# Use Labels on SKS Labels can be associated with SKS Cluster, SKS NodePool and SKS Karpenter. The intent and the specifics of each object are detailed in the sections below. ## SKS Cluster SKS Cluster labels are informational only and are not intended to be associated with any workload. Each SKS Cluster can have a set of key/value labels defined. Each Key must be unique for a given object and adhere to the [Kubernetes Labels Key syntax and character set][kubernetes-labels-spec]. Quoting from the Kubernetes documentation: > Valid label keys have two segments: an optional prefix and name, separated by > a slash (`/`). The name segment is required and must be 63 characters or > less, beginning and ending with an alphanumeric character (`[a-z0-9A-Z]`) > with dashes (`-`), underscores (`_`), dots (`.`), and alphanumerics between. > The prefix is optional. If specified, the prefix must be a DNS subdomain: a > series of DNS labels separated by dots (`.`), not longer than 253 characters > in total, followed by a slash (`/`). Valid label value: * must be 128 characters or less (can be empty), * unless empty, must **begin** and **end** with an alphanumeric character (`[a-z0-9A-Z]`), * could contain dashes (`-`), underscores (`_`), dots (`.`), slashes (`/`), hash symbols (`#`), colons (`:`), at signs (`@`), and alphanumerics between. For example, below we create an SKS Cluster with two labels `environment: production` and `exoscale.com/sks-cluster-labels-url: https://community.exoscale.com/product/compute/containers/how-to/labels/#sks-cluster`: ```shell ➜ exo compute sks create cluster-001 \ --label environment=production \ --label exoscale.com/sks-cluster-labels-url=https://community.exoscale.com/product/compute/containers/how-to/labels/#sks-cluster ┼───────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼ │ SKS CLUSTER │ │ ┼───────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼ │ ID │ 1d963c64-55b5-4c4f-a5e9-ccfdc59bb2df │ │ Name │ cluster-001 │ │ Description │ │ │ Zone │ ch-gva-2 │ │ Creation Date │ 2026-03-02 15:58:30 +0000 UTC │ │ Auto-upgrade │ false │ │ Enable kube-proxy │ true │ │ Endpoint │ 1d963c64-55b5-4c4f-a5e9-ccfdc59bb2df.ppsks-ch-gva-2.exo.io │ │ Version │ 1.35.0 │ │ Service Level │ pro │ │ CNI │ calico │ │ Add-Ons │ exoscale-cloud-controller │ │ │ metrics-server │ │ Audit Enabled │ false │ │ Feature Gates │ │ │ State │ running │ │ Labels │ environment:production │ │ │ exoscale.com/sks-cluster-labels-url:https://community.exoscale.com/product/compute/containers/how-to/labels/#sks-cluster │ │ Nodepools │ n/a │ ┼───────────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┼ ``` [kubernetes-labels-spec]: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set ## SKS NodePool Labels can be associated with an SKS NodePool to help classify and organize them. Those labels will be associated with Kubernetes Node provisioned via the SKS NodePool. The underlying Compute Instances will also be tagged with SKS NodePool labels when defined. Labels are key/value pairs and must adhere to the [Kubernetes Labels syntax and character set][kubernetes-labels-spec]. Quoting from the documentation – emphasis ours: > Valid label keys have two segments: an optional prefix and name, separated by > a slash (`/`). The name segment is required and must be 63 characters or > less, beginning and ending with an alphanumeric character (`[a-z0-9A-Z]`) > with dashes (`-`), underscores (`_`), dots (`.`), and alphanumerics between. > The prefix is optional. If specified, the prefix must be a DNS subdomain: a > series of DNS labels separated by dots (`.`), not longer than 253 characters > in total, followed by a slash (`/`). > > The `kubernetes.io/` and `k8s.io/` prefixes are **reserved** for Kubernetes > core components. > > Valid label value: > > * must be 63 characters or less (can be empty), > * unless empty, must **begin** and **end** with an alphanumeric character > (`[a-z0-9A-Z]`), > * could contain dashes (`-`), underscores (`_`), dots (`.`), and > alphanumerics between. For example, below we create an SKS NodePool with two labels `environment: production` and `cloud-provider: exoscale`: ```shell ➜ exo compute sks nodepool add cluster-001 nodepool-001 \ --label environment=production \ --label cloud-provider=exoscale ┼─────────────────────────┼──────────────────────────────────────┼ │ SKS NODEPOOL │ │ ┼─────────────────────────┼──────────────────────────────────────┼ │ ID │ 2268bc0c-2f8c-4445-b676-f8503804fba4 │ │ Name │ nodepool-001 │ │ Description │ │ │ Creation Date │ 2026-03-04 10:10:58 +0000 UTC │ │ Instance Pool ID │ 04f6b3f5-1445-4646-afc2-fccb64c2bc9e │ │ Instance Prefix │ pool │ │ Instance Type │ standard.medium │ │ Template │ sks-node-1.35.0-standard │ │ Disk Size │ 50 │ │ Public IP Assignment │ inet4 │ │ IPv6 │ false │ │ Anti Affinity Groups │ n/a │ │ Security Groups │ n/a │ │ Private Networks │ n/a │ │ Version │ 1.35.0 │ │ Size │ 2 │ │ State │ running │ │ Taints │ n/a │ │ Labels │ cloud-provider:exoscale │ │ │ environment:production │ │ Add Ons │ n/a │ │ Image GC Min │ 2m │ │ Image Gc Low Threshold │ 80 │ │ Image Gc High Threshold │ 85 │ ┼─────────────────────────┼──────────────────────────────────────┼ ``` Once the SKS NodePool created, we can verify its labels are propagated to the underlying Compute Instances: ```shell ➜ exo compute instance list ┼──────────────────────────────────────┼──────────────────┼──────────┼─────────────────┼────────────────┼──────────────┼─────────┼ │ ID │ NAME │ ZONE │ TYPE │ IP ADDRESS │ IPV6 ADDRESS │ STATE │ ┼──────────────────────────────────────┼──────────────────┼──────────┼─────────────────┼────────────────┼──────────────┼─────────┼ │ ebcbadfa-6716-4510-8463-75761e17a683 │ pool-04f6b-rtjun │ ch-gva-2 │ standard.medium │ 85.217.161.236 │ - │ running │ │ a1aafd68-c22e-4759-8bf5-27b26c8835b6 │ pool-04f6b-lyadc │ ch-gva-2 │ standard.medium │ 85.217.161.157 │ - │ running │ ┼──────────────────────────────────────┼──────────────────┼──────────┼─────────────────┼────────────────┼──────────────┼─────────┼ ➜ exo compute instance show pool-04f6b-lyadc ┼─────────────────────────────────────────┼──────────────────────────────────────┼ │ COMPUTE INSTANCE │ │ ┼─────────────────────────────────────────┼──────────────────────────────────────┼ │ ID │ a1aafd68-c22e-4759-8bf5-27b26c8835b6 │ │ Name │ pool-04f6b-lyadc │ │ Creation Date │ 2026-03-04 10:11:00 +0000 UTC │ │ Instance Type │ standard.medium │ │ Template │ sks-node-1.35.0-standard │ │ Zone │ ch-gva-2 │ │ Anti-Affinity Groups │ n/a │ │ Deploy Target │ - │ │ Security Groups │ default │ │ Private Instance │ No │ │ Private Networks │ n/a │ │ Elastic IPs │ n/a │ │ Public IP │ inet4 │ │ IP Address │ 85.217.161.157 │ │ IPv6 Address │ - │ │ SSH Key │ - │ │ Disk Size │ 50 GiB │ │ State │ running │ │ Labels │ cloud-provider:exoscale │ │ │ environment:production │ │ Secure Boot │ false │ │ Tpm │ false │ │ Reverse DNS │ │ │ Application-Consistent Snapshot enabled │ false │ ┼─────────────────────────────────────────┼──────────────────────────────────────┼ ➜ exo compute instance show pool-04f6b-rtjun ┼─────────────────────────────────────────┼──────────────────────────────────────┼ │ COMPUTE INSTANCE │ │ ┼─────────────────────────────────────────┼──────────────────────────────────────┼ │ ID │ ebcbadfa-6716-4510-8463-75761e17a683 │ │ Name │ pool-04f6b-rtjun │ │ Creation Date │ 2026-03-04 10:11:00 +0000 UTC │ │ Instance Type │ standard.medium │ │ Template │ sks-node-1.35.0-standard │ │ Zone │ ch-gva-2 │ │ Anti-Affinity Groups │ n/a │ │ Deploy Target │ - │ │ Security Groups │ default │ │ Private Instance │ No │ │ Private Networks │ n/a │ │ Elastic IPs │ n/a │ │ Public IP │ inet4 │ │ IP Address │ 85.217.161.236 │ │ IPv6 Address │ - │ │ SSH Key │ - │ │ Disk Size │ 50 GiB │ │ State │ running │ │ Labels │ cloud-provider:exoscale │ │ │ environment:production │ │ Secure Boot │ false │ │ Tpm │ false │ │ Reverse DNS │ │ │ Application-Consistent Snapshot enabled │ false │ ┼─────────────────────────────────────────┼──────────────────────────────────────┼ ``` We can also ensure the SKS NodePool labels are associated with the Kubernetes Nodes: ```shell ➜ kubectl --kubeconfig kubeconfig.yml get nodes NAME STATUS ROLES AGE VERSION pool-04f6b-lyadc Ready 5m3s v1.35.0 pool-04f6b-rtjun Ready 4m57s v1.35.0 ➜ kubectl --kubeconfig kubeconfig.yml label node/pool-04f6b-lyadc --list [...] environment=production cloud-provider=exoscale ➜ kubectl --kubeconfig kubeconfig.yml label node/pool-04f6b-rtjun --list [...] cloud-provider=exoscale environment=production ``` ## SKS Karpenter add-on Provided [Karpenter add-on is enabled and configured]({{}}) for a given SKS Cluster, labels can be defined in Karpenter NodePools via the [`spec.template.metadata.labels`](https://karpenter.sh/docs/concepts/nodepools/#spectemplatemetadatalabels) configuration. Those labels will then be associated with Kubernetes Node provisioned hereafter. ## Labeling Rules for the `kubernetes.io` Namespace When using labels in the `kubernetes.io` namespace, you must follow strict naming rules. Labels must either: 1. Start with an allowed prefix: * `kubelet.kubernetes.io` * `node.kubernetes.io` **OR** 2. Be part of the explicitly allowed set: * `beta.kubernetes.io/arch` * `beta.kubernetes.io/instance-type` * `beta.kubernetes.io/os` * `failure-domain.beta.kubernetes.io/region` * `failure-domain.beta.kubernetes.io/zone` * `kubernetes.io/arch` * `kubernetes.io/hostname` * `kubernetes.io/os` * `node.kubernetes.io/instance-type` * `topology.kubernetes.io/region` * `topology.kubernetes.io/zone` If you need another label in the `kubernetes.io` namespace, you will need to set it after the Nodes are registered with: ```bash kubectl label node NODE-NAME unallowed.kubernetes.io/prefix=true ```