Common Fix Patterns for AKS Automatic Compatibility

Loaded on demand when generating YAML fixes during assessment. Maps to constraint IDs in constraint-spec-v1.yaml.

---

safeguard-container-resource-requests — Add resource requests/limits

Before:

containers:
  - name: web
    image: myapp:v1.0.0

After:

containers:
  - name: web
    image: myapp:v1.0.0
    resources:
      requests:
        cpu: "250m"
        memory: "256Mi"
      limits:
        cpu: "500m"
        memory: "512Mi"

💡 Tip: Use safe minimums as starting values. VPA (auto-enabled on AKS Automatic) will tune these after deployment based on actual usage.

---

safeguard-container-capabilities — Drop all capabilities

Before:

securityContext:
  capabilities:
    add: ["NET_ADMIN"]

After:

securityContext:
  capabilities:
    drop: ["ALL"]

⚠️ Warning: If the app genuinely requires NET_ADMIN or similar, it is incompatible with AKS Automatic. Do not silently drop — explain the incompatibility and suggest redesign.

---

safeguard-allowed-seccomp-profiles — Add seccomp profile

Before:

spec:
  containers:
    - name: web

After:

spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: web

---

safeguard-allowed-seccomp-profiles — Remove 'Unconfined' seccomp profile

Before:

spec:
  securityContext:
    seccompProfile:
      type: Unconfined
  containers:
    - name: web

After:

spec:
  containers:
    - name: web

---

safeguard-enforce-apparmor — Add AppArmor annotation

Before:

metadata:
  name: my-deployment

After:

metadata:
  name: my-deployment
  annotations:
    container.apparmor.security.beta.kubernetes.io/web: runtime/default

💡 Tip: Replace web with the actual container name. Add one annotation per container.

---

safeguard-images-no-latest — Pin image tag (LLM-reasoned — ask user)

Before:

image: myapp:latest

After:

image: myapp:v1.2.3   # ← version confirmed with user

⚠️ Warning: Do not guess the version. Ask the user: "What specific version tag or SHA digest should I pin this image to?" If from a public registry, suggest checking Docker Hub or the registry for the latest stable tag.

---

safeguard-probes-configured — Add probes (best-practice recommendation — warning-only, not blocked at admission)

HTTP app (most common):

readinessProbe:
  httpGet:
    path: /healthz        # ← ask user for their health endpoint
    port: 8080            # ← ask user for port
  initialDelaySeconds: 5
  periodSeconds: 10
  failureThreshold: 3
livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 15
  periodSeconds: 20
  failureThreshold: 3

TCP-only app (databases, Redis, etc.):

readinessProbe:
  tcpSocket:
    port: 6379           # ← service port
  initialDelaySeconds: 5
  periodSeconds: 10
livenessProbe:
  tcpSocket:
    port: 6379
  initialDelaySeconds: 15
  periodSeconds: 20

gRPC app:

readinessProbe:
  grpc:
    port: 50051
  initialDelaySeconds: 5
  periodSeconds: 10

---

safeguard-host-probes — Remove host field in probes and lifecycle hooks

Before:

spec:
  containers:
  - name: my-container
    image: nginx:v1.2.3
    livenessProbe:
      httpGet:
        host: "my-host"
        path: /healthz
        port: 8080
      initialDelaySeconds: 15
      periodSeconds: 20
      failureThreshold: 3

After: Remove the host field Example:

spec:
  containers:
  - name: my-container
    image: nginx:v1.2.3
    livenessProbe:
      httpGet:
        path: /healthz
        port: 8080
      initialDelaySeconds: 15
      periodSeconds: 20
      failureThreshold: 3

---

safeguard-pod-enforce-antiaffinity — Add topology spread (LLM-reasoned — ask user for label)

Ask user: "What label key/value identifies your workload's pods?"

spec:
  template:
    spec:
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels: