ReplicaSet is not removed when a new label selector is added to the Rollout

[targylyen]

Checklist:

• [ X ] I've included steps to reproduce the bug.
• [ X ] I've included the version of argo rollouts.

Describe the bug

When adding a new label to spec.selector.matchLabels and spec.template.metadata.labels in a Rollout, the old ReplicaSet is not removed from the revision history list and old workloads keep running on the old app version, even when revisionHistoryLimit is set.

To Reproduce

1. Create a Rollout using the manifest below:

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: rollouts-demo
spec:
  replicas: 2
  strategy:
    canary:
      steps:
      - setWeight: 20
      - pause: {duration: 2}
      - setWeight: 80
      - pause: {duration: 5}
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: rollouts-demo
  template:
    metadata:
      labels:
        app: rollouts-demo
    spec:
      containers:
      - name: rollouts-demo
        image: argoproj/rollouts-demo:blue
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
        resources:
          requests:
            memory: 32Mi
            cpu: 5m

2. Apply the manifest
3. Update the Rollout by adding a new label under spec.selector.matchLabels and spec.template.metadata.labels.
4. Observe the ReplicaSets.

Expected behavior

Old ReplicaSet should be removed (garbage collected) according to revisionHistoryLimit.

Screenshots

Version

v1.8.3

Logs

Paste the logs from the rollout controller

Logs for a specific rollout:

kubectl logs -n argo-rollouts deployment/argo-rollouts | grep rollout= rollouts-demo

time="2025-09-19T20:08:09Z" level=info msg="Started syncing rollout" generation=12 namespace=default resourceVersion=1758311752248175012 rollout=rollouts-demo
time="2025-09-19T20:08:09Z" level=info msg="No TrafficRouting Reconcilers found" namespace=default rollout=rollouts-demo
time="2025-09-19T20:08:09Z" level=info msg="No StableRS exists to reconcile or matches newRS" namespace=default rollout=rollouts-demo
time="2025-09-19T20:08:09Z" level=info msg="No Steps remain in the canary steps" namespace=default rollout=rollouts-demo

---

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritize the issues with the most 👍.

[mistervivek]

Changing spec.selector.matchLabels on an existing Rollout detaches old ReplicaSets (they no longer match the new selector), so the Rollout controller no longer manages/garbage-collects them — revisionHistoryLimit therefore appears not to work.

[targylyen]

@mistervivek on an existing Rollout maybe spec.selector should not to be allowed to be changed?
https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#selector

but yeah, It seems someone else reported that same issue long time ago:
#2105

and the fix was also merged, not sure if it was realeased though:
#4084