What this validator does
Kubernetes manifests look like normal YAML, but the real validation lives inside the cluster: `kubectl apply` accepts a file and only later, after the API server resolves it against the live schema and admission controllers, you find out something is wrong. By then you might have a misconfigured Deployment running in production with no liveness probe, no resource limits, and a Service that does not actually route to its pods because the label selector does not match.
This tool catches the top 30 mistakes before you apply. Paste any K8s manifest, multi-document files with `---` separators included. The validator parses each document, detects the kind, and runs hand-written checks: missing `apiVersion` or `metadata.name`, Service `targetPort` that does not exist on the pod, Deployment selector that does not match the pod labels, `privileged: true` containers, `:latest` tags, missing resource limits and probes, Ingress on a deprecated API version, PVCs without storage size.
Everything runs in your browser. No upload, no kubectl, no cluster contact. The validator does not pull live CRD schemas (those live in your specific cluster), so custom resources show as info only.
How to use it
- Pick a sample at the top to see how the output looks, or paste your own YAML into the input panel. The validator handles multi-document files with `---` separators.
- Read the error / warning / info counts on the right. Errors mean the manifest will be rejected by the API server or behave broken (missing fields, mismatched selectors, invalid HPA). Warnings are best-practice violations (`:latest` tag, no resource limits, `privileged: true`). Info items are suggestions.
- Each issue lists the kind, the resource name, the document index (which manifest in a multi-doc file), the message, and a fix hint.
- Common fixes covered: add liveness/readiness probes, set resource requests and limits, remove hostPort, replace `:latest` with a pinned tag, align selector matchLabels with template metadata.labels, set HPA scaleTargetRef and a valid min/max replica range.
- For Services, the validator cross-checks that the `targetPort` actually exists as a `containerPort` on the pod selected by `spec.selector`. This catches the classic mistake of a Service that quietly routes to nothing.
- When the input is empty or YAML parsing fails, you get a parse error with the line number from js-yaml. Fix that first and the rest of the checks light up.
- Click Copy to put the manifest in your clipboard, then drop it into `kubectl apply -f -` to actually deploy. The validator never sends your YAML anywhere.
When this is useful
Seven concrete situations where catching K8s mistakes before kubectl apply saves real downtime:
- First time touching K8s. The official docs are huge and you do not yet have intuition for which fields are mandatory. The validator flags missing `apiVersion`, `kind`, `metadata.name` immediately and gives a fix hint for each.
- Service that connects to nothing. The classic mistake: Service selector says `app: web`, Deployment template labels say `app: api`. K8s creates the Service, the Service has no endpoints, traffic 503s. The validator says exactly which keys do not match.
- Pre-commit gate for K8s repos. Plug the validator output check into your review process. PRs that introduce `privileged: true`, `:latest`, missing limits, missing probes get flagged before merge.
- GitOps repo health check. A repo with hundreds of manifests is hard to audit by eye. Paste a file, see all issues at once. Repeat per file or wire it into CI by hand.
- Migration from extensions/v1beta1 Ingress to networking.k8s.io/v1. The validator flags the old API version with a one-line fix. Saves a deploy that 404s the next time the cluster upgrades.
- CronJob without limits running on a small node. A nightly backup with no memory limit can OOM the node. The validator warns about every container missing limits.
- HPA misconfigured to scale only between 1 and 1. The check catches `minReplicas >= maxReplicas` (which is invalid) and missing `scaleTargetRef` (which makes the HPA do nothing).