K8S Deploy Manifest Review

Kubernetes Deploy Manifest Review

When to use

Invoke when shipping a workload to Kubernetes for the first time, when the workload's manifests are being changed materially, or when reviewing inherited manifests for production-readiness. Do not invoke for non-Kubernetes deployments.

Inputs

• Container image reference (registry + tag/digest).
• Workload type (stateless service assumed; stateful workloads need extra design).
• Replica count, expected resource usage (CPU/memory), HPA targets.
• Network model: which namespaces and external services this workload may reach.

Output contract

Generated or reviewed manifests MUST conform to:

• deployment-standards — rolling update default; tier-0 services require canary or blue-green; readiness/liveness probes mandatory; rollback artifact declared.
• security-standards — runAsNonRoot: true, readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, drop ALL capabilities, NetworkPolicy by default, ServiceAccount scoping (not the default SA).
• observability-standards — Prometheus scrape annotations or a ServiceMonitor; logs to stdout.
• naming-conventions — resource names kebab-case, suffixed by kind when ambiguous.
• Tier classification from architecture-schema drives PDB requirements and replica defaults.

Process

1. Author or review Deployment:
   • replicas set; strategy: RollingUpdate with maxSurge: 1, maxUnavailable: 0.
   • imagePullPolicy: IfNotPresent; image pinned by digest when possible.
   • resources.requests AND resources.limits set on every container.
   • securityContext: runAsNonRoot: true, readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, capabilities: { drop: [ALL] }.
   • Probes: startupProbe (slow start), readinessProbe (gate traffic), livenessProbe (restart on hang). They must be distinct.
2. Author Service (ClusterIP unless explicitly external).
3. Author HorizontalPodAutoscaler with min/max replicas and target metrics.
4. Author PodDisruptionBudget when replicas > 1 (minAvailable: 1 or maxUnavailable: 1).
5. Author NetworkPolicy with default-deny ingress; allow only required peers.
6. Author dedicated ServiceAccount (no use of default); bind only required RBAC.
7. If reviewing existing manifests, produce findings.md categorized Blocker / High / Medium / Low.
8. Emit the manifest set under k8s/ plus a deploy.md summarizing the rollout strategy and rollback procedure.

Outputs

• k8s/deployment.yaml, service.yaml, hpa.yaml, pdb.yaml, networkpolicy.yaml, serviceaccount.yaml.
• deploy.md (rollout + rollback).
• findings.md when reviewing existing manifests.

Quality checks

• Every container has both requests and limits set.
• startupProbe, readinessProbe, and livenessProbe are distinct.
• runAsNonRoot: true, readOnlyRootFilesystem: true, all capabilities dropped.
• NetworkPolicy denies by default and lists only required peers.
• PodDisruptionBudget exists for any workload with replicas > 1.
• No use of the default ServiceAccount.

References

(None in v0.1.)