updated readme and comments

README.md

@@ -304,6 +304,7 @@ Reloader reacts to CSI status changes, not direct updates to external secret sto
 Secret rotation must be enabled in the CSI driver for updates to be detected
 CSI limitations (such as `subPath` mounts) still apply and may require pod restarts
 If secrets are synced to Kubernetes Secret objects, standard Reloader behavior applies and CSI support may not be required
+`--resource-label-selector` is not applied to CSI watches: it scopes ConfigMaps/Secrets only, since `SecretProviderClassPodStatus` objects are managed by the CSI driver and cannot carry user labels. CSI reloads continue to work when a label selector is configured
 
 ## 🚀 Installation
 

internal/pkg/controller/secretproviderclass_reconciler.go

@@ -74,8 +74,8 @@ func resolveSecretProviderClassChange(
 }
 
 // secretProviderClassFilter omits the label selector (driver-owned SPCPS can't
-// carry user labels) and the namespace cache (checked in Reconcile to avoid a
-// startup race). See docs/manual-testing-csi.md.
+// carry user labels, so applying it would silently disable CSI reloads) and the
+// namespace cache (checked in Reconcile to avoid a startup race).
 func secretProviderClassFilter(cfg *config.Config, hasher *reload.Hasher) predicate.Predicate {
 	return reload.CombinedPredicates(
 		reload.NamespaceFilterPredicateWithCache(cfg, nil),