Env & Kubernetes ConfigMap/Secret value suggester

Pull all ConfigMaps & Secrets from Kubernetes into Sample Data

You do not need to decode Base64 values or merge files manually. Click ☸ Fetch from K8s inside the tool above to auto-detect your OS and namespace, or copy the single command for your OS below and paste the result into Sample data:

• macOS (pipes directly to clipboard):

  kubectl get configmap,secret -n brand -o yaml | pbcopy

• Linux (X11 with xclip, or replace with wl-copy on Wayland):

  kubectl get configmap,secret -n brand -o yaml | xclip -selection clipboard

• Windows (PowerShell):

  kubectl get configmap,secret -n brand -o yaml | Set-Clipboard

If kubectl, jq, or a clipboard helper is not installed yet:

• macOS (Homebrew):

  brew install kubectl jq

• Debian / Ubuntu:

  sudo apt-get update && sudo apt-get install -y kubectl jq xclip

• RHEL / Fedora:

  sudo dnf install -y kubernetes-client jq xclip

• Alpine:

  apk add kubectl jq xclip

• Windows (winget):

  winget install -e --id Kubernetes.kubectl && winget install -e --id jqlang.jq

When you paste a Kubernetes YAML output, this tool automatically:

• Reads kind: List, ConfigMap.data, Secret.data (auto-decoded from Base64), and Secret.stringData.
• Detects metadata.namespace from the pasted manifest and offers a one-click button to rename or switch the current environment tab.
• Skips noisy cluster/system objects such as kubernetes.io/service-account-token, helm.sh/release.v1, kubernetes.io/tls, and kube-root-ca.crt.
• Flags keys coming from a Secret (or keys matching sensitive patterns like PASSWORD, SECRET, TOKEN, API_KEY, CONNSTR) so they are masked on screen by default.

How suggestions are ranked (5 tiers)

1. Exact key match: normalizes key names (lowercased and stripped of - _ . :, so DB_HOST, db.host, and Db__Host match).
2. Fuzzy key + value shape match: splits keys into words across _ . - : __ and camelCase, canonicalizes common synonyms (db|database, host|hostname|server|addr, url|uri|dsn|endpoint|connection, pass|password|secret…), and combines Weighted Dice (IDF) key similarity (70%) with value shape compatibility (30%: URL scheme, hostname, IP, host:port, connection string, number/port, boolean). Assigned 1-to-1 with a dropdown of alternative candidates when available.
3. Token substitution: detects which saved environment overlaps most with your input, learns token-level replacement rules across shared keys (e.g. dev-db.internal → prod-db.internal learns dev→prod, plus environment name rules), and rewrites tokens in new keys.
4. Unchanged: if a key has the exact same value across your saved environments (e.g. LOG_FORMAT=json), keeps it as-is.
5. Needs review: remaining keys keep their input value and are highlighted in amber so you can verify them before copying.

Secret masking & local storage privacy

• Mask sensitive values (enabled by default): Sensitive keys are masked as •••••••• in both the Input value and Suggested value columns, with a per-row Show / Hide toggle. The Sample data box also blurs automatically when unfocused if Secrets are present.
• 3 storage modes: choose between Save all (localStorage), Scrub secrets on save (replaces sensitive values with <secret> before writing to disk), or Session only (RAM) so nothing touches browser storage.