K8sTools

Redact Kubernetes YAML

Paste a cluster export. Each sensitive-looking field is listed with its reason and a masked preview. Untick false positives, then export.

This page keeps the input in memory only. Nothing is autosaved, uploaded or logged. Detection is heuristic and has false positives and false negatives, so review the list and the preview.

Input (not saved)

7 field(s) to review

Redacted preview

Self-check: 0 of 7 selected values remain
1# Synthetic cluster export containing fake secrets
2apiVersion: v1
3kind: Secret
4metadata:
5 name: web-db
6 namespace: shop
7 annotations:
− 8 kubectl.kubernetes.io/last-applied-configuration: '{"apiVersion":"v1","data":{"password":"aHVudGVyMg=="},"kind":"Secret"}'
+ 8 kubectl.kubernetes.io/last-applied-configuration: "<REDACTED:annotation>"
9type: Opaque
10data:
− 11 username: c2hvcA==
− 12 password: aHVudGVyMg==
+ 11 username: "<REDACTED:secret-data>"
+ 12 password: "<REDACTED:secret-data>"
13---
14apiVersion: v1
15kind: ConfigMap
16metadata:
17 name: web-config
18 namespace: shop
19data:
20 LOG_LEVEL: info
− 21 API_TOKEN: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJleGFtcGxlLXVzZXIifQ.ZmFrZS1zaWduYXR1cmUtZm9yLWRlbW8
− 22 DATABASE_URL: postgres://shop:hunter2@db.example.internal:5432/shop
+ 21 API_TOKEN: "<REDACTED:config>"
+ 22 DATABASE_URL: "<REDACTED:config>"
23---
24apiVersion: apps/v1
25kind: Deployment
26metadata:
27 name: web
28 namespace: shop
29spec:
30 selector:
31 matchLabels: { app: web }
32 template:
33 metadata:
34 labels: { app: web }
35 spec:
36 containers:
37 - name: web
38 image: registry.example.com/shop/web:1.4.2
− 39 args: ["--api-key=AKIAIOSFODNN7EXAMPLE"]
+ 39 args: [ "<REDACTED:token-pattern>" ]
40 env:
41 - name: STRIPE_SECRET
− 42 value: sk-test0000000000000000000000fake
+ 42 value: "<REDACTED:env>"
43 - name: LOG_LEVEL
44 value: info
45

Only the selected scalar values are replaced with <REDACTED:category>. Names, hosts, registries and namespaces are not redacted automatically.

Detection has limits

Detection uses field knowledge (Secret data, env var names, the last-applied annotation) and token patterns (private keys, cloud access keys, JWTs, credentials embedded in URLs). It will miss secrets with unusual shapes and flag some harmless values, so review the preview before sharing.

Redaction rewrites only the selected scalar values and keeps comments and structure elsewhere. The original stays in the editor, and the redaction is a single step you can undo.

Questions

Why is last-applied-configuration flagged?

kubectl apply stores the full applied object in that annotation. For a Secret, that includes its data, so redacting the data field alone is not enough.

Is the redacted export safe to post publicly?

Only after you review it. Names, hostnames, image registries and namespaces can be sensitive too, and they are not redacted automatically.

Other tools

Manifest editorEdit multi-document Kubernetes YAML with per-document identity, duplicate detection, a relationship graph with an accessible table, and findings tied to source lines.YAML validatorValidate Kubernetes YAML against a versioned schema pack with separate YAML, schema, cross-object and policy findings.Deployment generatorGenerate a Deployment with Service, Ingress, PodDisruptionBudget and HPA: named ports, probes, requests and a hardened security context, validated as you type.Service generatorBuild ClusterIP, NodePort, LoadBalancer, headless and ExternalName Services, and check selector and targetPort mapping against a pasted workload.Resource calculatorExact Kubernetes quantity parsing (100m vs 100Mi), unit conversion, and requests/limits totals that account for init containers, native sidecars, replicas, rollout surge and overhead.RBAC analyzerInspect Roles, ClusterRoles and bindings offline: subject-to-permission matrix, aggregated-role handling, risky verbs, and "can this subject do X" checks scoped to the supplied rules.NetworkPolicy explainerExplain which pods each NetworkPolicy isolates and test traffic scenarios between pods, namespaces and IPs with additive allow-list reasoning.Probe builderBuild liveness, readiness and startup probes and see their timing: when the first check runs, how long until a failure triggers action, and what that action is.Manifest diffCompare two Kubernetes bundles by text or by object: objects matched by identity, list items matched by name, and status or server fields ignored only when you choose.API deprecationsFind Kubernetes APIs removed or deprecated for your target version, using a dated pack, and preview field-aware migrations with the semantic changes you need to review.CronJob schedulePreview the next runs of a Kubernetes CronJob schedule in its spec.timeZone, explain concurrency and deadline settings, and catch TZ= in the schedule string.Secret encoderEncode and decode Kubernetes Secret values locally, build Secret YAML with data or stringData, and inspect an existing Secret with values masked by default.TemplatesSynthetic Kubernetes templates with safe defaults — web app, StatefulSet, CronJob, NetworkPolicy, RBAC, HPA, sidecar — each tested against the schema pack for every supported version.