This is astonishingly complex and counterintuitive. I cannot fathom why they made it like this.

I wonder if the reason Service specifies labels directly under selector: instead of under matchLabels, is that it doesn’t even support matchExpressions, thus there’s no need for disambiguation? As opposed to this example for instance:

selector:
  matchLabels:
    component: redis
  matchExpressions:
    - {key: tier, operator: In, values: [cache]}
    - {key: environment, operator: NotIn, values: [dev]}