lint: 42 issues found by KubeLinter

When running [KubeLinter](https://github.com/stackrox/kube-linter) on `main`, 42 issues are found:

Show issues

```
$ kube-linter lint .
KubeLinter 0.8.3

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/config/manager/manager.yaml: (object: nrr-system/nrr-controller-manager apps/v1, Kind=Deployment) The container "manager" is using an invalid container image, "controller:latest". Please use images that are not blocked by the `BlockList` criteria : [".*:(latest)$" "^[^:]*$" "(.*/[^:]+)$"] (check: latest-tag, remediation: Use a container image with a specific tag other than latest.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/config/manager/manager.yaml: (object: nrr-system/nrr-controller-manager apps/v1, Kind=Deployment) container "manager" does not expose port 8081 for the HTTPGet (check: liveness-port, remediation: Check which ports you've exposed and ensure they match what you have specified in the liveness probe.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/config/manager/manager.yaml: (object: nrr-system/nrr-controller-manager apps/v1, Kind=Deployment) container "manager" does not expose port 8081 for the HTTPGet (check: readiness-port, remediation: Check which ports you've exposed and ensure they match what you have specified in the readiness probe.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/config/manager/manager.yaml: (object: system/controller-manager apps/v1, Kind=Deployment) The container "manager" is using an invalid container image, "controller:latest". Please use images that are not blocked by the `BlockList` criteria : [".*:(latest)$" "^[^:]*$" "(.*/[^:]+)$"] (check: latest-tag, remediation: Use a container image with a specific tag other than latest.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/config/manager/manager.yaml: (object: system/controller-manager apps/v1, Kind=Deployment) container "manager" does not expose port 8081 for the HTTPGet (check: liveness-port, remediation: Check which ports you've exposed and ensure they match what you have specified in the liveness probe.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/config/manager/manager.yaml: (object: system/controller-manager apps/v1, Kind=Deployment) serviceAccount "controller-manager" not found (check: non-existent-service-account, remediation: Create the missing service account, or refer to an existing service account.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/config/manager/manager.yaml: (object: system/controller-manager apps/v1, Kind=Deployment) container "manager" does not expose port 8081 for the HTTPGet (check: readiness-port, remediation: Check which ports you've exposed and ensure they match what you have specified in the readiness probe.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/config/prometheus/metrics_service.yaml: (object: system/metrics-service /v1, Kind=Service) no pods found matching service labels (map[app.kubernetes.io/name:nrrcontroller control-plane:controller-manager]) (check: dangling-service, remediation: Confirm that your service's selector correctly matches the labels on one of your deployments.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/config/webhook/service.yaml: (object: system/webhook-service /v1, Kind=Service) no pods found matching service labels (map[control-plane:controller-manager]) (check: dangling-service, remediation: Confirm that your service's selector correctly matches the labels on one of your deployments.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/cni-readiness/cni-reporter-ds.yaml: (object: kube-system/cni-reporter apps/v1, Kind=DaemonSet) resource shares host's network namespace (via hostNetwork=true). (check: host-network, remediation: Ensure the host's network namespace is not shared.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/cni-readiness/cni-reporter-ds.yaml: (object: kube-system/cni-reporter apps/v1, Kind=DaemonSet) container "cni-status-patcher" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/cni-readiness/cni-reporter-ds.yaml: (object: kube-system/cni-reporter apps/v1, Kind=DaemonSet) container "cni-status-patcher" is not set to runAsNonRoot (check: run-as-non-root, remediation: Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/constrained-impersonation/reporter-ds.yaml: (object: kube-system/cni-reporter apps/v1, Kind=DaemonSet) resource shares host's network namespace (via hostNetwork=true). (check: host-network, remediation: Ensure the host's network namespace is not shared.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/constrained-impersonation/reporter-ds.yaml: (object: kube-system/cni-reporter apps/v1, Kind=DaemonSet) container "cni-status-patcher" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/constrained-impersonation/reporter-ds.yaml: (object: kube-system/cni-reporter apps/v1, Kind=DaemonSet) container "cni-status-patcher" is not set to runAsNonRoot (check: run-as-non-root, remediation: Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/security-agent-readiness/npd-variant/npd-daemonset.yaml: (object: falco/node-problem-detector-falco apps/v1, Kind=DaemonSet) resource shares host's network namespace (via hostNetwork=true). (check: host-network, remediation: Ensure the host's network namespace is not shared.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/security-agent-readiness/npd-variant/npd-daemonset.yaml: (object: falco/node-problem-detector-falco apps/v1, Kind=DaemonSet) container "node-problem-detector" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/security-agent-readiness/npd-variant/npd-daemonset.yaml: (object: falco/node-problem-detector-falco apps/v1, Kind=DaemonSet) container "node-problem-detector" is Privileged hence allows privilege escalation. (check: privilege-escalation-container, remediation: Ensure containers do not allow privilege escalation by setting allowPrivilegeEscalation=false, privileged=false and removing CAP_SYS_ADMIN capability. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for more details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/security-agent-readiness/npd-variant/npd-daemonset.yaml: (object: falco/node-problem-detector-falco apps/v1, Kind=DaemonSet) container "node-problem-detector" is privileged (check: privileged-container, remediation: Do not run your container as privileged unless it is required.