Deployment manifests

Name: Deployment manifests
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Identifies Kubernetes/Helm/Compose deployment manifests with populated resource definitions: apiVersion/kind, container image and pod spec keys, namespaces or internal hosts. Manifest wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: topic wording is discovery-only; enforcement requires manifest structure, and 85 adds a second structure and cluster context. Pod-template manifests are under-detected (see operation).
Detection quality: Not detected
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF, CIS Controls
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:(?:deployment|kubernetes|k8s|service|release)\s+manifests?|helm\s+(?:chart|values\s+file|release)|docker-compose\.ya?ml|compose\s+file|pod\s+spec(?:ification)?|deployment\s+descriptor|kustomization\.ya?ml)\b

Corroborative evidence keywords

production, cluster, ingress controller, load balancer, rollout

Proximity: 300 characters

Should match

Kubernetes manifest for payments-api (production cluster) apiVersion: v1 kind: Service metadata: name: payments-api namespace: payments-prod spec: type: LoadBalancer ports: - port: 443 --- apiVersion: v1 kind: Pod spec: serviceAccountName: payments-runner containers: - name: api image: registry.example.internal/payments/api:2.14.0 — High tier (85) - apiVersion/kind, container spec and namespace with production cluster context
Helm values file for the intranet chart: replicaCount: 2 imagePullPolicy: IfNotPresent — Medium tier (75) - pod-spec key only
docker-compose.yml for the reporting stack: kind: Service definitions are generated from it by the converter. — Medium tier (75) - resource kind line only
Can someone review the helm chart changes before the release? — Discovery tier (65) - topic wording only

Should not match

unrelated generic text without domain phrases — No relevant topic phrases present
Kubernetes guidance note: organisations should not put secrets in a deployment manifest; reference them with secretKeyRef instead. — Guidance text
Deployment manifest blank template kind: Deployment namespace: ______ image: ______ — Blank template
Tutorial: this pod specification runs a demo nginx container with image: nginx/nginx:1.27 in a local cluster. — Tutorial/demo framing must not enforce

Known false positives

Kubernetes documentation, tutorials and vendor examples contain apiVersion/kind and image lines. Mitigation: Topic wording is discovery-only; enforcement needs manifest structure, and guidance/tutorial/demo/template framing is excluded.
Deployment, StatefulSet and Job manifests contain a template: key that trips the shared template-exclusion NOT group (false negative). Mitigation: Documented limitation; Service, Pod, ConfigMap, Ingress, Helm values and Compose files are unaffected.