{
  "id": 6875946,
  "title": "Copilot Wrote a Kubernetes Manifest That Passed Schema Validation With 21 Security Findings In It",
  "url": "https://urgent.news/2026/09/12/copilot-wrote-a-kubernetes-manifest-that-passed-schema-validation",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-12T06:52:17.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jjoyneriv/copilot-wrote-a-kubernetes-manifest-that-passed-schema-validation-with-21-security-findings-in-it-38ch"
  },
  "original_language": "en",
  "account": "Copilot generated a Kubernetes Deployment manifest that passed schema validation but contained 21 security findings. Schema validation checks if the manifest is structured correctly, while security scanning looks for potential vulnerabilities. The three most important checks to perform are: omitting probes, setting resource requests and limits, and including securityContext settings like runAsNonRoot and readOnlyRootFilesystem.\n\nA common mistake is setting both readinessProbe and livenessProbe to check the same health endpoint, leading to both probes failing simultaneously. This causes the entire deployment to restart during an incident instead of isolating the problematic pods.\n\nRunning `kubectl apply --dry-run=client -f manifests/` is incorrect because it requires cluster credentials, whereas `kubeconform` performs a local schema check without needing cluster access.\n\nCopilot's main value lies in explaining manifest components rather than generating them itself. It helps clarify the purpose of specific blocks and perform mechanical transformations like converting Deployment to StatefulSet or adding init containers. To make the most of Copilot, store the recommended rules in a file like `.github/copilot-instructions.md`, which includes guidelines on resource requests, securityContext settings, pinned images, and the use of multiple probes. By standardizing these practices, generated manifests will have fewer security issues.",
  "summary": "I asked Copilot for a Deployment manifest. It produced valid YAML. kubeconform passed it against the strict schema without a complaint. Then I ran a policy scanner over the same file and got twenty-one findings . Nothing was wrong with the YAML. Everything was wrong with the Deployment. Schema validation and safety are different questions This is the part worth internalising, because it…",
  "key_points": [
    "Copilot generated Kubernetes manifest with 21 security findings",
    "Schema validation passed despite security issues",
    "Best practices include omitting probes and setting resource limits"
  ],
  "editors_take": "Relying on Copilot to generate Kubernetes manifests can lead to security issues, but using it to explain and transform components can help standardize practices and reduce vulnerabilities.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}