I've got a problem with Deployments which uses both matchLabels and matchExpressions in the spec.selector. like:

...
spec:
   replicas: 3
   selector:
     matchLabels:
         run: myapp
     matchExpressions:
      - {key: exclude, operator: NotIn, values: [true]}
...

Now, I launch this deployment with say 3 replica's. Then I go to one pod and add a label: exclude=true.

What I expect to happen

The pod to which I added the label exclude=true is taken out of the Deployment & ReplicaSet and a new pod is spun up, so the Deployment/ReplicaSet still have 3 pods (showing 3/3 in the dashboard)

What I see happening

A new pod is spun up, but the pod to which I added the label is NOT taken out of the Deployment/ReplicaSet: those now show 4/3 in the dashboard

questions

Is this expected behavior or a bug? Am running the latest MiniKube (on Windows).

If I update the run label to something else but 'myapp' on the pod to which I added label exclude=true, then the pod is taken out of the Deployment/ReplicaSet (dashboard shows 3/3)

Any thoughts?