Kubernetes Deployment generator

Fill in the workload. The YAML, the validation result and the matching kubectl commands update together.

Target KubernetesSchema pack 2026.10.0, self-authored. What it covers

Generated YAML

Passes pack schemaKubernetes 1.31, pack 2026.10.0

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: shop
  labels: &a1
    app.kubernetes.io/name: web
spec:
  replicas: 3
  selector:
    matchLabels: *a1
  template:
    metadata:
      labels: *a1
    spec:
      containers:
        - name: web
          image: registry.example.com/shop/web:1.4.2
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 10
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 20
            failureThreshold: 3
            initialDelaySeconds: 10
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            capabilities:
              drop:
                - ALL
            seccompProfile:
              type: RuntimeDefault
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
---
apiVersion: v1
kind: Service
metadata:
  name: web
  namespace: shop
  labels: &a1
    app.kubernetes.io/name: web
spec:
  type: ClusterIP
  selector: *a1
  ports:
    - name: http
      port: 80
      targetPort: http
      protocol: TCP
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web
  namespace: shop
  labels: &a1
    app.kubernetes.io/name: web
spec:
  maxUnavailable: 1
  selector:
    matchLabels: *a1

kubectl commands (not executed)

# Preview what would change (contacts your cluster when you run it)
kubectl --context '<CONTEXT>' diff -f web.yaml

# Server-side dry run
kubectl --context '<CONTEXT>' apply --dry-run=server -f web.yaml

# Apply
kubectl --context '<CONTEXT>' apply -f web.yaml

# Wait for Deployment/web to roll out
kubectl --context '<CONTEXT>' -n shop rollout status deployment/web --timeout=5m

Safe defaults, visible assumptions

The generator uses one label set for the selector and the template so they cannot drift apart. It names the container port and points probes and the Service targetPort at that name. With hardening on, it drops all capabilities, disallows privilege escalation, runs as non-root with RuntimeDefault seccomp, and turns off ServiceAccount token automount.

When an autoscaler is added, spec.replicas is left out of the Deployment so re-applying the manifest does not fight the HPA.

Questions

Which apiVersions does it use?

apps/v1, v1, networking.k8s.io/v1, policy/v1 and autoscaling/v2. All are served in every version the pack covers (1.27 to 1.33).

Why is the Ingress class a placeholder?

Ingress behaviour depends on the controller installed in your cluster. The generator does not guess it. Replace <INGRESS_CLASS> with your IngressClass name.

Other tools

Manifest editorEdit multi-document Kubernetes YAML with per-document identity, duplicate detection, a relationship graph with an accessible table, and findings tied to source lines.YAML validatorValidate Kubernetes YAML against a versioned schema pack with separate YAML, schema, cross-object and policy findings.Service generatorBuild ClusterIP, NodePort, LoadBalancer, headless and ExternalName Services, and check selector and targetPort mapping against a pasted workload.Resource calculatorExact Kubernetes quantity parsing (100m vs 100Mi), unit conversion, and requests/limits totals that account for init containers, native sidecars, replicas, rollout surge and overhead.RBAC analyzerInspect Roles, ClusterRoles and bindings offline: subject-to-permission matrix, aggregated-role handling, risky verbs, and "can this subject do X" checks scoped to the supplied rules.NetworkPolicy explainerExplain which pods each NetworkPolicy isolates and test traffic scenarios between pods, namespaces and IPs with additive allow-list reasoning.Probe builderBuild liveness, readiness and startup probes and see their timing: when the first check runs, how long until a failure triggers action, and what that action is.Manifest diffCompare two Kubernetes bundles by text or by object: objects matched by identity, list items matched by name, and status or server fields ignored only when you choose.API deprecationsFind Kubernetes APIs removed or deprecated for your target version, using a dated pack, and preview field-aware migrations with the semantic changes you need to review.CronJob schedulePreview the next runs of a Kubernetes CronJob schedule in its spec.timeZone, explain concurrency and deadline settings, and catch TZ= in the schedule string.Secret encoderEncode and decode Kubernetes Secret values locally, build Secret YAML with data or stringData, and inspect an existing Secret with values masked by default.Redact exportFind Secret data, tokens, credential-bearing env values and last-applied annotations in Kubernetes YAML, review each one, and export a redacted copy.TemplatesSynthetic Kubernetes templates with safe defaults — web app, StatefulSet, CronJob, NetworkPolicy, RBAC, HPA, sidecar — each tested against the schema pack for every supported version.