Kubernetes Manifest Review: test results

Verdicts

Date

2026-10-26

Strong · claude-sonnet-5-5 (Claude Code alias "sonnet")

Right on all 3 cases, read by hand. On the shop Deployment it found the image with no tag and the password typed into env, and left out the digest-pinned sidecar, the harmless log level and the pod-level runAsNonRoot. On the node-agent Pod it gave the privileged container, the missing memory limit and the Docker socket mount, and left out the token read through secretKeyRef. On the clean billing Deployment it answered exactly No findings.

Weak · claude-haiku-5-5 (Claude Code alias "haiku")

Right on all 3 cases, read by hand. It matched the strong model on both planted manifests with sound fixes and kept the digest-pinned sidecar, the log level, the secretKeyRef token and the read-only configMap volume out of its list. On the clean manifest it answered exactly No findings.

Note

Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. Facts come from public Kubernetes documentation, read on 26 October 2026; there are no owner-measured facts.

What was not measured

• Models other than the two named above were not run.
• Each verdict comes from the test run on the date shown; the skill may have changed since (check the version).
• Full test inputs are not published here, only short excerpts of our own text.
• Results on your own texts, languages and domains can differ.