{
  "example": "Synthetic, deliberately imperfect visualization input. Not a deployment template or live cloud scan.",
  "resources": 7,
  "boundaries": 1,
  "review": {
    "findings": [
      {
        "id": "single-replica-workload",
        "severity": "medium",
        "category": "reliability",
        "title": "Deployment \"api\" runs a single replica",
        "targets": [
          "storefront/Deployment/api"
        ],
        "why": "With one replica there is no redundancy: a node drain, eviction, or crash leaves zero healthy pods.",
        "risk": "Routine cluster maintenance causes user-visible downtime, and rolling updates have no capacity to shift traffic onto.",
        "bestPractice": "Run at least two replicas across nodes, with a PodDisruptionBudget so voluntary evictions keep one serving.",
        "impact": "Node maintenance and deploys stop being outages."
      },
      {
        "id": "no-health-probe",
        "severity": "medium",
        "category": "reliability",
        "title": "2 workloads define no liveness or readiness probe",
        "targets": [
          "storefront/Deployment/api",
          "storefront/StatefulSet/postgres"
        ],
        "why": "Without probes Kubernetes cannot tell a starting container from a healthy one, or a wedged one from a working one.",
        "risk": "Traffic is routed to pods that are not ready, and hung processes are never restarted.",
        "bestPractice": "Define a readiness probe for traffic gating and a liveness probe for stuck-process recovery.",
        "impact": "Failed and starting pods stop receiving requests."
      },
      {
        "id": "no-logging",
        "severity": "medium",
        "category": "operations",
        "title": "No log group or logging destination is defined",
        "targets": [
          "storefront/Deployment/web",
          "storefront/Deployment/api",
          "storefront/StatefulSet/postgres",
          "storefront/HorizontalPodAutoscaler/web"
        ],
        "why": "The configuration provisions workloads but declares nowhere for their logs to go.",
        "risk": "Incidents are diagnosed without evidence, and most compliance frameworks require retained audit logs.",
        "bestPractice": "Declare log groups with an explicit retention period and ship application and platform logs to them.",
        "impact": "Turns incident investigation from guesswork into evidence, and satisfies a control auditors test."
      },
      {
        "id": "no-resource-limits",
        "severity": "medium",
        "category": "operations",
        "title": "2 workloads have no CPU or memory limits",
        "targets": [
          "storefront/Deployment/api",
          "storefront/StatefulSet/postgres"
        ],
        "why": "No resource limits are set, so these containers can consume whatever the node has available.",
        "risk": "One workload with a memory leak evicts unrelated pods on the same node, turning a single bug into a cluster-wide incident.",
        "bestPractice": "Set requests and limits for CPU and memory on every container, and enforce with a LimitRange per namespace.",
        "impact": "Contains a runaway workload to its own blast radius instead of its neighbours."
      },
      {
        "id": "mutable-image-tag",
        "severity": "medium",
        "category": "operations",
        "title": "1 workload uses a mutable image tag",
        "targets": [
          "storefront/Deployment/api"
        ],
        "why": "Images are referenced by `:latest` or with no tag, so the same reference resolves to different content over time.",
        "risk": "Deployments are not reproducible, rollbacks do not restore known code, and a compromised upstream tag is pulled automatically.",
        "bestPractice": "Pin images to an immutable digest or a version tag produced by your build pipeline.",
        "impact": "Makes every deploy reproducible and every rollback exact."
      }
    ],
    "counts": {
      "critical": 0,
      "high": 0,
      "medium": 5,
      "low": 0
    },
    "grade": {
      "score": 75,
      "letter": "B",
      "color": "#34D399"
    },
    "summary": {
      "resources": 7,
      "byCategory": {
        "compute": 1,
        "container": 3,
        "storage": 0,
        "database": 0,
        "network": 3,
        "edge": 0,
        "security": 0,
        "identity": 0,
        "integration": 0,
        "observability": 0,
        "other": 0
      },
      "clouds": [
        "kubernetes"
      ]
    }
  }
}