Kubernetes YAML validator

The example has mistakes on purpose: a quoted replica count, a selector that misses its template, 100m of memory, a removed Ingress API and a custom resource with no schema.

Target KubernetesSchema pack 2026.10.0, self-authored. What it covers

Source

Opening local draft…

# Synthetic example with deliberate mistakes
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: demo
spec:
  replicas: "2"
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api-server
    spec:
      containers:
        - name: api
          image: example/api
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 500m
              memory: 100m
            limits:
              cpu: 250m
          livenessProbe:
            httpGet:
              path: /healthz
              port: "8080"
          imagePullPolicy: IfNotPresnt
---
apiVersion: v1
kind: Service
metadata:
  name: api
  namespace: demo
spec:
  selector:
    app: api-server
  ports:
    - port: 80
      targetPort: web
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: api
  namespace: demo
spec:
  backend:
    serviceName: api
    servicePort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: api
  namespace: demo
spec:
  ports:
    - port: 8080
---
apiVersion: monitoring.example.io/v1
kind: ServiceMonitor
metadata:
  name: api
  namespace: demo
spec:
  endpoints:
    - port: web

Analysing… Policy profile

Analysing…

Findings are layered

YAML syntax errors, schema errors, cross-object problems and policy warnings are kept apart, because each means something different. A schema error is something the API server would reject. A cross-object warning is about how your objects fit together. A policy warning is a recommendation you can switch off.

Click any finding to jump to the line in the editor. Positions are UTF-16 offsets into the text you pasted, shown as line and column.

Common mistakes it catches

Quoted integers ("3"), unquoted values that must be strings, enum typos such as IfNotPresnt, unknown fields that strict field validation rejects, selector and template label mismatches, requests above limits, memory written in millibytes (100m), numeric ports quoted into port names, duplicate container or port names, missing volume definitions, and Job templates that keep the default restartPolicy.

Questions

Why is my custom resource only "syntax only"?

No schema for it is installed in this tool, so only YAML syntax was checked. CRD schema import is on the roadmap. Until then the tool will not claim the resource is valid.

Is an "unknown field" error real?

kubectl uses strict server-side field validation by default since 1.27, so the API server rejects unknown fields. If the pack is missing a real field, the finding says which field and pack version so you can report it.

Does passing mean the server will accept it?

No. Admission controllers, quotas, defaulting and policies in your cluster can still reject or mutate the object. Use the server-side dry-run command for that check.

Other tools

Manifest editorEdit multi-document Kubernetes YAML with per-document identity, duplicate detection, a relationship graph with an accessible table, and findings tied to source lines.Deployment generatorGenerate a Deployment with Service, Ingress, PodDisruptionBudget and HPA: named ports, probes, requests and a hardened security context, validated as you type.Service generatorBuild ClusterIP, NodePort, LoadBalancer, headless and ExternalName Services, and check selector and targetPort mapping against a pasted workload.Resource calculatorExact Kubernetes quantity parsing (100m vs 100Mi), unit conversion, and requests/limits totals that account for init containers, native sidecars, replicas, rollout surge and overhead.RBAC analyzerInspect Roles, ClusterRoles and bindings offline: subject-to-permission matrix, aggregated-role handling, risky verbs, and "can this subject do X" checks scoped to the supplied rules.NetworkPolicy explainerExplain which pods each NetworkPolicy isolates and test traffic scenarios between pods, namespaces and IPs with additive allow-list reasoning.Probe builderBuild liveness, readiness and startup probes and see their timing: when the first check runs, how long until a failure triggers action, and what that action is.Manifest diffCompare two Kubernetes bundles by text or by object: objects matched by identity, list items matched by name, and status or server fields ignored only when you choose.API deprecationsFind Kubernetes APIs removed or deprecated for your target version, using a dated pack, and preview field-aware migrations with the semantic changes you need to review.CronJob schedulePreview the next runs of a Kubernetes CronJob schedule in its spec.timeZone, explain concurrency and deadline settings, and catch TZ= in the schedule string.Secret encoderEncode and decode Kubernetes Secret values locally, build Secret YAML with data or stringData, and inspect an existing Secret with values masked by default.Redact exportFind Secret data, tokens, credential-bearing env values and last-applied annotations in Kubernetes YAML, review each one, and export a redacted copy.TemplatesSynthetic Kubernetes templates with safe defaults — web app, StatefulSet, CronJob, NetworkPolicy, RBAC, HPA, sidecar — each tested against the schema pack for every supported version.