K8s Selector Audit

Match every Service selector in a set of Kubernetes manifests against the pod template labels of every workload in the same set. Reports a Service whose selector matches no supplied workload, which has no endpoints so every request to it fails to connect; a targetPort no matched container declares, which fails at connection time rather than at apply time; and a workload whose own selector does not match its own pod template, which the API server rejects.