Infrastructure / BROWSER-ONLY UTILITY
Kubernetes Manifest Reviewer
Review the resource settings before applying them to a cluster. The file describes what you intend to run; cluster defaults and admission policy may change the final workload.
Choose a rendered manifest file or paste its YAML. Up to 30 documents and 200 resources are accepted. Helm templates and YAML aliases are unsupported; remove Secret values first. Limit: 100,000 characters.
Loading local tool code...
Input stays in this tab. No upload, AI call, analytics or ads. Reset clears the workspace. Clipboard copies and downloaded files remain under your control.
Result
Technical details (optional)
Review the result before sharing. It may still contain personal or confidential information.
Follow the PodSpec into its template
Pod, Deployment, StatefulSet, DaemonSet, ReplicaSet, ReplicationController, Job and CronJob layouts are recognised. Normal, init and ephemeral containers are reviewed. Pod-level runAsNonRoot, runAsUser and seccomp settings are inherited unless the container overrides them. Unknown custom kinds are counted and reported as unreviewed rather than interpreted as ordinary workloads.
Security controls depend on the operating system
Linux capability, seccomp, privilege-escalation, UID and read-only-root recommendations are skipped for an explicit Windows PodSpec. Incompatible Linux fields receive a separate error. runAsNonRoot still matters on Windows because it rejects ContainerAdministrator. Windows HostProcess gets a host-access note. This is not a version-pinned Baseline or Restricted conformance check.
Host and credential exposure deserve context
Host namespaces, hostPath volumes, host ports, inline credential-like environment values and automatic service-account token mounting are reviewed separately. Resource requests and limits get operational notes, not a Pod Security Standards compliance score. Secret objects are identified without displaying values; encoding a value as base64 does not encrypt it.
Resource declarations are not effective access
Wildcard rules in Roles and ClusterRoles are highlighted without following bindings to subjects. NodePort and LoadBalancer Services receive exposure notes without a network test. NetworkPolicy enforcement, CRDs, admission mutations, namespace defaults, image content and cluster policy remain outside this review. No kubectl command, cloud API or cluster connection is used.
References
- Pod Security Standards, Kubernetes
- Security context configuration, Kubernetes
- RBAC guidance, Kubernetes
Documentation reviewed: . Rule results describe the supplied text, not a live application test.
Useful next steps
- Dockerfile Static Reviewer
- Docker Compose Reviewer
- AWS IAM Policy Reviewer
- Practical guides and coding projects
Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.