@@ -70,9 +70,9 @@ spec:
         )
         and on(namespace,cluster) (
           max by (namespace,cluster) (
-            kube_pod_status_phase{phase="Pending"}
+            kube_pod_status_phase{job="kube-state-metrics",phase="Pending"}
             * on(namespace,pod) group_left(cluster)
-            label_replace(kube_pod_labels{label_cnpg_io_cluster!=""}, "cluster", "$1", "label_cnpg_io_cluster", "(.+)")
+            label_replace(kube_pod_labels{job="kube-state-metrics",label_cnpg_io_cluster!=""}, "cluster", "$1", "label_cnpg_io_cluster", "(.+)")
           ) > 0
         )
       for: 15m
 
@@ -105,15 +105,19 @@ tests:
           path: spec.groups[0].rules[4].expr
           pattern: count\(kube_horizontalpodautoscaler_status_current_replicas\{.*keda-hpa
       # ScaleStuck must intersect with a Pending pod so a healthy long basebackup
-      # (Running pod, desired > current for >15m) does not false-fire
+      # (Running pod, desired > current for >15m) does not false-fire. Both selectors
+      # in the Pending term MUST pin job="kube-state-metrics" like every other selector
+      # in the file: a tenant vmselect carrying a second KSM series (federated/remote
+      # write, or a tenant-run KSM) makes the on(namespace,pod) match ambiguous and the
+      # whole rule errors out silently. Dropping the job pin re-opens that, so this goes red.
       - matchRegex:
           path: spec.groups[0].rules[0].expr
-          pattern: kube_pod_status_phase\{phase="Pending"\}
+          pattern: kube_pod_status_phase\{job="kube-state-metrics",phase="Pending"\}
       # ...and that Pending term is scoped to CNPG pods (label_cnpg_io_cluster) so an
       # unrelated Pending pod in the tenant namespace cannot trip the alert
       - matchRegex:
           path: spec.groups[0].rules[0].expr
-          pattern: kube_pod_labels\{label_cnpg_io_cluster!=
+          pattern: kube_pod_labels\{job="kube-state-metrics",label_cnpg_io_cluster!=
 
   - it: can be disabled
     set:
Original file line number	Diff line number	Diff line change
`@@ -70,9 +70,9 @@ spec:`
`70`	`70`	`)`
`71`	`71`	`and on(namespace,cluster) (`
`72`	`72`	`max by (namespace,cluster) (`
`73`		`- kube_pod_status_phase{phase="Pending"}`
	`73`	`+ kube_pod_status_phase{job="kube-state-metrics",phase="Pending"}`
`74`	`74`	`* on(namespace,pod) group_left(cluster)`
`75`		`- label_replace(kube_pod_labels{label_cnpg_io_cluster!=""}, "cluster", "$1", "label_cnpg_io_cluster", "(.+)")`
	`75`	`+ label_replace(kube_pod_labels{job="kube-state-metrics",label_cnpg_io_cluster!=""}, "cluster", "$1", "label_cnpg_io_cluster", "(.+)")`
`76`	`76`	`) > 0`
`77`	`77`	`)`
`78`	`78`	`for: 15m`