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/security-agent-readiness/npd-variant/npd-daemonset.yaml: (object: falco/node-problem-detector-falco apps/v1, Kind=DaemonSet) container "node-problem-detector" is not set to runAsNonRoot (check: run-as-non-root, remediation: Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/static-pod/node-readiness-controller.yaml: (object: kube-system/node-readiness-controller /v1, Kind=Pod) resource shares host's network namespace (via hostNetwork=true). (check: host-network, remediation: Ensure the host's network namespace is not shared.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/static-pod/node-readiness-controller.yaml: (object: kube-system/node-readiness-controller /v1, Kind=Pod) The container "prepare-kubeconfig" is using an invalid container image, "busybox:latest". Please use images that are not blocked by the `BlockList` criteria : [".*:(latest)$" "^[^:]*$" "(.*/[^:]+)$"] (check: latest-tag, remediation: Use a container image with a specific tag other than latest.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/static-pod/node-readiness-controller.yaml: (object: kube-system/node-readiness-controller /v1, Kind=Pod) The container "manager" is using an invalid container image, "controller:latest". Please use images that are not blocked by the `BlockList` criteria : [".*:(latest)$" "^[^:]*$" "(.*/[^:]+)$"] (check: latest-tag, remediation: Use a container image with a specific tag other than latest.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/static-pod/node-readiness-controller.yaml: (object: kube-system/node-readiness-controller /v1, Kind=Pod) container "prepare-kubeconfig" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/static-pod/node-readiness-controller.yaml: (object: kube-system/node-readiness-controller /v1, Kind=Pod) container "manager" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/static-pod/node-readiness-controller.yaml: (object: kube-system/node-readiness-controller /v1, Kind=Pod) container "prepare-kubeconfig" is not set to runAsNonRoot (check: run-as-non-root, remediation: Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/static-pod/node-readiness-controller.yaml: (object: kube-system/node-readiness-controller /v1, Kind=Pod) container "prepare-kubeconfig" has cpu request 0 (check: unset-cpu-requirements, remediation: Set CPU requests for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/static-pod/node-readiness-controller.yaml: (object: kube-system/node-readiness-controller /v1, Kind=Pod) container "manager" has cpu request 0 (check: unset-cpu-requirements, remediation: Set CPU requests for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/static-pod/node-readiness-controller.yaml: (object: kube-system/node-readiness-controller /v1, Kind=Pod) container "prepare-kubeconfig" has memory limit 0 (check: unset-memory-requirements, remediation: Set memory limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/examples/static-pod/node-readiness-controller.yaml: (object: kube-system/node-readiness-controller /v1, Kind=Pod) container "manager" has memory limit 0 (check: unset-memory-requirements, remediation: Set memory limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/kwok.yaml: (object: kube-system/kwok-controller apps/v1, Kind=Deployment) container "kwok-controller" does not expose port 10247 for the HTTPGet (check: liveness-port, remediation: Check which ports you've exposed and ensure they match what you have specified in the liveness probe.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/kwok.yaml: (object: kube-system/kwok-controller apps/v1, Kind=Deployment) container "kwok-controller" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/kwok.yaml: (object: kube-system/kwok-controller apps/v1, Kind=Deployment) container "kwok-controller" does not expose port 10247 for the HTTPGet (check: readiness-port, remediation: Check which ports you've exposed and ensure they match what you have specified in the readiness probe.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/kwok.yaml: (object: kube-system/kwok-controller apps/v1, Kind=Deployment) container "kwok-controller" is not set to runAsNonRoot (check: run-as-non-root, remediation: Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/kwok.yaml: (object: kube-system/kwok-controller apps/v1, Kind=Deployment) container "kwok-controller" does not expose port 10247 for the HTTPGet (check: startup-port, remediation: Check which ports you've exposed and ensure they match what you have specified in the startup probe.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/kwok.yaml: (object: kube-system/kwok-controller apps/v1, Kind=Deployment) container "kwok-controller" has cpu request 0 (check: unset-cpu-requirements, remediation: Set CPU requests for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/kwok.yaml: (object: kube-system/kwok-controller apps/v1, Kind=Deployment) container "kwok-controller" has memory limit 0 (check: unset-memory-requirements, remediation: Set memory limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/nginx.yaml: (object: /nginx apps/v1, Kind=Deployment) The container "nginx" is using an invalid container image, "nginx:latest". Please use images that are not blocked by the `BlockList` criteria : [".*:(latest)$" "^[^:]*$" "(.*/[^:]+)$"] (check: latest-tag, remediation: Use a container image with a specific tag other than latest.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/nginx.yaml: (object: /nginx apps/v1, Kind=Deployment) container "nginx" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/nginx.yaml: (object: /nginx apps/v1, Kind=Deployment) container "nginx" is not set to runAsNonRoot (check: run-as-non-root, remediation: Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/nginx.yaml: (object: /nginx apps/v1, Kind=Deployment) container "nginx" has cpu request 0 (check: unset-cpu-requirements, remediation: Set CPU requests for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)

/home/vitorfloriano/go/src/github.com/vitorfloriano/node-readiness-controller/hack/test-workloads/nginx.yaml: (object: /nginx apps/v1, Kind=Deployment) container "nginx" has memory limit 0 (check: unset-memory-requirements, remediation: Set memory limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)

Error: found 42 lint errors
```

