Copilot Wrote a Kubernetes Manifest That Passed Schema Validation With 21 Security Findings In It

I asked Copilot for a Deployment manifest. It produced valid YAML. kubeconform passed it against the strict schema without a complaint. Then I ran a policy scanner over the same file and got twenty-one findings . Nothing was wrong with the YAML. Everything was wrong with the Deployment. Schema validation and safety are different questions This is the part worth internalising, because it generalises past Kubernetes: a structural validator checks that your file is shaped correctly. It has no opinion about whether the thing you described is a good idea. kubeconform asks "is spec.template.spec.containers[0].image a string?" It does not ask "does this container run as root?" Both tools were doing their jobs. Only one of them was doing the review. Run both. The schema check is fast enough to be a pre-commit hook; the policy scan belongs in CI. The three things generated manifests omit, essentially every time Probes. No readinessProbe , no livenessProbe , no startupProbe . Resource requests and limits. A pod with no requests is scheduled anywhere and evicted first. securityContext . No runAsNonRoot , no allowPrivilegeEscalation: false , no readOnlyRootFilesystem , no dropped capabilities. Those three are the review. If you check nothing else on a generated manifest, check those — and note that a namespace with Pod Security Admission set to restricted will reject the pod at admission rather than at review, which is a much better place to find out. The probe mistake that turns a slow dependency into an outage This one deserves its own section because it is subtle, common, and it fails at exactly the wrong moment. Generated manifests frequently point livenessProbe and readinessProbe at the same endpoint. They look equivalent. They are not — they answer different questions: startupProbe — has it finished booting? readinessProbe — should it receive traffic right now ? livenessProbe — is it wedged, and worth killing? If your /health endpoint checks the database, and the database