--- title: 5 Kubernetes YAML Anti-Patterns I Still See in... description: Five common Kubernetes YAML mistakes still found in production environments, each with a concrete fix. The anti-patterns covered are: using the 'latest' image... canonical: https://daily.dev/posts/5-kubernetes-yaml-anti-patterns-i-still-see-in-production-and-how-to-fix-them--un8co0moc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 5 Kubernetes YAML Anti-Patterns I Still See in Production (And How to Fix Them) | daily.dev og:description: Five common Kubernetes YAML mistakes still found in production environments, each with a concrete fix. The anti-patterns covered are: using the 'latest' image... og:url: https://daily.dev/posts/5-kubernetes-yaml-anti-patterns-i-still-see-in-production-and-how-to-fix-them--un8co0moc og:image: https://api.daily.dev/og/posts/Un8co0MOC.png og:image:alt: 5 Kubernetes YAML Anti-Patterns I Still See in Production (And How to Fix Them) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 5 Kubernetes YAML Anti-Patterns I Still See in Production (And How to Fix Them) **[Medium](https://daily.dev/sources/medium_js)** · 3 min read · 0 upvotes · 0 comments ## Summary Five common Kubernetes YAML mistakes still found in production environments, each with a concrete fix. The anti-patterns covered are: using the 'latest' image tag (supply chain risk and non-deterministic deployments), running containers as root (privilege escalation risk), omitting CPU and memory limits (node OOM killer risk), missing liveness and readiness probes (traffic routed to unhealthy pods), and hardcoding secrets in ConfigMaps (unencrypted credentials in etcd). Each issue is illustrated with a bad and good YAML snippet. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why is using the latest tag for a container image in Kubernetes considered a security risk? Using the latest tag breaks deterministic deployments and opens a supply chain attack vector: if an attacker gains access to the image registry, they can publish an infected version under the same tag, and Kubernetes will deploy it without anyone noticing. Two pods started on different days could end up running completely different code. The fix is pinning images to explicit semantic versions or immutable SHA-256 digests. _Developers hardening Kubernetes manifests can find similar production-tested fixes on daily.dev._ ### How do I stop Kubernetes containers from running as root by default? Kubernetes containers run as root unless you explicitly configure a securityContext to prevent it. Set runAsNonRoot: true and runAsUser to a non-zero UID at the pod level, and add allowPrivilegeEscalation: false at the container level, ideally paired with a non-root base image such as nginxinc/nginx-unprivileged:alpine. Without this, a remote code execution exploit instantly grants an attacker root access inside the container, making host node escapes easier. _Teams reviewing container security contexts can track patterns like this via daily.dev._ ### Why do ConfigMaps in Kubernetes leak secrets even though they seem hidden in a manifest? Kubernetes ConfigMaps are stored unencrypted in etcd by default and can be read by anyone with basic namespace read access, and their plain-text values frequently leak into system logs. Storing credentials like DB_PASSWORD directly in a ConfigMap exposes them broadly. Use native Kubernetes Secrets, which are encrypted at rest, or inject credentials via a secret manager such as HashiCorp Vault or AWS Secrets Manager instead. _Anyone auditing secrets handling in Kubernetes manifests can keep up with such guidance through daily.dev._ ## Similar posts on daily.dev - [7 Toxic Kubernetes CI/CD Mistakes Ruining Your Weekends](https://daily.dev/posts/7-toxic-kubernetes-ci-cd-mistakes-ruining-your-weekends-40ijlbjeq) · Devtron · 1 upvotes · 0 comments - [Ten Common Kubernetes Misconfigurations That Cause Outages \(And What You Can Do About It\)](https://daily.dev/posts/ten-common-kubernetes-misconfigurations-that-cause-outages-and-what-you-can-do-about-it--3demxdwov) · Container Journal · 2 upvotes · 0 comments - [5 anti-patterns that cause Kubernetes operator vulnerabilities](https://daily.dev/posts/5-anti-patterns-that-cause-kubernetes-operator-vulnerabilities-tjsfjyvka) · Red