Kubernetes manifest & kubeconfig redactor
Mask Secret values, kubeconfig tokens, cluster endpoints and IPs before you paste YAML into an AI chat or a ticket.
Runs locally. Nothing you paste leaves this tab.
Masked output
What gets masked
- Every value under
data:andstringData:in a Secret, including multi-line values. - kubeconfig credentials:
certificate-authority-data,client-certificate-data,client-key-data,token,password, and the cluster’sserverhost. - Env var values whose name looks like a secret (
*PASSWORD*,*TOKEN*,*CONNECTION_STRING*…). - The
last-applied-configurationannotation, which often contains a copy of the Secret. - JWTs, bearer tokens, GitHub and AWS keys, private keys and credentials in URLs.
The same value always gets the same placeholder ([IP_1], [CLUSTER_HOST_1]), so an AI can still tell which pods talk to which address. Always read the output before you paste it: this catches common patterns, not every secret.