Use this free online Kubernetes Manifest Generator directly in your browser. No signup required, no data leaves your device. Part of Utilier — a collection of 133+ developer utilities.
What is Kubernetes Manifest Generator & Validator (YAML)?
Kubernetes manifests are YAML configuration files that define how to deploy and manage applications on Kubernetes clusters. This tool generates manifest files for common resources — Deployment (app replicas), Service (networking), ConfigMap (configuration), Secret (credentials), Ingress (HTTP routing), PersistentVolumeClaim (storage), Pod, Namespace. Select resource type, configure replicas, images, ports, labels, and copy the YAML. Validates syntax, checks for security issues (running as root, missing resource limits), and suggests best practices (health checks, labels, namespaces).
Resource templates: Pre-configured manifests: Deployment (app with replicas), Service (ClusterIP, NodePort, LoadBalancer), ConfigMap (env vars, config files), Secret (passwords, API keys), Ingress (routing), PVC (storage), Pod, Namespace, Job, CronJob.
Configuration options: Set replicas, container image, ports, environment variables, resource limits (CPU, memory), labels, selectors, volumes, health checks (liveness, readiness).
YAML validation: Checks syntax errors, required fields, invalid API versions, missing labels/selectors. Ensures manifest is valid before applying to cluster.
Security checks: Warns about running as root (securityContext), missing resource limits (OOMKilled risk), privileged containers, exposed secrets in env vars.
Best practices: Suggests health checks (livenessProbe, readinessProbe), resource limits (requests, limits), labels (app, version, component), namespaces (isolation).
Why use Kubernetes manifest?
Writing Kubernetes manifests manually requires knowledge of API versions, field names, indentation, and best practices. This tool generates valid manifests automatically.
Avoid syntax errors: YAML is indentation-sensitive (spaces, not tabs). Missing fields, wrong API version, or incorrect nesting breaks manifests. Tool validates syntax.
Save time: No need to search Kubernetes docs for field names or examples. Tool generates production-ready manifests instantly.
Learn Kubernetes resources: See how Deployment, Service, ConfigMap, Ingress work together. Great for learning K8s architecture and manifest structure.
Security by default: Tool creates non-root users, sets resource limits, uses read-only file systems. Prevents common security issues.
Best practices built-in: Adds health checks, resource limits, labels, selectors automatically. Ensures production-ready configuration.
Multi-resource manifests: Generate multiple resources (Deployment + Service + ConfigMap) in one file. Use --- separator between resources.
When to use Kubernetes manifest
Use whenever you need to deploy applications to Kubernetes clusters.
Deploying web apps (Node.js, Python, Java) to Kubernetes with replicas and load balancing.
Creating Services to expose apps (ClusterIP for internal, LoadBalancer for external).
Managing configuration with ConfigMaps (env vars, config files) and Secrets (passwords, API keys).
Setting up Ingress for HTTP routing (domain-based routing, TLS termination).
Requesting persistent storage with PersistentVolumeClaims (databases, file storage).
Running scheduled jobs with CronJobs (backups, data processing, cleanups).
Learning Kubernetes by experimenting with manifests and deploying to minikube or kind.
Configure basic settings: Set name (my-app), namespace (default, production), labels (app: my-app, version: v1). Labels are key for selectors.
Set container details: Specify image (nginx:1.21, node:20-alpine), ports (80, 3000), command/args (optional), environment variables (from ConfigMap or inline).
Add resource limits (optional): Set CPU and memory requests (guaranteed resources) and limits (max resources). Example: requests: cpu 100m, memory 128Mi; limits: cpu 500m, memory 512Mi.
Configure health checks (optional): Add livenessProbe (restart if fails) and readinessProbe (remove from service if fails). HTTP GET, TCP, or exec command.
Validate manifest: Click Validate to check YAML syntax, API version, required fields, security issues (root user, missing limits).
Copy YAML: Click Copy to get the manifest. Save as deployment.yaml. Apply with kubectl apply -f deployment.yaml.
