Kubernetes manifest checker

What this checks

Required fields, selectors, image tags, resources, security context, probes, host namespaces, plain-text secrets and RBAC wildcards. When you paste several documents it also checks that Services select pods, target ports exist, Ingress backends exist, HPAs have requests to scale on and replicated workloads have a PodDisruptionBudget. For CI, run kubeconform for schema validation, kube-linter or Polaris for policy, and Pluto or kubent to find API versions your cluster no longer serves.

The Pod Security Standards line shows the strictest level each workload would pass: Privileged, Baseline or Restricted.

Rules

Ignore a rule for this browser with the Ignore button, or for one object with an annotation:

metadata:
  annotations:
    opsmask.com/ignore: "image-tag, no-liveness"

missing-field Required field missing

apiVersion, kind, metadata.name, a selector and a container image are required. The API server rejects the object without them.

selector-mismatch Selector does not match pod labels

spec.selector must match spec.template.metadata.labels, otherwise the API server rejects the workload.

no-namespace No namespace

The object lands in whatever namespace kubectl, Helm or Argo CD targets, which can differ between people and pipelines.

secret-in-git Secret values in the manifest

Base64 is encoding, not encryption. Anyone with access to the repo can read the value. Use External Secrets Operator, Sealed Secrets or the Secrets Store CSI driver.

plaintext-secret Plain-text secret in env or args

The value is visible in Git, in kubectl describe and in the pod spec.

public-load-balancer Public LoadBalancer

A LoadBalancer Service gets a public IP unless the cloud-specific internal annotation is set.

node-port NodePort Service

NodePort opens the port on every node. Prefer ClusterIP behind an Ingress or an internal LoadBalancer.

ingress-no-tls Ingress without TLS

Traffic to the Ingress is plain HTTP unless TLS is terminated somewhere in front of it.

rbac-wildcard Wildcard in RBAC rule

“*” in verbs, resources or apiGroups grants access to things that do not exist yet, including future CRDs. List what is needed.

single-replica Single replica

A node drain, cluster upgrade or crash causes downtime while the only pod is rescheduled.

no-disruption-budget No PodDisruptionBudget

Without a PDB a node drain can evict every replica at the same time.

no-spread Replicas not spread

Without topology spread or anti-affinity the scheduler may put every replica on the same node or zone.

host-namespace Host namespace shared

hostNetwork, hostPID and hostIPC remove the isolation between the pod and the node.

host-path hostPath volume

hostPath exposes the node filesystem to the pod and is a common container escape route.

sa-token Service account token mounted

Most apps never call the Kubernetes API. A mounted token is useful to an attacker who gets into the pod.

no-seccomp No seccomp profile

RuntimeDefault blocks dangerous syscalls and is required by the Restricted Pod Security Standard.

duplicate-name Duplicate name

Container names must be unique in a pod. Duplicate env var names silently keep the last value.

image-tag Image uses latest or no tag

The same manifest can pull different code on different days, and rollbacks are not predictable. Pin a version or digest.

no-requests No resource requests

The scheduler cannot place the pod sensibly, HPA cannot compute utilisation, and the pod is first to be evicted.

no-memory-limit No memory limit

A memory leak can starve other pods on the node. CPU limits are optional and often cause throttling.

request-over-limit Request larger than limit

The API server rejects a container whose request is above its limit.

privileged Privileged container

privileged: true gives the container full access to the node.

privilege-escalation Privilege escalation allowed

Without allowPrivilegeEscalation: false a process can gain more privileges than its parent through setuid binaries.

run-as-root May run as root

If the image runs as root, a container escape lands as root on the node.

writable-root-fs Writable root filesystem

A read-only root filesystem stops an attacker from dropping tools into the container. Mount an emptyDir for paths the app writes to.

capabilities Capabilities not dropped

Containers get a default set of Linux capabilities most apps never use.

no-readiness No readinessProbe

Traffic reaches the pod as soon as the process starts, before the app is ready.

no-liveness No livenessProbe

A hung process is not restarted. Keep it cheap and do not check dependencies in it.

same-probes Liveness and readiness are identical

When a dependency is down, both fail together and Kubernetes restarts pods that only needed to stop taking traffic.

probe-port Probe uses an unknown port name

A named probe port must match a name in the container’s ports, otherwise the probe always fails.

slow-start Long initialDelaySeconds

A startupProbe protects slow starts without delaying liveness checks for the rest of the pod’s life.

job-ttl Job never cleaned up

Finished Jobs and their pods stay in the cluster until deleted.

cronjob-concurrency CronJob runs may overlap

The default concurrencyPolicy is Allow, so a slow run overlaps the next one.

cronjob-deadline No startingDeadlineSeconds

If the controller misses more than 100 schedules (for example during an outage) the CronJob stops scheduling.

service-no-match Service selects no pods

No workload in the pasted manifests has labels matching the Service selector, so it will have no endpoints.

service-target-port Service targetPort not found

targetPort must match a containerPort (or a port name) on the selected pods.

ingress-backend Ingress backend not found

The Ingress points at a Service that is not in the pasted manifests. Requests return 503 if it does not exist in the cluster.

hpa-no-request HPA target has no requests

Utilisation is measured against requests. Without them the HPA reports <unknown> and never scales.