⎈Kubernetes Manifest Generator

• No PodDisruptionBudget — voluntary disruptions can take all pods at once.→ Add a PodDisruptionBudget resource.
• No NetworkPolicy — pods accept traffic from anywhere in the cluster.→ Add a default-deny NetworkPolicy.
• Uses the default ServiceAccount.→ Create a dedicated ServiceAccount with least privilege.

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: default
  labels:
    app: my-app
    app.kubernetes.io/name: my-app
    app.kubernetes.io/instance: my-app
    app.kubernetes.io/version: "1.27"
    app.kubernetes.io/managed-by: devopsdrill
spec:
  replicas: 2
  selector:
    matchLabels:
      app: my-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: "25%"
      maxUnavailable: "25%"
  template:
    metadata:
      labels:
        app: my-app
        app.kubernetes.io/name: my-app
        app.kubernetes.io/instance: my-app
        app.kubernetes.io/version: "1.27"
        app.kubernetes.io/managed-by: devopsdrill
    spec:
      containers:
        - name: my-app
          image: "nginx:1.27"
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 256Mi
          readinessProbe:
            httpGet:
              path: "/healthz"
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: "/healthz"
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: tmp
              mountPath: "/tmp"
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 3000
        fsGroup: 2000
        seccompProfile:
          type: RuntimeDefault
      automountServiceAccountToken: false
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app: my-app
      volumes:
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: my-app
  namespace: default
  labels:
    app: my-app
    app.kubernetes.io/name: my-app
    app.kubernetes.io/instance: my-app
    app.kubernetes.io/version: "1.27"
    app.kubernetes.io/managed-by: devopsdrill
spec:
  type: ClusterIP
  selector:
    app: my-app
  ports:
    - port: 80
      targetPort: 8080
      protocol: TCP

Validate against a live cluster with kubectl apply --dry-run=server -f manifest.yaml

# kustomization.yaml — put the generated manifests in resources.yaml alongside this file
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: default

commonLabels:
  app.kubernetes.io/managed-by: kustomize

resources:
  - resources.yaml

images:
  - name: nginx
    newTag: "1.27"

replicas:
  - name: my-app
    count: 2

# Apply an environment overlay with:  kubectl apply -k overlays/production