Can not exclude existing Violated resource by adding labelSelector to Constraint

[allkusary]

Hi everyone. We are going to apply MinReplicas Constraint which doesn't allow 1 replica deployments. Also we have some exception deployments that should continue running with 1 replica. So we added labelSelector to Constraint to exclude these deployments. But even with this label we can not reapply/replace existing deployment with 1 replica. We have to delete and only after that recreate deployment. Is it any other way to apply it without deletion?

Error

error when patching "sample-deploy.yaml": admission webhook "validation.gatekeeper.sh" denied the request: [min-replicas] <test-opa-1-replica-exclude> should have more than 1 replica

Constraint

 match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment", "StatefulSet"]
    labelSelector:
        matchExpressions:
        - key: opa-min-replicas/ignore
          operator: DoesNotExist

Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: test-opa-1-replica-exclude
    opa-min-replicas/ignore: ignore
  name: test-opa-1-replica-exclude
  namespace: default
spec:
  replicas: 1
  ......

[ctrought]

The indentation doesn't look quite right to me, but it might not have any effect. Are you using the Replica Limits constraint template from the community library? https://open-policy-agent.github.io/gatekeeper-library/website/validation/replicalimits

match:
  kinds:
  - apiGroups: ["apps"]
    kinds: ["Deployment", "StatefulSet"]
  labelSelector:
    matchExpressions:
    - key: opa-min-replicas/ignore
      operator: DoesNotExist