Setting the file. One moment.
Chapter 20 · Azure Kubernetes App Deploy
Subchapter 20.4
references/safeguards.mdMarkdown3 KBView on GitHub
Source of truth: the Deployment Safeguards policy initiative is defined once in
../../azure-kubernetes-automatic-readiness/references/constraint-spec-v1.yaml(initiative ). This file is the : which rules the app-deploy workflow auto-fixes vs. warns on, and how. When the policy set changes, update the constraint spec; only the app-deploy-specific fix behavior below is maintained here.
c047ea8e-…This checklist maps each safeguard to how the quick-deploy workflow handles it.
Every container needs resources.requests AND resources.limits for both cpu and memory.
Every container needs a livenessProbe. Use httpGet, tcpSocket, or exec.
Every container needs a readinessProbe.
Set at both pod and container level.
Remove hostNetwork: true or set to false.
Remove hostPID: true or set to false.
Remove hostIPC: true or set to false.
Remove securityContext.privileged: true or set to false.
Use a semantic version, git SHA, or digest — never :latest or omit the tag.
Set spec.replicas: 2 or higher. Pair with a PodDisruptionBudget.
Every container must set securityContext.allowPrivilegeEscalation: false.
Every container must set securityContext.readOnlyRootFilesystem: true.
If the app writes to specific paths, mount emptyDir volumes:
volumes:
- name: tmp
emptyDir: {}
containers:
- volumeMounts:
- name: tmp
mountPath: /tmpCommon writable paths: Spring Boot /tmp, ASP.NET /tmp, Django /tmp, Express /tmp, Go /tmp.
Set spec.automountServiceAccountToken: false. Set to true only if the app genuinely calls the K8s API (scope with RBAC).
| Rule | What | Severity | Auto-Fix |
|---|---|---|---|
| DS001 | Resource limits | Error | Yes |
| DS002 | Liveness probe | Warning | Yes |
| DS003 | Readiness probe | Warning | Yes |
| DS004 | runAsNonRoot | Error | Yes |
| DS005 | No hostNetwork | Error | Yes |
| DS006 | No hostPID | Error | Yes |
| DS007 | No hostIPC | Error | Yes |
| DS008 | No privileged | Error | Yes |
| DS009 | No :latest tag | Error | No |
| DS010 | Min 2 replicas | Warning | Yes |
| DS011 | No privilege escalation | Error | Yes |
| DS012 | Read-only root FS | Warning | Yes |
| DS013 | No SA token mount | Warning | Yes |