CKSKubernetes 1.35

Exercises

Exercise: fix the manifest the linter rejects

updated 2026-10-22 by seed

Host: controlplane · Time: 8 min · Domain: Supply Chain Security

Task

  • deploy/bad.yaml fails kube-linter lint.
  • Fix every finding without changing the image reference or the replica count.
  • kubectl apply --dry-run=server must pass.

Acceptance criteria

  • kube-linter lint deploy/bad.yaml exits 0.
  • kubesec scan scores positive.
  • The Pod is Running afterwards.

Solution

kube-linter lint deploy/bad.yaml
kubesec scan deploy/bad.yaml | jq '.[0].score'
      securityContext:
        runAsNonRoot: true
        runAsUser: 2000
        seccompProfile: {type: RuntimeDefault}
      containers:
      - name: app
        image: registry.example.com/app:1.4.2   # no :latest
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities: {drop: ["ALL"]}
        resources:
          requests: {cpu: 50m, memory: 64Mi}
          limits: {memory: 128Mi}
        volumeMounts:
        - {name: tmp, mountPath: /tmp}
      volumes:
      - {name: tmp, emptyDir: {}}

The five fields the tools keep asking for: non-root, no escalation, drop caps,
read-only root, seccomp. Add resources and emptyDir for the ones that would
otherwise crash.