Custom labels on kafka pods

[Sjoerd97]

We are trying to add custom labels to our kafka pods so that we can apply the right network policies.
However we are struggling to get the labels to show up:

We are deploying the kafka pods through helm charts via ArgoCD.

This is our definition:

apiVersion: kafka.strimzi.io/v1
kind: KafkaNodePool
metadata:
  name: dual-role
  labels:
    strimzi.io/cluster: my-cluster
    app.kubernetes.io/allow-traffic-to-k8s-api: "true"
spec:
  replicas: 1
  roles:
    - controller
    - broker
  storage:
    type: jbod
    volumes:
      - id: 0
        type: persistent-claim
        size: 5Gi
        deleteClaim: false
        kraftMetadata: shared
  template:
    podSet:
      metadata:
        labels:
          app.kubernetes.io/allow-traffic-to-k8s-api: "true"
    pod:
      metadata:
        labels:
          app.kubernetes.io/allow-traffic-to-k8s-api: "true"

As you might have spotted we are trying to add this label app.kubernetes.io/allow-traffic-to-k8s-api: "true"
We have tried a few places in the template based on the CRD, but we cant seem to figure out the right place.
We did see the label in the kafkaNodePool resource but not on the actual kafka broker/controller pod

Name:         dual-role
Namespace:    test-1
Labels:       app.kubernetes.io/allow-traffic-to-k8s-api=true
              strimzi.io/cluster=my-cluster
Annotations:  argocd.argoproj.io/tracking-id: kafka:kafka.strimzi.io/KafkaNodePool:test-1/dual-role
API Version:  kafka.strimzi.io/v1
Kind:         KafkaNodePool
Metadata:
  Creation Timestamp:  2026-01-21T14:55:14Z
  Generation:          3
  Resource Version:    741476846
  UID:                 x

Name:                 my-cluster-dual-role-0
Namespace:            test-1
Priority:             2000000
Priority Class Name:  medium-priority
Service Account:      my-cluster-kafka
Node:                 x
Start Time:           Wed, 21 Jan 2026 16:20:04 +0100
Labels:               app.kubernetes.io/instance=my-cluster
                      app.kubernetes.io/managed-by=strimzi-cluster-operator
                      app.kubernetes.io/name=kafka
                      app.kubernetes.io/part-of=strimzi-my-cluster
                      strimzi.io/broker-role=true
                      strimzi.io/cluster=my-cluster
                      strimzi.io/component-type=kafka
                      strimzi.io/controller=strimzipodset
                      strimzi.io/controller-name=my-cluster-dual-role
                      strimzi.io/controller-role=true
                      strimzi.io/kind=Kafka
                      strimzi.io/name=my-cluster-kafka
                      strimzi.io/pod-name=my-cluster-dual-role-0
                      strimzi.io/pool-name=dual-role
Annotations:          kubernetes.io/limit-ranger: LimitRanger plugin set: cpu, memory request for container kafka; cpu, memory limit for 

[scholzj]

For a good or bad, the app.kubernetes.io have special meaning and that is why they are likely skipped. You should try to use different labels.

[Sjoerd97]

We just saw the label exclusion regex and a way to overwrite it. Is there a good reason not to overwite it so we can use app.kubernetes.io?

We would have liked not to change existing network policies

[scholzj]

I'm not sure there is a good reason for it.

These labels are complete garbage without a proper definitions and semantics. And everyone tends to use them differently and expects them to work differently. We should have never touched them in the first place and just have people who want them set them all manually, like you are trying to do now. Unfortunately, we did touch them. And now whatever we change around them ultimately breaks things for someone. 😢

[Sjoerd97]

Fair, understandable. We will try to refrain from using them, we dont like it when things break lol
Thanks for the quick answer again!