6.3What to Validate in Kubernetes Manifests

A production-ready deployment should include ALL of the following. Each annotation explains why the field matters:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
    version: "1.2.3"        # Pinned version, not "latest"
spec:
  replicas: 3               # Multiple replicas for availability
  selector:
    matchLabels:
      app: myapp
  template:
    spec:
      securityContext:
        runAsNonRoot: true   # Never run as root
        runAsUser: 1000
        fsGroup: 2000
        seccompProfile:
          type: RuntimeDefault  # Use default seccomp profile
      containers:
        - name: myapp
          image: myapp:1.2.3  # Pinned tag, never :latest
          resources:
            requests:          # Scheduler needs these
              cpu: 100m
              memory: 128Mi
            limits:            # Prevent noisy-neighbor issues
              cpu: 500m
              memory: 512Mi
          readinessProbe:      # When to send traffic
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
            failureThreshold: 3
          livenessProbe:       # When to restart
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
            failureThreshold: 3
          startupProbe:        # Grace period for slow starts
            httpGet:
              path: /healthz
              port: 8080
            failureThreshold: 30
            periodSeconds: 10
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          ports:
            - containerPort: 8080
              protocol: TCP
          env:
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:    # Never hardcode secrets
                  name: myapp-secrets
                  key: db-password
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: myapp

Checklist for Manifest Review

Check	Why	Severity
Image tag is not :latest	Prevents unpredictable deployments	Critical
Resource requests and limits set	Prevents resource starvation	Critical
Readiness probe configured	Prevents traffic to unready pods	Critical
Liveness probe configured	Enables automatic recovery	High
runAsNonRoot: true	Prevents container breakout	Critical
readOnlyRootFilesystem: true	Limits attacker file writes	High
allowPrivilegeEscalation: false	Prevents privilege elevation	Critical
All capabilities dropped	Minimizes kernel exposure	High
No hostNetwork: true	Prevents host network access	Critical
No hostPID: true	Prevents process visibility	Critical
Secrets via secretKeyRef	No hardcoded credentials	Critical
Multiple replicas	Availability during node failure	High
PodDisruptionBudget exists	Prevents all-at-once upgrades	Medium
NetworkPolicy exists	Zero-trust network segmentation	High