Copilot Wrote a Kubernetes Manifest That Passed Schema Validation With 21 Security Findings In It

Copilot generated a Kubernetes Deployment manifest that passed schema validation but contained 21 security findings. Schema validation checks if the manifest is structured correctly, while security scanning looks for potential vulnerabilities. The three most important checks to perform are: omitting probes, setting resource requests and limits, and including securityContext settings like runAsNonRoot and readOnlyRootFilesystem.

A common mistake is setting both readinessProbe and livenessProbe to check the same health endpoint, leading to both probes failing simultaneously. This causes the entire deployment to restart during an incident instead of isolating the problematic pods.

Running `kubectl apply --dry-run=client -f manifests/` is incorrect because it requires cluster credentials, whereas `kubeconform` performs a local schema check without needing cluster access.

Copilot's main value lies in explaining manifest components rather than generating them itself. It helps clarify the purpose of specific blocks and perform mechanical transformations like converting Deployment to StatefulSet or adding init containers. To make the most of Copilot, store the recommended rules in a file like `.github/copilot-instructions.md`, which includes guidelines on resource requests, securityContext settings, pinned images, and the use of multiple probes. By standardizing these practices, generated manifests will have fewer security issues.