kubernetes-manifest-validationlisted

# Kubernetes Manifest Validation ## Purpose A consistent pre-deploy checklist for the Kubernetes manifest mistakes that pass `kubectl apply` but never become Ready, silent failures. This is K8s-specific domain knowledge about how manifests fail quietly, not generic YAML linting. ## The silent-failure principle `kubectl apply` validates schema, not intent. A manifest can apply cleanly and then: never pass readiness, get OOMKilled, run as root against policy, or route traffic to a dead Pod. Static pre-flight catches these before they reach the cluster. ## Validation checklist (assign PASS / WARN / FAIL) | Check | FAIL condition | Why it fails silently | |-------|----------------|-----------------------| | Type / quoting | `containerPort: "8080"` (string), `"true"` bool, int env value | schema accepts strings; port never binds / value mis-typed | | Resource requests & limits | missing on a container | BestEffort QoS → first evicted; can starve the node | | Readiness probe | missing | traffic routed before the app can serve → 502s | | Liveness probe | missing (WARN) or too aggressive (FAIL) | wedged Pod never restarts; or healthy Pod killed in a loop | | Startup probe | missing on slow-starting app | liveness kills it before it finishes booting | | securityContext | `runAsNonRoot` unset, caps not dropped, writable rootfs | runs as root; policy admission may reject later | | Image tag | `:latest` or untagged | non-reproducible; rollout pulls a different image silently | | Repl