Azure Kubernetes Service (AKS) and 7 More Manifest Families — 40 Snippets + 28 Rules That Name a Removed apiVersion, a :latest Tag or a Literal Secret Before It Reaches the Cluster

Your editor does not reject a removed apiVersion. The cluster does, at deploy time.

That gap is where the outage lives. A PodDisruptionBudget still written against policy/v1beta1 looks perfectly fine in the editor - correct YAML, correct indentation, no squiggly line anywhere. Then AKS moves your cluster to a version that no longer serves that group, the object is refused, and the workload you thought was protected has no disruption budget for the whole of the next node drain.

The timing is not up to you. AKS supports a GA Kubernetes version for twelve months, and when a cluster is about to fall out of the support window it is upgraded automatically to stay inside policy. You can configure the upgrade to stop when deprecated APIs are detected, which is the good outcome: your upgrade halts instead of your CronJob silently never running again.

So the useful moment to catch these lines is while you are typing them, not in CI after the push.

This pack puts twenty-eight rules in the editor. They run on the file you have open and report line numbers:

apiVersion: policy/v1beta1        # removed - the cluster refuses this object
apiVersion: batch/v1beta1         # removed - the schedule silently stops
image: registry.internal/api:latest   # you cannot tell the failing build from the working one
serviceAccountName: default       # shared by every pod in the namespace
runAsUser: 0                      # a root process writes to any volume it has mounted
DB_PASSWORD: hunter2supersecret   # committed once, it exists in every clone forever

# what the snippets give you instead
apiVersion: policy/v1
kind: PodDisruptionBudget
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: checkout-api

The rules cover eight file families, not one - Kubernetes and Helm, Azure IoT Edge deployment manifests, MicroProfile and Liberty config, T-SQL, MAUI project files and R scripts - because the engineer who owns the cluster usually owns those repos too. Forty snippet blocks expand at the cursor, all written against API versions that still exist.

Checking the file you have open is free and complete. All twenty-eight rules run, nothing is held back, nothing is watermarked. What a licence changes is scale, not quality: the same rules across every file in the workspace, your team's own banned registries and required labels checked alongside the built-in set, and the findings written out as a CSV, JSON or HTML file you can attach to the change request.

A managed Kubernetes security platform starts around $45 per developer per month. A cloud security-audit hour benchmarks at $275 in 2026. This is $29, once.