# Kubernetes Manifest Studio

Paste Deployment, Service or other manifests to list the resources and see which Deployment a Service's selector reaches. It flags removed apiVersions, latest or missing image tags, missing requests and limits, and risky securityContext settings, each with a line number. It does not fully validate the schema, so use it as a review aid before you apply anything to a cluster.

- URL: https://tools.itlibra.com/en/kubernetes-studio
- On-device・No upload
- Last updated: 2026-10-26

## How to use

1. Paste YAML, or drop a file (“Choose file” works too). “Try a sample” shows how it works.
2. Check the resource list for apiVersion, kind, name, namespace and labels. Deployment containers show image, ports, env names and resources.
3. Open “Issues” for a list ordered by severity. Removed APIs and Deployment selector mismatches are high; the rest are medium or low.
4. Use “Format” to save the YAML with aligned indentation. It is not formatted when there is a syntax error.

## Use cases

- Check for removed apiVersions such as extensions/v1beta1 before you apply to a cluster
- See which Deployment a Service selector reaches without tracing labels by hand
- Review Pod securityContext settings such as privileged and runAsNonRoot before publishing
- Look for passwords typed directly into env values in YAML generated by Helm or other tools

## What it does

### Findings from official removed APIs

Only the apiVersion and kind pairs listed in the Kubernetes Deprecated API Migration Guide are checked, with the release in which each was removed (1.16, 1.22, 1.25, 1.26, 1.29).

### Service to Deployment matching

Shows which Deployments a Service selector reaches, and flags selectors that match nothing and targetPorts that no container port matches.

### Pod Security checks

Checks privileged, hostNetwork and hostPath (baseline), and runAsNonRoot and allowPrivilegeEscalation (restricted), following the Pod Security Standards.

### Env values are kept out of the table and issues

Flags values in env that look like secrets (AWS-style keys, PEM keys) or names such as PASSWORD and TOKEN set directly. The table and issues show names only. The Format tab prints the YAML as it is, values included.

### Formatting with line-numbered issues

Keeps the --- document separators and key order while aligning indentation, so the output is easy to diff.


## Capability matrix

| Feature | Support | Notes |
| --- | --- | --- |
| Reading multiple documents and listing resources | Supported | — |
| Removed API detection (only the pairs in the official migration guide) | Partial | Pairs not in the list, and newly removed APIs, are not detected |
| Service selector and targetPort matching to Deployments | Supported | — |
| Pod Security checks (privileged, hostNetwork, hostPath, runAsNonRoot and more) | Partial | Only part of the baseline and restricted profiles |
| Latest tags, requests/limits and probes | Supported | Best-practice checks; Kubernetes does not require them |
| Full schema validation (every field name and type) | Not supported | Full schema validation is not performed |
| Applying to a cluster, comparing with live resources, running kubectl | Not supported | No network requests; kubectl is not run |
| Expanding Helm or Kustomize templates | Not supported | Paste the rendered YAML instead |

## Limits & notes

- Input is limited to 300,000 characters and 50 documents. Anything beyond is not read, and you are told.
- Full schema validation is not performed. A misspelled field or wrong type may not be flagged here, but the cluster may still reject it.
- Pod Security checks cover only part of the baseline and restricted profiles. The namespace-level Pod Security setting is not visible here.
- Findings follow the official documentation. Removal dates and recommendations depend on the Kubernetes version.

## Privacy & safety

Pasted YAML is processed only inside your browser. Nothing is sent to or stored on a server, and nothing is saved in the browser. Usage analytics never include content or file names.

## FAQ

### When was extensions/v1beta1 Deployment removed?

The official migration guide lists it as removed in Kubernetes 1.16. This page flags listed pairs together with the release in which they were removed.

### A Service does not reach my pods. What should I check?

Check that the Service selector matches the labels in the Deployment pod template, and that targetPort matches a container port. This page shows that matching.

### What happens without resources or probes?

The manifest can still apply, but without requests and limits the scheduler and resource controls have less to work with. This page flags them as best-practice items.

### If there are no findings, will it apply?

Not necessarily. Schema validation is not performed here, so also run a server-side dry run such as kubectl apply --dry-run=server.

### How should I supply secret values?

Do not write them in the manifest. Create a Secret and reference it with secretKeyRef. Note that Secret data is base64, which is encoding, not encryption.