Key features
Resource templates: Deployment, Service, ConfigMap, Secret, Ingress, PVC, Pod, Namespace, Job, CronJob. Pre-configured with best practices.
Replicas and scaling: Set replica count (1-10+). Kubernetes maintains desired number of replicas (auto-restart failed pods).
Service types: ClusterIP (internal only), NodePort (expose on node port), LoadBalancer (cloud load balancer), ExternalName (DNS alias).
Health checks: LivenessProbe (restart if fails), ReadinessProbe (remove from service if fails). HTTP GET, TCP, or exec command.
ConfigMap and Secret: Store env vars, config files (ConfigMap), or credentials (Secret). Mount as env vars or files.
YAML validation: Checks syntax, API version, required fields, labels/selectors. Highlights errors before applying.
Common use cases
Deploy web app (3 replicas): Deployment with 3 replicas of nginx:1.21. Expose on port 80. Add livenessProbe (HTTP GET /) and resource limits (CPU 100m, memory 128Mi).
Expose app with Service: Create Service (type: LoadBalancer) to expose Deployment. Maps port 80 (service) to port 80 (container). Gets external IP from cloud.
Store config in ConfigMap: ConfigMap with env vars (DATABASE_URL, API_KEY). Reference in Deployment: envFrom: configMapRef: name: my-config. Separates config from code.
Manage secrets: Secret with base64-encoded credentials (password, token). Mount as env vars: valueFrom: secretKeyRef. Never commit secrets to git.
HTTP routing with Ingress: Ingress routes example.com/api to api-service, example.com/web to web-service. TLS termination with cert-manager.
Persistent storage (PVC): PersistentVolumeClaim for 10Gi storage. Mount to /data in container. Used for databases (PostgreSQL, MySQL) or file uploads.
Exposes nginx Deployment. type: LoadBalancer gets external IP from cloud (AWS ELB, GCP Load Balancer). Routes port 80 (service) to port 80 (container).
Routes example.com/ to nginx-service. Requires Ingress controller (nginx-ingress, traefik). Add TLS for HTTPS.
Technical reference
Kubernetes manifest structure and fields:
apiVersion
API version: apps/v1 (Deployment, StatefulSet), v1 (Service, Pod, ConfigMap, Secret), networking.k8s.io/v1 (Ingress). Specifies resource API version.
kind
Resource type: Deployment, Service, ConfigMap, Secret, Ingress, Pod, Namespace, Job, CronJob, PersistentVolumeClaim. Defines what this manifest creates.
metadata
Name, namespace, labels, annotations. Example: metadata: name: my-app namespace: production labels: app: my-app version: v1. Labels are key-value pairs for selection.
spec (Deployment)
replicas: 3 (number of pods), selector: matchLabels: app: my-app (which pods to manage), template: pod spec (image, ports, volumes). Defines desired state.
spec (Service)
type: ClusterIP/NodePort/LoadBalancer, selector: app: my-app (which pods to route to), ports: port: 80 targetPort: 80 (service port → container port).
spec (ConfigMap)
data: key-value pairs (DATABASE_URL: postgres://..., API_KEY: abc123). Or binaryData for binary files. Used for configuration.
spec (Secret)
data: base64-encoded key-value pairs (password: cGFzc3dvcmQ=). Or stringData for plain text (auto-encoded). Used for credentials.
resources (limits/requests)
requests: cpu: 100m memory: 128Mi (guaranteed), limits: cpu: 500m memory: 512Mi (max). Prevents OOMKilled or CPU throttling.
livenessProbe
Restarts container if fails. Example: httpGet: path: / port: 80 initialDelaySeconds: 30 periodSeconds: 10. Or exec: command: [cat, /tmp/healthy].
readinessProbe
Removes from service if fails (not ready to serve traffic). Same syntax as livenessProbe. Used during startup or maintenance.
