Kubernetes manifest templates

Start from a template that already passes the schema pack. Every template is checked by the test suite against each version it claims to support.

Target KubernetesSchema pack 2026.10.0, self-authored. What it covers

tested 1.27–1.33
Deployment with probes, requests, hardened security context, Service and PodDisruptionBudget.
Deployment, Service, PodDisruptionBudget
tested 1.27–1.33
Headless Service, StatefulSet with volumeClaimTemplates and ordered startup.
Service, StatefulSet
tested 1.27–1.33
Nightly batch job with concurrency guard, deadlines and history limits.
CronJob
tested 1.27–1.33
Configuration split between a ConfigMap and a Secret (placeholder values, stringData).
ConfigMap, Secret
tested 1.27–1.33
HorizontalPodAutoscaler (autoscaling/v2) targeting 70% CPU with a scale-down window.
HorizontalPodAutoscaler
tested 1.27–1.33
Namespace default-deny plus explicit ingress from the ingress controller namespace and DNS egress.
NetworkPolicy
tested 1.27–1.33
ServiceAccount with a namespaced Role that can read pods and logs only.
ServiceAccount, Role, RoleBinding
tested 1.27–1.33
Namespace labelled for Pod Security Admission "restricted" enforcement.
Namespace
tested 1.29–1.33
Pod with an init-container sidecar (restartPolicy: Always) that starts before and outlives the app.
Pod
tested 1.27–1.33
A ReadWriteOnce claim; actual provisioning depends on your StorageClass.
PersistentVolumeClaim

Stateless web app

Passes pack schemaKubernetes 1.31, pack 2026.10.0

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  namespace: app
  labels:
    app.kubernetes.io/name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: web
  template:
    metadata:
      labels:
        app.kubernetes.io/name: web
    spec:
      automountServiceAccountToken: false
      containers:
        - name: web
          image: registry.example.com/app/web:1.0.0
          ports:
            - name: http
              containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              memory: 256Mi
          readinessProbe:
            httpGet:
              path: /ready
              port: http
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 20
            initialDelaySeconds: 10
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            capabilities:
              drop: ["ALL"]
            seccompProfile:
              type: RuntimeDefault
---
apiVersion: v1
kind: Service
metadata:
  name: web
  namespace: app
spec:
  selector:
    app.kubernetes.io/name: web
  ports:
    - name: http
      port: 80
      targetPort: http
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web
  namespace: app
spec:
  maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: web

What "tested" means

Each template is parsed and validated against the self-authored schema pack for every version from its minimum up to 1.33, and must produce no schema errors or warnings. That proves it is consistent with the pack, not that your cluster’s admission policies will accept it. Placeholders such as <STORAGE_CLASS> mark values you must decide.

Questions

Can I use these in production?

They are starting points with conservative defaults. Review images, resources, probes and policies for your workload before deploying.

Other tools

Manifest editorEdit multi-document Kubernetes YAML with per-document identity, duplicate detection, a relationship graph with an accessible table, and findings tied to source lines.YAML validatorValidate Kubernetes YAML against a versioned schema pack with separate YAML, schema, cross-object and policy findings.Deployment generatorGenerate a Deployment with Service, Ingress, PodDisruptionBudget and HPA: named ports, probes, requests and a hardened security context, validated as you type.Service generatorBuild ClusterIP, NodePort, LoadBalancer, headless and ExternalName Services, and check selector and targetPort mapping against a pasted workload.Resource calculatorExact Kubernetes quantity parsing (100m vs 100Mi), unit conversion, and requests/limits totals that account for init containers, native sidecars, replicas, rollout surge and overhead.RBAC analyzerInspect Roles, ClusterRoles and bindings offline: subject-to-permission matrix, aggregated-role handling, risky verbs, and "can this subject do X" checks scoped to the supplied rules.NetworkPolicy explainerExplain which pods each NetworkPolicy isolates and test traffic scenarios between pods, namespaces and IPs with additive allow-list reasoning.Probe builderBuild liveness, readiness and startup probes and see their timing: when the first check runs, how long until a failure triggers action, and what that action is.Manifest diffCompare two Kubernetes bundles by text or by object: objects matched by identity, list items matched by name, and status or server fields ignored only when you choose.API deprecationsFind Kubernetes APIs removed or deprecated for your target version, using a dated pack, and preview field-aware migrations with the semantic changes you need to review.CronJob schedulePreview the next runs of a Kubernetes CronJob schedule in its spec.timeZone, explain concurrency and deadline settings, and catch TZ= in the schedule string.Secret encoderEncode and decode Kubernetes Secret values locally, build Secret YAML with data or stringData, and inspect an existing Secret with values masked by default.Redact exportFind Secret data, tokens, credential-bearing env values and last-applied annotations in Kubernetes YAML, review each one, and export a redacted copy.