- `LabelSelectors` specified in `topologySpreadConstraints` were validated to ensure that pods are scheduled as expected. Existing pods with invalid `LabelSelectors` could be updated, but new pods were required to specify valid `LabelSelectors`. ([#111802](https://github.com/kubernetes/kubernetes/pull/111802), [@maaoBit](https://github.com/maaoBit))

func validateMatchLabelKeysInTopologySpread(fldPath *field.Path, matchLabelKeys []string, labelSelector *metav1.LabelSelector) field.ErrorList {
	if len(matchLabelKeys) == 0 {
		return nil
	}

	var allErrs field.ErrorList
	labelSelectorKeys := sets.Set[string]{}

	if labelSelector != nil {
		for key := range labelSelector.MatchLabels {

	// with SignerName and LabelSelector.
	Name *string

	// Select all ClusterTrustBundles for this signer that match LabelSelector.
	// Mutually-exclusive with Name.
	SignerName *string

	// Select all ClusterTrustBundles that match this LabelSelecotr.
	// Mutually-exclusive with Name.
	LabelSelector *metav1.LabelSelector

the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread...

	// everything".
	// +optional
	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty" protobuf:"bytes,3,rep,name=labelSelector"`

	// If true, don't block pod startup if the referenced ClusterTrustBundle(s)
	// aren't available.  If using name, then the named ClusterTrustBundle is
	// allowed not to exist.  If using signerName, then the combination of
	// signerName and labelSelector is allowed to match zero

  // +optional
  optional .k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector labelSelector = 3;

  // If true, don't block pod startup if the referenced ClusterTrustBundle(s)
  // aren't available.  If using name, then the named ClusterTrustBundle is
  // allowed not to exist.  If using signerName, then the combination of
  // signerName and labelSelector is allowed to match zero
  // ClusterTrustBundles.
  // +optional

the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread...

	PodAntiAffinityLabelSelector []*v11.LabelSelector `protobuf:"bytes,12,rep,name=podAntiAffinityLabelSelector,proto3" json:"podAntiAffinityLabelSelector,omitempty"`
	// See PodAntiAffinityLabelSelector.
	//
	// Deprecated: Marked as deprecated in pkg/apis/istio/v1alpha1/values_types.proto.

	out.LabelSelector = (*metav1.LabelSelector)(unsafe.Pointer(in.LabelSelector))
	out.Namespaces = *(*[]string)(unsafe.Pointer(&in.Namespaces))
	out.TopologyKey = in.TopologyKey
	out.NamespaceSelector = (*metav1.LabelSelector)(unsafe.Pointer(in.NamespaceSelector))
	out.MatchLabelKeys = *(*[]string)(unsafe.Pointer(&in.MatchLabelKeys))

								Scale: &apiextensions.CustomResourceSubresourceScale{
									SpecReplicasPath:   ".spec.replicas",
									StatusReplicasPath: ".status.replicas",
									LabelSelectorPath:  strPtr(".status.labelSelector"),
								},
							},
						},
						{
							// labelSelectorPath under .spec
							Name:    "version2",
							Served:  true,
							Storage: false,