service-selector-ref.yaml

apiVersion: kubevious.io/v1alpha1
kind: ClusterRule
metadata:
  name: service-selector-ref
spec:
  summary: |
    Validate Service to PodSpec label selector reference.
  categories:
    - k8s
    - service
    - pod-spec
    - reference
  target: |
    ApiVersion('v1')
      .Kind('Service')
  cache: |
    cache.apps = helpers.newLabelLookupDict();
    for(const app of Shortcut("PodSpec")
                       .many())
    {
      cache.apps.add(app, app.config.metadata?.labels);
    }
  rule: |
    if (!config.spec.selector) {
      return;
    }

    const apps = cache.apps.resolveSelector(config.spec.selector)
    if (apps.length === 0)
    {
      error(`Could not find Applications for Service with ${helpers.labelsToString(config.spec.selector)} labels`);
    }
    else
    {
      for(const app of apps)
      {
        const appPortMap = {};

        for(const container of app?.config.spec?.containers ?? [])
        {
          for(const port of container.ports ?? [])
          {
            appPortMap[port.containerPort] = true;
            if (port.name) {
              appPortMap[port.name] = true;
            }
          }
        }

        for(const servicePort of config.spec?.ports ?? [])
        {
          if (!servicePort.port)
          {
            error('Service port is not set');
          }
          else
          {
            const targetPort = servicePort.targetPort ?? servicePort.port;
            if (!appPortMap[targetPort])
            {
              warning(`Could not find exposed port ${targetPort} in ${app.name}`);
            }
          }
        }
      }
    }