or if I create the service with the selector it won't let me create a stateful set that matches the selector, cryptic error message below. I'm obviously doing something boneheaded here, if anyone can point me the right direction I'd really appreciate it.

Oh yeah those are two bugs i have enountered. The first one requires you to manually edit the service yaml and set the ipfamilypolicy to "SingleStack" The second one is when you're modyfing a workload that matches a selector, as you said, and something is not really working. Please note that your workload is redeployed anyway.

I think we had an issue to fix a problem with the selectors component in https://github.com/rancher/dashboard for the next release (2.9) but I cannot seem to find it right now…