K8s Selector Audit

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
    "amount": "190000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 60
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "body": {
          "manifests": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: web\n  labels:\n    app: web\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: web\n  template:\n    metadata:\n      labels:\n        app: web\n    spec:\n      containers:\n        - name: web\n          image: ghcr.io/example/web:latest\n          ports:\n            - containerPort: 8080\n          resources:\n            requests:\n              cpu: 500m\n              memory: 256M\n            limits:\n              cpu: 200m\n              memory: 512Mi\n          env:\n            - name: DATABASE_PASSWORD\n              value: hunter2\n            - name: FEATURE_FLAG\n              value: no\n---\napiVersion: v1\nkind: Service\nmetadata:\n  name: web\nspec:\n  selector:\n    app: webserver\n  ports:\n    - port: 80\n      targetPort: 9090\n"
        },
        "type": "http",
        "method": "POST",
        "bodyType": "json"
      },
      "output": {
        "type": "json",
        "example": {
          "limits": {
            "maxFindings": 500,
            "maxDocuments": 100,
            "maxYamlBytes": 262144,
            "maxDockerfileBytes": 131072
          },
          "passed": false,
          "complete": true,
          "findings": [
            {
              "code": "SCALAR_IS_A_YAML_BOOLEAN",
              "line": 33,
              "detail": "manifests: \"no\" is an unquoted YAML 1.1 boolean and reads as false, not as the text no. Quoting it keeps it a string.",
              "location": "spec.template.spec.containers[0].env[1].value"
            },
            {
              "code": "SERVICE_SELECTOR_MATCHES_NOTHING",
              "detail": "Service web selects {\"app\":\"webserver\"} and no supplied workload carries those pod labels, so the Service has no endpoints and every request to it fails to connect.",
              "location": "Service web"
            }
          ],
          "services": [
            {
              "matched": [],
              "service": "Service web",
              "port_mismatches": []
            }
          ],
          "consistent": false,
          "request_id": "example-request",
          "service_id": "kubernetes_service_selector_audit",
          "assumptions": [
            "A Service selector is matched against the pod template labels, not against the object labels, because that is what Kubernetes matches. Those two differ in most real manifests and matching the wrong on...",
            "Only the documents supplied form the set. A workload that exists in the cluster and was not supplied cannot be matched, so a finding says the selector matches nothing in the set.",
            "A Service with no selector is noted rather than reported, since manually managed endpoints and ExternalName are written that way."
          ],
          "limitations": [
            "Label and port agreement within the set supplied. Live endpoints, network policy and readiness are outside this, and nothing is fetched.",
            "consistent is true only when every Service was matched and every port resolved."
          ],
          "observed_at": "2026-10-02T00:00:00.000Z",
          "not_examined": [],
          "finding_count": 2,
          "service_count": 1,
          "workload_count": 1,
          "service_version": "1.0.0",
          "findings_by_code": {
            "SCALAR_IS_A_YAML_BOOLEAN": 1,
            "SERVICE_SELECTOR_MATCHES_NOTHING": 1
          },
          "unmatched_service_count": 1
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method",
            "bodyType",
            "body"
          ],
          "properties": {
            "body": {
              "type": "object",
              "required": [
                "manifests"
              ],
              "properties": {
                "manifests": {
                  "type": "string",
                  "maxLength": 262144
                }
              },
              "additionalProperties": false
            },
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "POST"
              ],
              "type": "string"
            },
            "bodyType": {
              "enum": [
                "json",
                "form-data",
                "text"
              ],
              "type": "string"
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog

2026-10-04 08:24Z

Last indexed by Roundhouse

2026-10-05 00:20Z

Last enriched (probe, favicon, geo)

2026-10-05 00:46Z

x402 version

2

Max timeout

60s

Liveness probe

HTTP 0