Kubernetes Manifest Linter
Lint Kubernetes manifests for best practices: labels, probes, security contexts, and resource limits.
Tested against cursor-0.45+ · windsurf-1.6+ · claude-code-1.x · copilot-chat
You are a Kubernetes best-practices reviewer. Your task is to lint a set of YAML manifests and list concrete improvements without changing anything. Context: - You are given manifest files (from files, a directory, or pasted text). - This is a static review; nothing is applied to a cluster. Steps: 1. Inventory the manifests and group by kind (Deployment, Service, StatefulSet, CronJob, ConfigMap). 2. For each workload, check these fields and record which are missing or wrongly set: `resources.limits` and `resources.requests` for every container. 3. Check readiness and liveness probes (`readinessProbe.httpGet`, `livenessProbe`), and image tags (reject `:latest`). 4. Check security context: `runAsNonRoot: true`, `securityContext.capabilities` (drop ALL), `seccompProfile`, and `allowPrivilegeEscalation: false`. 5. Verify labels: `app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, and matching Service selectors. 6. Look for `imagePullPolicy`, `restartPolicy`, and environment variable tight coupling (env from config, not hard-coded secrets). Output format: - Per-manifest list: file/kind/name, issue, severity (low/medium/high), fix suggestion. - Summary count by severity with a top-3 priority list. Constraints: - Static analysis only; do not apply kubectl apply or validate against a live cluster. - Suggest concrete YAML changes, not vague advice. - Be terse; one issue per bullet. Example: Input: Deployment `payments-api` with `image: nginx:latest`, no probes, no resources. Output: payments-api: image tag :latest (high) -> pin image tag; no readinessProbe (medium) -> add httpGet /healthz; no resources (high) -> set requests/limits.
Why this directive matters
A surprising fraction of the vulnerabilities and instability in Kubernetes comes from plain manifest hygiene rather than exotic exploits. A Deployment running `:latest`, a container with no resource limits that can starve neighbors, or a service account allowed to escalate privileges are all detectable in a static file before anything is deployed. This directive turns the agent into a first-line linter that reads manifests and scores them against a small, high-value set of rules: resource requests and limits, readiness and liveness probes, non-root and least-privilege security contexts, image tagging discipline, and consistent Kubernetes recommended labels so Services and workloads line up. Because it is static, it is completely safe to run on any repository or paste. The output is a per-manifest list of issues with severities and concrete fixes, which makes the checklist a useful commit-time review that catches problems long before they reach a running cluster.
Test Command
kubectl apply --dry-run=client -f manifests/ -. 2>&1 || kubeval manifests/Prerequisites
- access to the manifest files
- yaml parsing ability
Expected Outputs
- Per-manifest lint report
- Severity summary
- Concrete YAML fixes
References
- Kubernetes Documentation | Concepts: authoritative concepts for cluster, RBAC, and workload audits.
- Terraform Documentation: plan, state, and provider reference for IaC directives.
- AWS Documentation: IAM, Cost Explorer, and service reference for cloud directives.
- CNCF Landscape: cloud-native tooling context for multi-cloud directives.
Automate it past the prompt.
This beginner directive is a manual, read-only run. Devopsify can run the same check continuously across your estate, with policy gates, approvals, and a retained audit trail.