kubernetes manifest audit derived

{
  "input": {
    "body": {
      "contract": {
        "require_labels": [
          "app",
          "team"
        ],
        "require_probes": true,
        "require_resource_limits": true,
        "forbid_mutable_image_tags": true
      },
      "manifests": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: web\n  labels:\n    app: web\nspec:\n  replicas: 3\n  selector:\n    matchLabels:\n      app: web\n  template:\n    metadata:\n      labels:\n        app: web\n    spec:\n      containers:\n        - name: web\n          image: ghcr.io/example/web:latest\n          ports:\n            - containerPort: 8080\n          resources:\n            requests:\n              cpu: 500m\n              memory: 256M\n            limits:\n              cpu: 200m\n              memory: 512Mi\n          env:\n            - name: DATABASE_PASSWORD\n              value: hunter2\n            - name: FEATURE_FLAG\n              value: no\n"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxFindings": 500,
        "maxDocuments": 100,
        "maxYamlBytes": 262144,
        "maxDockerfileBytes": 131072
      },
      "passed": false,
      "checked": {
        "probes": true,
        "required_labels": 2,
        "resource_limits": true,
        "security_context": false,
        "mutable_image_tags": true
      },
      "complete": true,
      "findings": [
        {
          "code": "SCALAR_IS_A_YAML_BOOLEAN",
          "line": 33,
          "detail": "manifests: \"no\" is an unquoted YAML 1.1 boolean and reads as false, not as the text no. Quoting it keeps it a string.",
          "location": "spec.template.spec.containers[0].env[1].value"
        },
        {
          "code": "REQUIRED_LABEL_ABSENT",
          "detail": "Deployment web does not carry the required label team.",
          "location": "Deployment web"
        },
        {
          "code": "IMAGE_TAG_IS_LATEST",
          "detail": "Deployment web container web uses the latest tag, so two pods created minutes apart can run different code.",
          "location": "Deployment web container web"
        }
      ],
      "documents": [
        {
          "kind": "Deployment",
          "name": "web",
          "containers": 1
        }
      ],
      "conformant": false,
      "request_id": "example-request",
      "service_id": "kubernetes_manifest_audit",
      "assumptions": [
        "Nothing is fetched and no cluster is contacted. The findings are about the documents supplied, so a value injected by an admission controller or a Helm template at deploy time is absent here and not a...",
        "YAML parsing surprises in the source are reported as findings rather than silently inherited, because a key read as the boolean true or a file mode read as octal changes what the cluster receives.",
        "Which checks ran is published, so a contract that switched everything off is visible rather than reading as a pass."
      ],
      "limitations": [
        "Observable facts about the manifests supplied. This is not a security assessment, a compliance determination or a judgement that a workload is production ready.",
        "conformant is true only when every document parsed and every check that ran found nothing."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 6,
      "document_count": 1,
      "workload_count": 1,
      "container_count": 1,
      "service_version": "1.0.0",
      "findings_by_code": {
        "IMAGE_TAG_IS_LATEST": 1,
        "LIVENESS_PROBE_ABSENT": 1,
        "REQUIRED_LABEL_ABSENT": 1,
        "READINESS_PROBE_ABSENT": 1,
        "SCALAR_IS_A_YAML_BOOLEAN": 1,
        "CREDENTIAL_SHAPED_ENV_LITERAL": 1
      }
    }
  }
}