apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    spec:
      containers:
        - name: web
          image: myapp:latest

1 document — 0 errors · 8 warnings · 2 notes

[1] Deployment "web-app" · apps/v1 · namespace production — 0 errors · 8 warnings · 2 notes
WARN  No metadata.labels — selectors, cost reporting and kubectl filtering all depend on them  [no-labels]
      → labels:
  app.kubernetes.io/name: my-app
WARN  No pod-level securityContext  [no-pod-security-context]
      → securityContext:
  runAsNonRoot: true
  seccompProfile: { type: RuntimeDefault }
WARN  Container "web" uses "myapp:latest" — an unpinned tag makes rollouts and rollbacks unpredictable  [image-latest]
      → image: myapp:1.2.3
WARN  Container "web" has no resources.requests — the scheduler cannot place it sensibly  [no-resource-requests]
      → resources:
  requests: { cpu: 100m, memory: 128Mi }
WARN  Container "web" has no resources.limits — one bad deploy can starve the node  [no-resource-limits]
WARN  Container "web" has no livenessProbe — a hung process is never restarted  [no-liveness-probe]
WARN  Container "web" has no readinessProbe — traffic arrives before it is ready  [no-readiness-probe]
WARN  Container "web" does not set allowPrivilegeEscalation: false  [privilege-escalation]
NOTE  No serviceAccountName — the pod gets the namespace default service account  [default-service-account]
      → serviceAccountName: my-app
NOTE  Container "web" has a writable root filesystem  [writable-root-fs]
      → securityContext.readOnlyRootFilesystem: true