;Job&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;creationTimestamp&quot;:&quot;2020-03-19T21:40:11Z&quot;,&quot;labels&quot;:{&quot;controller-uid&quot;:&quot;35e63c20-6a2a-11ea-b577-069afd6d30d4&quot;,&quot;job-name&quot;:&quot;vault-unseal-vault-unseal-1584654000&quot;},&quot;name&quot;:&quot;vault-unseal-vault-unseal-1584654000&quot;,&quot;namespace&quot;:&quot;infrastructure&quot;,&quot;ownerReferences&quot;:[{&quot;apiVersion&quot;:&quot;batch/v1beta1&quot;,&quot;blockOwnerDeletion&quot;:true,&quot;controller&quot;:true,&quot;kind&quot;:&quot;CronJob&quot;,&quot;name&quot;:&quot;vault-unseal-vault-unseal&quot;,&quot;uid&quot;:&quot;c9965fdb-4fbb-11e9-80d7-061cf1426d5a&quot;}],&quot;resourceVersion&quot;:&quot;163427805&quot;,&quot;selfLink&quot;:&quot;/apis/batch/v1/namespaces/infrastructure/jobs/vault-unseal-vault-unseal-1584654000&quot;,&quot;uid&quot;:&quot;35e63c20-6a2a-11ea-b577-069afd6d30d4&quot;},&quot;spec&quot;:{&quot;backoffLimit&quot;:20,&quot;completions&quot;:1,&quot;parallelism&quot;:1,&quot;selector&quot;:{&quot;matchLabels&quot;:{&quot;controller-uid&quot;:&quot;35e63c20-6a2a-11ea-b577-069afd6d30d4&quot;}},&quot;template&quot;:{&quot;metadata&quot;:{&quot;creationTimestamp&quot;:null,&quot;labels&quot;:{&quot;controller-uid&quot;:&quot;35e63c20-6a2a-11ea-b577-069afd6d30d4&quot;,&quot;job-name&quot;:&quot;vault-unseal-vault-unseal-1584654000&quot;}},&quot;spec&quot;:{&quot;containers&quot;:[{&quot;env&quot;:[{&quot;name&quot;:&quot;VAULT_ADDR&quot;,&quot;value&quot;:&quot;http://vault-vault:8200&quot;},{&quot;name&quot;:&quot;VAULT_SKIP_VERIFY&quot;,&quot;value&quot;:&quot;1&quot;},{&quot;name&quot;:&quot;VAULT_TOKEN&quot;,&quot;valueFrom&quot;:{&quot;secretKeyRef&quot;:{&quot;key&quot;:&quot;vault_token&quot;,&quot;name&quot;:&quot;vault-unseal-vault-unseal&quot;}}},{&quot;name&quot;:&quot;VAULT_UNSEAL_KEY_0&quot;,&quot;valueFrom&quot;:{&quot;secretKeyRef&quot;:{&quot;key&quot;:&quot;unseal_key_0&quot;,&quot;name&quot;:&quot;vault-unseal-vault-unseal&quot;}}},{&quot;name&quot;:&quot;VAULT_UNSEAL_KEY_1&quot;,&quot;valueFrom&quot;:{&quot;secretKeyRef&quot;:{&quot;key&quot;:&quot;unseal_key_1&quot;,&quot;name&quot;:&quot;vault-unseal-vault-unseal&quot;}}},{&quot;name&quot;:&quot;VAULT_UNSEAL_KEY_2&quot;,&quot;valueFrom&quot;:{&quot;secretKeyRef&quot;:{&quot;key&quot;:&quot;unseal_key_2&quot;,&quot;name&quot;:&quot;vault-unseal-vault-unseal&quot;}}},{&quot;name&quot;:&quot;VAULT_UNSEAL_KEY_3&quot;,&quot;valueFrom&quot;:{&quot;secretKeyRef&quot;:{&quot;key&quot;:&quot;unseal_key_3&quot;,&quot;name&quot;:&quot;vault-unseal-vault-unseal&quot;}}},{&quot;name&quot;:&quot;VAULT_UNSEAL_KEY_4&quot;,&quot;valueFrom&quot;:{&quot;secretKeyRef&quot;:{&quot;key&quot;:&quot;unseal_key_4&quot;,&quot;name&quot;:&quot;vault-unseal-vault-unseal&quot;}}}],&quot;image&quot;:&quot;blockloop/vault-unseal&quot;,&quot;imagePullPolicy&quot;:&quot;Always&quot;,&quot;name&quot;:&quot;vault-unseal&quot;,&quot;resources&quot;:{},&quot;terminationMessagePath&quot;:&quot;/dev/termination-log&quot;,&quot;terminationMessagePolicy&quot;:&quot;File&quot;}],&quot;dnsPolicy&quot;:&quot;ClusterFirst&quot;,&quot;nodeSelector&quot;:{&quot;nodePool&quot;:&quot;devs&quot;},&quot;restartPolicy&quot;:&quot;OnFailure&quot;,&quot;schedulerName&quot;:&quot;default-scheduler&quot;,&quot;securityContext&quot;:{},&quot;terminationGracePeriodSeconds&quot;:5}}},&quot;status&quot;:{&quot;conditions&quot;:[{&quot;lastProbeTime&quot;:&quot;2020-03-19T21:49:11Z&quot;,&quot;lastTransitionTime&quot;:&quot;2020-03-19T21:49:11Z&quot;,&quot;message&quot;:&quot;Job has reached the specified backoff limit&quot;,&quot;reason&quot;:&quot;BackoffLimitExceeded&quot;,&quot;status&quot;:&quot;True&quot;,&quot;type&quot;:&quot;Failed&quot;}],&quot;failed&quot;:1,&quot;startTime&quot;:&quot;2020-03-19T21:40:11Z&quot;}}
  creationTimestamp: 2020-03-19T21:40:11Z
  labels:
    controller-uid: 35e63c20-6a2a-11ea-b577-069afd6d30d4
    job-name: vault-unseal-vault-unseal-1584654000
  name: vault-unseal-vault-unseal-1584654000
  namespace: infrastructure
  ownerReferences:
  - apiVersion: batch/v1beta1
    blockOwnerDeletion: true
    controller: true
    kind: CronJob
    name: vault-unseal-vault-unseal
    uid: c9965fdb-4fbb-11e9-80d7-061cf1426d5a
