Kubernetes manifest editor and resource graph

Edit a multi-document bundle and see each object’s identity, how the objects reference each other, and which references point at objects you have not supplied.

Target KubernetesSchema pack 2026.10.0, self-authored. What it covers

Source

Opening local draft…

# Synthetic example: web app, database and a read-only ServiceAccount
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: app
  labels:
    app.kubernetes.io/name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: web
  template:
    metadata:
      labels:
        app.kubernetes.io/name: web
    spec:
      automountServiceAccountToken: false
      containers:
        - name: web
          image: registry.example.com/app/web:1.0.0
          ports:
            - name: http
              containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              memory: 256Mi
          readinessProbe:
            httpGet:
              path: /ready
              port: http
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 20
            initialDelaySeconds: 10
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            capabilities:
              drop: ["ALL"]
            seccompProfile:
              type: RuntimeDefault
---
apiVersion: v1
kind: Service
metadata:
  name: web
  namespace: app
spec:
  selector:
    app.kubernetes.io/name: web
  ports:
    - name: http
      port: 80
      targetPort: http
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web
  namespace: app
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: web
---
apiVersion: v1
kind: Service
metadata:
  name: db
  namespace: data
spec:
  clusterIP: None
  selector:
    app.kubernetes.io/name: db
  ports:
    - name: tcp
      port: 5432
      targetPort: tcp
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: db
  namespace: data
spec:
  serviceName: db
  replicas: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: db
  template:
    metadata:
      labels:
        app.kubernetes.io/name: db
    spec:
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 999
      containers:
        - name: db
          image: registry.example.com/data/db:16.4
          ports:
            - name: tcp
              containerPort: 5432
          resources:
            requests:
              cpu: 500m
              memory: 1Gi
            limits:
              memory: 1Gi
          readinessProbe:
            tcpSocket:
              port: tcp
          volumeMounts:
            - name: data
              mountPath: /var/lib/data
          securityContext:
            allowPrivilegeEscalation: false
            runAsNonRoot: true
            runAsUser: 999
            capabilities:
              drop: ["ALL"]
            seccompProfile:
              type: RuntimeDefault
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 20Gi
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: reader
  namespace: app
automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: app
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: reader-pod-reader
  namespace: app
subjects:
  - kind: ServiceAccount
    name: reader
    namespace: app
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-reader
---
# references a ConfigMap that is not supplied
apiVersion: batch/v1
kind: Job
metadata:
  name: seed
  namespace: data
spec:
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: seed
          image: registry.example.com/data/seed:1.0.0
          envFrom:
            - configMapRef:
                name: seed-config

Analysing… Policy profile

Analysing…

Identity first

Each document is identified by group, kind, namespace and name. Two documents with the same identity are a conflict, because applying both lets the later one silently win. A missing namespace is shown as assumed, since the real namespace is decided when you apply.

Reading the graph

Edges are drawn only from the supplied documents: Service selectors to pod templates, Ingress backends to Services, volumes and env references to ConfigMaps, Secrets and claims, bindings to roles, autoscalers to their targets. A dashed node is referenced but not supplied. That usually means the input is incomplete, not that the cluster is broken. The same data is available as a table for keyboard and screen-reader use.

Questions

Are comments and key order preserved?

Your text is never reformatted. Edits you type stay as typed. Transforms such as redaction and migration rewrite only the targeted fields and keep comments elsewhere.

Can I open several files?

Yes. Import multiple .yaml or .yml files and they are joined into one bundle with --- separators. Drag-and-drop works too.

What does a dashed node mean?

Another object refers to it, but it is not in your input. It might exist in the cluster or in another file, so this is reported as information, not as an error.

Other tools

YAML validatorValidate Kubernetes YAML against a versioned schema pack with separate YAML, schema, cross-object and policy findings.Deployment generatorGenerate a Deployment with Service, Ingress, PodDisruptionBudget and HPA: named ports, probes, requests and a hardened security context, validated as you type.Service generatorBuild ClusterIP, NodePort, LoadBalancer, headless and ExternalName Services, and check selector and targetPort mapping against a pasted workload.Resource calculatorExact Kubernetes quantity parsing (100m vs 100Mi), unit conversion, and requests/limits totals that account for init containers, native sidecars, replicas, rollout surge and overhead.RBAC analyzerInspect Roles, ClusterRoles and bindings offline: subject-to-permission matrix, aggregated-role handling, risky verbs, and "can this subject do X" checks scoped to the supplied rules.NetworkPolicy explainerExplain which pods each NetworkPolicy isolates and test traffic scenarios between pods, namespaces and IPs with additive allow-list reasoning.Probe builderBuild liveness, readiness and startup probes and see their timing: when the first check runs, how long until a failure triggers action, and what that action is.Manifest diffCompare two Kubernetes bundles by text or by object: objects matched by identity, list items matched by name, and status or server fields ignored only when you choose.API deprecationsFind Kubernetes APIs removed or deprecated for your target version, using a dated pack, and preview field-aware migrations with the semantic changes you need to review.CronJob schedulePreview the next runs of a Kubernetes CronJob schedule in its spec.timeZone, explain concurrency and deadline settings, and catch TZ= in the schedule string.Secret encoderEncode and decode Kubernetes Secret values locally, build Secret YAML with data or stringData, and inspect an existing Secret with values masked by default.Redact exportFind Secret data, tokens, credential-bearing env values and last-applied annotations in Kubernetes YAML, review each one, and export a redacted copy.TemplatesSynthetic Kubernetes templates with safe defaults — web app, StatefulSet, CronJob, NetworkPolicy, RBAC, HPA, sidecar — each tested against the schema pack for every supported version.