About K8sTools
K8sTools is an offline workbench for Kubernetes manifests. It parses and analyses YAML in your browser. It never connects to a cluster, runs kubectl, or uploads what you paste. The results are static analysis of the files you supply and are always labelled as such.
Installed packs
- Schema pack
- k8stools-core-schema 2026.10.0 (2026-10-30)
- Versions
- 1.27, 1.28, 1.29, 1.30, 1.31, 1.32, 1.33 (authored against 1.31)
- Kinds
- apps/v1 Deployment, apps/v1 StatefulSet, apps/v1 DaemonSet, v1 Pod, v1 Service, networking.k8s.io/v1 Ingress, v1 ConfigMap, v1 Secret, batch/v1 Job, batch/v1 CronJob, autoscaling/v2 HorizontalPodAutoscaler, autoscaling/v1 HorizontalPodAutoscaler, policy/v1 PodDisruptionBudget, networking.k8s.io/v1 NetworkPolicy, rbac.authorization.k8s.io/v1 Role, rbac.authorization.k8s.io/v1 ClusterRole, rbac.authorization.k8s.io/v1 RoleBinding, rbac.authorization.k8s.io/v1 ClusterRoleBinding, v1 ServiceAccount, v1 PersistentVolumeClaim, v1 Namespace
- Deprecations
- k8stools-api-removals 2026.10.0 (2026-10-30)
Self-authored partial structural schema, written by hand from the public Kubernetes API reference. Not generated from, and not a substitute for, the upstream OpenAPI v3 schema or server-side validation. Deployment, StatefulSet, DaemonSet, Pod, Service, Ingress, ConfigMap, Secret, Job, CronJob, HorizontalPodAutoscaler, PodDisruptionBudget, NetworkPolicy, Role, ClusterRole, RoleBinding, ClusterRoleBinding, ServiceAccount, PersistentVolumeClaim, Namespace. Affinity, topology spread, lifecycle hooks, most volume sources and HPA metrics are accepted without checking (partial). Hand-compiled from the public Kubernetes Deprecated API Migration Guide. Covers removals in 1.16 through 1.32 for the listed kinds.
Feature status
Mapped to requirement IDs in the product specification. NATIVE = local and deterministic; APPROX = local arithmetic or heuristics with stated assumptions; EXPLAIN = explanation only; UNSUPPORTED = not available.
| ID | Capability | Status | Label | Where | Notes |
|---|---|---|---|---|---|
| K8S-001 | Versioned Kubernetes packs | Partial | NATIVE | All pages | Self-authored partial schema pack 2026.10.0 for 1.27–1.33 and a dated removal pack. Not the upstream OpenAPI schema. Unknown kinds are never shown as valid. |
| K8S-002 | Multi-document YAML editor | Done | NATIVE | /manifest-editor | Source text is never reformatted; per-document identity, duplicate detection, line markers, file import, autosave and checkpoints. Plain textarea, no syntax colouring. |
| K8S-003 | Schema validator | Done | NATIVE | /yaml-validator | Eight-stage pipeline with separate YAML/schema/cross-object/policy findings. CRDs are syntax-only. |
| K8S-004 | Deployment/Pod builder | Done | NATIVE | /deployment-generator | Live validation of the output. |
| K8S-005 | Service/Ingress builder | Done | NATIVE | /service-generator | Ingress via the Deployment generator; the Ingress class is a placeholder because controller behaviour is not invented. |
| K8S-006 | ConfigMap/Secret helper | Done | NATIVE | /secret-encoder | Masked by default; not persisted. |
| K8S-007 | Resource quantity calculator | Done | NATIVE | /resource-calculator | Exact BigInt rationals. |
| K8S-008 | Requests/limits analyzer | Done | APPROX | /resource-calculator | Init/sidecar/overhead/replica/surge rules with listed assumptions. LimitRange defaults are unknown. |
| K8S-009 | Probe builder/checker | Done | APPROX | /probe-builder | Timing is arithmetic and ignores kubelet jitter. |
| K8S-010 | Selector/label matching | Done | NATIVE | Workbench, /service-generator | matchLabels and matchExpressions. |
| K8S-011 | Workload relationship graph | Done | NATIVE | /manifest-editor | SVG plus an accessible table; unsupplied targets are kept as dashed nodes. |
| K8S-012 | Port/service target inspector | Done | NATIVE | Workbench, /service-generator | |
| K8S-013 | API deprecation scanner | Done | NATIVE | /api-deprecations | Cannot know which APIs your cluster enables. |
| K8S-014 | Manifest diff | Done | NATIVE | /manifest-diff | Ignore options are explicit and off by default. |
| K8S-015 | Redaction/export | Done | APPROX | /redact | Heuristic detection with review and a self-check. |
| K8S-016 | Security-context checklist | Done | NATIVE | Workbench → Security | Baseline/restricted-inspired rules. Not Pod Security Admission and not a certification. |
| K8S-017 | RBAC explorer | Done | NATIVE | /rbac-analyzer | Aggregation resolved from supplied roles only, with a partial badge. |
| K8S-018 | NetworkPolicy explainer | Done | APPROX | /network-policy | IPv4 ipBlock only; CNI enforcement is unknown. |
| K8S-019 | Manifest templates | Done | NATIVE | /templates | Unit-tested against every pack version. |
| K8S-020 | Command generator | Done | NATIVE | Workbench → kubectl | Shell-quoted, placeholders, never executed. |
| K8S-021 | Documentation export | Done | NATIVE | Workbench → Export | Markdown and JSON with revision and pack versions. |
| K8S-022 | CRD schema import | Not done | UNSUPPORTED | — | Roadmap. CRDs stay syntax-only. |
| K8S-023 | Policy-as-code rules | Not done | UNSUPPORTED | — | Built-in rules can be toggled; user-authored policies are on the roadmap. |
| K8S-024 | PVC/storage planner | Partial | NATIVE | Validator | PVC schema and claim references only. |