Here's a summary of the issues, grouped by type (amount):

`no-read-only-root-fs` (7): The container's root file system is not set to read-only.
`run-as-non-root` (6): The container is not explicitly configured to run as a non-root user.
`host-network` (4): The resource is sharing the host machine's network namespace (hostNetwork=true).
`privilege-escalation-container` (1): The container is permitted to escalate privileges.
`privileged-container` (1): The container is running in privileged mode, granting it extensive host access.
`unset-cpu-requirements` (4): The container does not have CPU requests or limits defined.
`unset-memory-requirements` (4): The container does not have memory requests or limits defined.
`liveness-port` (3): The container does not expose the port specified in its HTTPGet liveness probe.
`readiness-port` (3): The container does not expose the port specified in its HTTPGet readiness probe.
`startup-port` (1): The container does not expose the port specified in its HTTPGet startup probe.
`latest-tag` (5): The deployment uses the latest image tag (or an invalid tag) instead of pinning a specific, stable version.
`dangling-service` (2): The Service's label selector does not match the labels of any deployed pods, meaning traffic will not route anywhere.
`non-existent-service-account` (1): A workload is attempting to use a serviceAccount that has not been created or cannot be found.

Since those are not few and would require significant effort, some questions arise:

1. Should we investigate those issues? Are they really issues or just false-positives (non-issues in our case)?
2. Could we add KubeLinter to CI? Would it benefit the project in any way?

ps: If this is accepted in triage, it would be nice to have this broken down in sub-issues.

Start by running KubeLinter 0.8.3 with `kube-linter lint .` and inspect the reported manifests, including config/manager/manager.yaml, config/prometheus/metrics_service.yaml, config/webhook/service.yaml, and the examples YAML files. Address the listed image, probe, selector, resource, and security-context findings across the manifests; done means the reported lint issues are resolved or intentionally accounted for.

Written by the indexing model from the issue text.