devopscodepro
Language
Productized services
Infrastructure AuditRisks, costs and quick wins — mapped in two weeks.Cloud Migration & IaCTerraform, CI/CD and a zero-downtime cutover.Monitoring-as-a-ServiceAlerting, on-call and incident response.Fractional DevOpsA senior engineer in your team, part-time.
Not sure where to start? The audit answers that.Request a quote →
server-assisted · every other tool runs in your browserAll 29 tools →
Infrastructure AuditCloud Migration & IaCMonitoring-as-a-ServiceFractional DevOps
ContactLog in
Request a quote
Theme
Language
Runs entirely in your browser — nothing leaves this page.

K8s manifest validator

Validate Kubernetes YAML: structure, removed API versions, security context, resources, probes and inline secrets.

or paste YAML below
parsed locally — manifests never leave your browserstructural and production-readiness checks; this is not full OpenAPI schema validation against a cluster version
These tools show symptoms. A full infrastructure audit finds the causes — risks, cost leaks and single points of failure, mapped in two weeks.
Request a quote →

What this validator covers

Manifests — single or multi-document — are parsed and checked in two passes: structure first (apiVersion, kind, name, YAML syntax with line numbers, API versions Kubernetes has removed), then thirty production-readiness rules across security context, host namespaces, capabilities, resource requests and limits, probes, image pinning and inline Secrets.

It is readiness linting, not OpenAPI schema validation against a specific cluster version — that would need the per-version schemas, which is a different tool. Manifests are parsed in your browser and never uploaded.

Why does it insist on resource requests?

Without requests the scheduler has no basis for placement and the pod lands in BestEffort QoS, which is the first thing evicted when a node comes under pressure. Requests are how you tell the scheduler what the workload needs; limits are how you stop it harming its neighbours.

Do I really need both liveness and readiness probes?

They answer different questions. Readiness decides whether traffic is sent to the pod — without it, every rollout drops requests into a container that is still starting. Liveness decides whether to restart a process that is running but stuck. Neither substitutes for the other.

It flags my Secret. What should I do instead?

Values in a Secret manifest are base64, not encrypted — committing one is publishing it. Use a sealed-secrets controller, an external secrets operator, or your cloud's secret manager, and keep only the reference in git.

Does it understand CRDs and Kustomize?

Custom resources get the structural checks only, since their schema is defined by the operator that installs them. Kustomize overlays are not rendered — the file is read as given, so validate the output of kustomize build rather than the overlay itself.

Related tools: YAML diff, Dockerfile analyzer and Kubernetes CVEs.