| K8S-025 | Affinity/toleration explainer | Not done | UNSUPPORTED | — | Affinity is accepted without checks (partial coverage). |
| K8S-026 | HPA/PDB/rollout analysis | Partial | APPROX | /resource-calculator | Surge rounding, HPA max scenario, PDB selector checks. |
| K8S-027 | CronJob schedule preview | Done | APPROX | /cronjob-calculator | Uses the browser time zone database. |
| K8S-028 | Environment overlay compare | Partial | NATIVE | /manifest-diff | Two-bundle comparison; no overlay provenance. |
| K8S-029 | Qualified Kustomize rendering | Not done | UNSUPPORTED | — | No qualified local implementation. |
| K8S-030 | Qualified Helm rendering | Not done | UNSUPPORTED | — | No qualified local implementation; lookup/plugins would be blocked. |
| K8S-031 | Migration assistant | Done | NATIVE | /api-deprecations | Field-aware patches with unresolved notes, never a text replace. |
| K8S-032 | Certificate metadata viewer | Not done | UNSUPPORTED | — | Roadmap. |
| K8S-033 | Local explanation model | Not done | UNSUPPORTED | — | R3. |
| K8S-034 | Offline assessment bundle | Partial | NATIVE | Workbench → Export | Report export; no signed bundle. |
| K8S-035 | Live cluster validation/health | Excluded | UNSUPPORTED | — | Never inferred from static files. |
| K8S-036 | Registry CVE freshness | Excluded | UNSUPPORTED | — | Requires external services. |
| K8S-103 | NetworkPolicy scenario tests | Done | APPROX | /network-policy | |
| K8S-104 | ServiceAccount token review | Partial | NATIVE | Security rules | automountServiceAccountToken check. |
| K8S-105 | Image-reference hygiene | Done | NATIVE | Security rules | No registry contact. |
| K8S-106 | Volume-mount consistency | Done | NATIVE | Validator | Missing volumes, path overlaps, claim refs. |
| K8S-107 | Env/config dependency matrix | Partial | NATIVE | Graph + findings | Missing keys flagged; no matrix view. |
| K8S-108 | Job retry/completion planning | Partial | EXPLAIN | /cronjob-calculator | Explanations only. |
| K8S-109 | Rolling update worksheet | Partial | APPROX | /resource-calculator | Surge/unavailable rounding. |
| K8S-111 | Ownership-field review | Partial | NATIVE | Validator + diff | Server fields flagged; diff can ignore them explicitly. |
All tools
WorkbenchValidate, explain and prepare multi-document Kubernetes YAML in your browser.Manifest editorEdit multi-document Kubernetes YAML with per-document identity, duplicate detection, a relationship graph with an accessible table, and findings tied to source lines.YAML validatorValidate Kubernetes YAML against a versioned schema pack with separate YAML, schema, cross-object and policy findings.Deployment generatorGenerate a Deployment with Service, Ingress, PodDisruptionBudget and HPA: named ports, probes, requests and a hardened security context, validated as you type.Service generatorBuild ClusterIP, NodePort, LoadBalancer, headless and ExternalName Services, and check selector and targetPort mapping against a pasted workload.Resource calculatorExact Kubernetes quantity parsing (100m vs 100Mi), unit conversion, and requests/limits totals that account for init containers, native sidecars, replicas, rollout surge and overhead.RBAC analyzerInspect Roles, ClusterRoles and bindings offline: subject-to-permission matrix, aggregated-role handling, risky verbs, and "can this subject do X" checks scoped to the supplied rules.NetworkPolicy explainerExplain which pods each NetworkPolicy isolates and test traffic scenarios between pods, namespaces and IPs with additive allow-list reasoning.Probe builderBuild liveness, readiness and startup probes and see their timing: when the first check runs, how long until a failure triggers action, and what that action is.Manifest diffCompare two Kubernetes bundles by text or by object: objects matched by identity, list items matched by name, and status or server fields ignored only when you choose.API deprecationsFind Kubernetes APIs removed or deprecated for your target version, using a dated pack, and preview field-aware migrations with the semantic changes you need to review.CronJob schedulePreview the next runs of a Kubernetes CronJob schedule in its spec.timeZone, explain concurrency and deadline settings, and catch TZ= in the schedule string.Secret encoderEncode and decode Kubernetes Secret values locally, build Secret YAML with data or stringData, and inspect an existing Secret with values masked by default.Redact exportFind Secret data, tokens, credential-bearing env values and last-applied annotations in Kubernetes YAML, review each one, and export a redacted copy.TemplatesSynthetic Kubernetes templates with safe defaults — web app, StatefulSet, CronJob, NetworkPolicy, RBAC, HPA, sidecar — each tested against the schema pack for every supported version.
Your local data
Editors autosave to IndexedDB in this browser so a reload does not lose work. The Secret encoder and the redaction tool never save. Browser storage is not a backup and not encryption.
Known limits
- Input is limited to 10 MiB, 2,000 documents and 100 YAML alias expansions per document.
- Analysis runs in a Web Worker and is cancelled after 15 seconds.
- No syntax colouring; the editor is a plain text area so screen readers and IME input behave predictably.
- Helm and Kustomize rendering, CRD schema import and custom policies are not available.