kubernetes service selector audit derived

{
  "input": {
    "body": {
      "manifests": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: web\n  labels:\n    app: web\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: web\n  template:\n    metadata:\n      labels:\n        app: web\n    spec:\n      containers:\n        - name: web\n          image: ghcr.io/example/web:latest\n          ports:\n            - containerPort: 8080\n          resources:\n            requests:\n              cpu: 500m\n              memory: 256M\n            limits:\n              cpu: 200m\n              memory: 512Mi\n          env:\n            - name: DATABASE_PASSWORD\n              value: hunter2\n            - name: FEATURE_FLAG\n              value: no\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: web\nspec:\n  selector:\n    app: webserver\n  ports:\n    - port: 80\n      targetPort: 9090\n"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxFindings": 500,
        "maxDocuments": 100,
        "maxYamlBytes": 262144,
        "maxDockerfileBytes": 131072
      },
      "passed": false,
      "complete": true,
      "findings": [
        {
          "code": "SCALAR_IS_A_YAML_BOOLEAN",
          "line": 33,
          "detail": "manifests: \"no\" is an unquoted YAML 1.1 boolean and reads as false, not as the text no. Quoting it keeps it a string.",
          "location": "spec.template.spec.containers[0].env[1].value"
        },
        {
          "code": "SERVICE_SELECTOR_MATCHES_NOTHING",
          "detail": "Service web selects {\"app\":\"webserver\"} and no supplied workload carries those pod labels, so the Service has no endpoints and every request to it fails to connect.",
          "location": "Service web"
        }
      ],
      "services": [
        {
          "matched": [],
          "service": "Service web",
          "port_mismatches": []
        }
      ],
      "consistent": false,
      "request_id": "example-request",
      "service_id": "kubernetes_service_selector_audit",
      "assumptions": [
        "A Service selector is matched against the pod template labels, not against the object labels, because that is what Kubernetes matches. Those two differ in most real manifests and matching the wrong on...",
        "Only the documents supplied form the set. A workload that exists in the cluster and was not supplied cannot be matched, so a finding says the selector matches nothing in the set.",
        "A Service with no selector is noted rather than reported, since manually managed endpoints and ExternalName are written that way."
      ],
      "limitations": [
        "Label and port agreement within the set supplied. Live endpoints, network policy and readiness are outside this, and nothing is fetched.",
        "consistent is true only when every Service was matched and every port resolved."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 2,
      "service_count": 1,
      "workload_count": 1,
      "service_version": "1.0.0",
      "findings_by_code": {
        "SCALAR_IS_A_YAML_BOOLEAN": 1,
        "SERVICE_SELECTOR_MATCHES_NOTHING": 1
      },
      "unmatched_service_count": 1
    }
  }
}