  resourceVersion: &quot;163442526&quot;
  selfLink: /apis/batch/v1/namespaces/infrastructure/jobs/vault-unseal-vault-unseal-1584654000
  uid: 35e63c20-6a2a-11ea-b577-069afd6d30d4
spec:
  backoffLimit: 100
  completions: 1
  parallelism: 1
  template:
    metadata:
      creationTimestamp: null
      labels:
        controller-uid: 35e63c20-6a2a-11ea-b577-069afd6d30d4
        job-name: vault-unseal-vault-unseal-1584654000
    spec:
      containers:
      - env:
        - name: VAULT_ADDR
          value: http://vault-vault:8200
        - name: VAULT_SKIP_VERIFY
          value: &quot;1&quot;
        - name: VAULT_TOKEN
          valueFrom:
            secretKeyRef:
              key: vault_token
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_0
          valueFrom:
            secretKeyRef:
              key: unseal_key_0
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_1
          valueFrom:
            secretKeyRef:
              key: unseal_key_1
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_2
          valueFrom:
            secretKeyRef:
              key: unseal_key_2
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_3
          valueFrom:
            secretKeyRef:
              key: unseal_key_3
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_4
          valueFrom:
            secretKeyRef:
              key: unseal_key_4
              name: vault-unseal-vault-unseal
        image: blockloop/vault-unseal
        imagePullPolicy: Always
        name: vault-unseal
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      nodeSelector:
        nodePool: devs
      restartPolicy: OnFailure
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 5
status:
  conditions:
  - lastProbeTime: 2020-03-19T21:49:11Z
    lastTransitionTime: 2020-03-19T21:49:11Z
    message: Job has reached the specified backoff limit
    reason: BackoffLimitExceeded
    status: &quot;True&quot;
    type: Failed
  failed: 1
  startTime: 2020-03-19T21:40:11Z
</code></pre>

<p>It looks like you are not using the <code>selector</code> that the system generates for you automatically by default. Bear in mind that the recommended option when creating a job is NOT to fill in <code>selector</code>. It makes it more probable to create a duplicate labels+selectors. Therefore you should use the auto-generated ones, which ensure uniqueness and release you from the necessity of manual management.</p>
<p>The <a href="https://kubernetes.io/docs/concepts/workloads/controllers/job/#specifying-your-own-pod-selector" rel="noreferrer">official docs</a> have this explained in more detail with an example. Please notice the below parts:</p>
<blockquote>
<p>Normally, when you create a Job object, you do not specify
<code>.spec.selector</code>. The system defaulting logic adds this field when the
Job is created. It picks a selector value that will not overlap with
any other jobs.</p>
</blockquote>
<p>and:</p>
<blockquote>
<p>You need to specify <code>manualSelector: true</code> in the new Job since you
are not using the selector that the system normally generates for you
automatically.</p>
</blockquote>
<p>If you want to use manual selectors you need to set: <code>.spec.manualSelector: true</code> in the job's spec. This way the API server will not generate labels automatically and you will be able to set them yourself.</p>
<p>EDIT:</p>
<p>Remember that <code>spec.Completions</code> <code>spec.Selector</code> and <code>spec.Template</code> are immutable fields and are not allowed to be updated. In order to make changes there you need to create a new Job.</p>
<p>The official docs regarding <a href="https://kubernetes.io/docs/concepts/workloads/controllers/job/#writing-a-job-spec" rel="noreferrer">Writing a Job spec</a> will help you understand what should and what shouldn't be put into the Job spec. Notice that despite:</p>
<blockquote>
<p>In addition to required fields for a Pod, a pod template in a Job must
specify appropriate labels (see <a href="https://kubernetes.io/docs/concepts/workloads/controllers/job/#pod-selector" rel="noreferrer">pod selector</a>) and an appropriate
restart policy.</p>
</blockquote>
<p>it is advised that the pod selector / labels are not specified as I explained earlier in order to not create a duplicate labels+selectors.</p>
