Kubernetes Deploy

A deployed manifest earns trust the same way a Dockerfile does: nothing runs as root, nothing gets more than it needs, and the cluster can tell a healthy pod from a broken one before traffic hits it.

securityContext

spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 65532
    seccompProfile: { type: RuntimeDefault }
  containers:
    - name: app
      securityContext:
        readOnlyRootFilesystem: true
        allowPrivilegeEscalation: false
        capabilities: { drop: ["ALL"] }