AI-Generated Kubernetes Manifest Passed Schema Check but Had 21 Security Flaws

A GitHub Copilot-generated Kubernetes Deployment manifest cleared strict schema validation via kubeconform without any errors, yet a subsequent policy scanner revealed 21 security findings. The core issue is that schema validators only confirm structural correctness — they do not evaluate whether a configuration is safe or operationally sound. Key gaps in the generated manifest included missing resource limits, absent security contexts such as runAsNonRoot and readOnlyRootFilesystem, and no liveness or readiness probes. The article also warns against conflating liveness and readiness probes, since routing them to the same endpoint can trigger full deployment restarts during incidents rather than simply removing unhealthy pods from traffic rotation. The author recommends running schema checks as pre-commit hooks and policy scans in CI, treating both as complementary rather than interchangeable steps.