yes, the runner must match all labels to be properly routed
A pipeline is not routed to a runner unless it matches all runner labels. If the pipeline only defines and matches a subset of runner labels it will not be routed to the runner.
How can this be achieved for a kubernetes runner? I have my drone server running in a separate cluster and want to selectively run certain pipelines (like for CD) in a separate cluster. I could not find the DRONE_RUNNER_LABELS variable for the kubernetes runner - https://docs.drone.io/runner/kubernetes/configuration/reference/