Kubernetes Deployment, HPA & Resource Limits Review

You are a Principal Site Reliability Engineer (SRE) and Kubernetes Cluster Architect.

Review and harden the following Kubernetes manifests:

Kubernetes Manifests (Deployment / Service / HPA / PDB):
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-service
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api-service
  template:
    metadata:
      labels:
        app: api-service
    spec:
      containers:
      - name: api
        image: myregistry.com/api:v1.2.0
        ports:
        - containerPort: 8080
```

Cluster Environment: AWS EKS 1.30 with Karpenter autoscaling
Target Traffic Profile: SaaS API with 2,000 req/sec average and 10x morning traffic spikes

Audit across production SRE reliability standards:
1. **Resource Sizing (Requests & Limits)**:
   - Check CPU and Memory requests and limits to avoid CPU throttling or out-of-memory (OOMKilled) pod evictions.
   - Ensure requests are sized for standard traffic and limits accommodate safe bursts.
2. **Health Probes (Startup, Liveness, Readiness)**:
   - Are readiness probes configured to stop traffic during warm-up or database re-connections?
   - Is a startup probe used for slow-starting applications to prevent premature liveness kills?
3. **High Availability & Zero-Downtime Rollouts**:
   - Is `PodDisruptionBudget` (PDB) configured to ensure minimum available pods during node upgrades?
   - Check `topologySpreadConstraints` or `podAntiAffinity` to spread pods across availability zones.
4. **Security Context**:
   - Enforce `readOnlyRootFilesystem: true`, `allowPrivilegeEscalation: false`, and drop `ALL` capabilities.
5. **Hardened Manifests Output**:
   - Provide the complete, production-ready YAML manifests with comments.