Hat Developer · 6 upvotes · 0 comments - [Kubernetes Pod Troubleshooting: 5 Real Production Failures in 2026](https://daily.dev/posts/kubernetes-pod-troubleshooting-5-real-production-failures-in-2026-09hrifvf0) · Medium · 2 upvotes · 1 comments - [Building AI Agents? Here Are Some Anti-Patterns to Avoid.](https://daily.dev/posts/building-ai-agents-here-are-some-anti-patterns-to-avoid--3lg9j0mta) · Machine Learning Mastery · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devops](https://daily.dev/tags/devops), [#kubernetes](https://daily.dev/tags/kubernetes), [#containers](https://daily.dev/tags/containers) [View this post on daily.dev](https://daily.dev/posts/5-kubernetes-yaml-anti-patterns-i-still-see-in-production-and-how-to-fix-them--un8co0moc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"5 Kubernetes YAML Anti-Patterns I Still See in Production (And How to Fix Them)","url":"https://daily.dev/posts/5-kubernetes-yaml-anti-patterns-i-still-see-in-production-and-how-to-fix-them--un8co0moc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/5-kubernetes-yaml-anti-patterns-i-still-see-in-production-and-how-to-fix-them--un8co0moc"},"datePublished":"2026-07-24T19:34:29.475Z","dateModified":"2026-09-14T06:26:56.891Z","description":"Five common Kubernetes YAML mistakes still found in production environments, each with a concrete fix. The anti-patterns covered are: using the 'latest' image...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6ab0a9a223ee01bc82d647f54feb2d2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6ab0a9a223ee01bc82d647f54feb2d2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/5-kubernetes-yaml-anti-patterns-i-still-see-in-production-and-how-to-fix-them--un8co0moc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devops,kubernetes,containers","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"5 Kubernetes YAML Anti-Patterns I Still See in Production (And How to Fix Them)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/5-kubernetes-yaml-anti-patterns-i-still-see-in-production-and-how-to-fix-them--un8co0moc#faq","mainEntity":[{"@type":"Question","name":"Why is using the latest tag for a container image in Kubernetes considered a security risk?","acceptedAnswer":{"@type":"Answer","text":"Using the latest tag breaks deterministic deployments and opens a supply chain attack vector: if an attacker gains access to the image registry, they can publish an infected version under the same tag, and Kubernetes will deploy it without anyone noticing. Two pods started on different days could end up running completely different code. The fix is pinning images to explicit semantic versions or immutable SHA-256 digests. Developers hardening Kubernetes manifests can find similar production-tested fixes on daily.dev."}},{"@type":"Question","name":"How do I stop Kubernetes containers from running as root by default?","acceptedAnswer":{"@type":"Answer","text":"Kubernetes containers run as root unless you explicitly configure a securityContext to prevent it. Set runAsNonRoot: true and runAsUser to a non-zero UID at the pod level, and add allowPrivilegeEscalation: false at the container level, ideally paired with a non-root base image such as nginxinc/nginx-unprivileged:alpine. Without this, a remote code execution exploit instantly grants an attacker root access inside the container, making host node escapes easier. Teams reviewing container security contexts can track patterns like this via daily.dev."}},{"@type":"Question","name":"Why do ConfigMaps in Kubernetes leak secrets even though they seem hidden in a manifest?","acceptedAnswer":{"@type":"Answer","text":"Kubernetes ConfigMaps are stored unencrypted in etcd by default and can be read by anyone with basic namespace read access, and their plain-text values frequently leak into system logs. Storing credentials like DB_PASSWORD directly in a ConfigMap exposes them broadly. Use native Kubernetes Secrets, which are encrypted at rest, or inject credentials via a secret manager such as HashiCorp Vault or AWS Secrets Manager instead. Anyone auditing secrets handling in Kubernetes manifests can keep up with such guidance through daily.dev."}}]} ```