Common mistakes to avoid
Missing resource limits (requests, limits), causing OOMKilled or CPU throttling
Why it happens: Without resource limits, pods can use unlimited memory or CPU. If pod uses too much memory, Kubernetes kills it (OOMKilled). If no limits, pods can starve other pods (noisy neighbor). Common in development manifests copied to production.
How to avoid it: Set resources: requests (guaranteed) and limits (max). Example: requests: cpu: 100m memory: 128Mi limits: cpu: 500m memory: 512Mi. Prevents OOMKilled and ensures fair resource allocation.
Running containers as root (no securityContext), creating security vulnerability
Why it happens: Default user is root (UID 0). If attacker exploits container, they have root access (can modify files, install malware). K8s best practices require non-root. CIS Kubernetes Benchmark mandates non-root.
How to avoid it: Add securityContext: runAsNonRoot: true runAsUser: 1000. Or use container images with non-root user (node:20-alpine uses node user). For read-only: readOnlyRootFilesystem: true.
Not setting livenessProbe and readinessProbe, missing failed pods
Why it happens: Without health checks, Kubernetes doesn't know if app is healthy. Failed app (crashed, deadlocked) stays in service, causing 50% error rate. livenessProbe restarts crashed pods, readinessProbe removes unhealthy pods from service.
How to avoid it: Add livenessProbe (httpGet: path: /health port: 80) and readinessProbe (httpGet: path: /ready port: 80). Or exec: command for non-HTTP apps. Essential for production.
Using :latest tag for images, causing non-reproducible deployments
Why it happens: :latest tag changes over time (nginx:latest today = 1.21, next month = 1.22). This breaks deployments when image updates introduce bugs. Rollbacks fail (can't recreate old state). Common for quick prototyping.
How to avoid it: Use specific version tags: nginx:1.21, node:20-alpine. Pin versions for reproducibility. Update manually when ready, not automatically via :latest.
Selector labels don't match pod labels, causing Service to route nowhere
Why it happens: Service selector: app: nginx must match Deployment pod labels: app: nginx. If mismatch (selector app: web, pod app: nginx), Service has no endpoints (no pods to route to). Common typo.
How to avoid it: Ensure Service selector matches Deployment pod template labels. Example: Deployment template: metadata: labels: app: nginx, Service selector: app: nginx. Use same labels.
Frequently asked questions
What is the difference between Deployment and Pod?
Pod = single instance of container(s). Deployment = manages multiple replicas of pods (auto-restart, scaling, rolling updates). Use Deployment for apps (not raw Pods). Deployment wraps Pods.
What is the difference between ClusterIP, NodePort, and LoadBalancer?
ClusterIP = internal only (accessible within cluster). NodePort = exposes on node IP:port (30000-32767). LoadBalancer = cloud load balancer with external IP (AWS ELB, GCP LB). Use LoadBalancer for production.
What is the difference between ConfigMap and Secret?
ConfigMap = plain text config (env vars, config files). Secret = base64-encoded credentials (passwords, API keys). Secrets are encrypted at rest (etcd encryption). Use Secret for sensitive data.
How do I apply a manifest to Kubernetes?
kubectl apply -f deployment.yaml. Creates or updates resources. Use kubectl delete -f deployment.yaml to remove. Or kubectl apply -k . for Kustomize.
What are resource requests and limits?
Requests = guaranteed resources (CPU, memory). Limits = max resources. Example: requests: cpu 100m memory 128Mi, limits: cpu 500m memory 512Mi. Prevents OOMKilled and ensures fair scheduling.
What is the difference between livenessProbe and readinessProbe?
livenessProbe = restarts container if fails (crashed, deadlocked). readinessProbe = removes from service if fails (not ready, startup). Both use HTTP GET, TCP, or exec. Essential for production.
How do I expose environment variables from ConfigMap or Secret?
ConfigMap: envFrom: configMapRef: name: my-config. Secret: env: - name: PASSWORD valueFrom: secretKeyRef: name: my-secret key: password. Or mount as volumes.