What the Kubernetes YAML validator checks
The validator checks basic YAML structure and the Kubernetes fields most frequently missed during deployment. It identifies absent apiVersion, kind, and metadata.name values, then applies workload-specific checks for containers, selectors, resource requests, limits, and health probes.
Security checks highlight privileged containers, host networking, containers configured to run as root, mutable latest image tags, and secrets written directly into a manifest. These findings are guidance for review rather than proof that a workload is secure.
Why valid YAML can still fail in Kubernetes
A file can be valid YAML and still be rejected by the Kubernetes API. Resource schemas vary by Kubernetes version, enabled APIs, admission policies, and custom resource definitions. A manifest can also be accepted but fail later because an image cannot be pulled, a volume cannot mount, a probe fails, or the scheduler cannot place the pod.
Use this browser check before committing a manifest, then run server-side validation against the intended cluster and review the deployment status. Cluster validation is the authoritative test because it includes the APIs and policies active in that environment.
- Run kubectl apply --server-side --dry-run=server against a safe target cluster.
- Review admission-policy and namespace-specific requirements.
- Pin immutable image versions instead of using latest.
- Set realistic requests, limits, readiness probes, and liveness probes.
Handling Kubernetes manifests safely
Do not place plaintext passwords, tokens, certificates, or connection strings in YAML committed to source control. Kubernetes Secret values are encoded, not automatically encrypted in a repository. Use an approved secret-management pattern such as Azure Key Vault integration and workload identity.
CloudForge performs these static checks in the browser. The tool does not contact a cluster and cannot verify live RBAC, admission controllers, custom resources, service connectivity, or runtime behavior.
Frequently asked questions
Does this tool connect to my Kubernetes cluster?
No. It performs static checks in your browser and does not require cluster credentials.
Can it validate custom resources and CRDs?
It can perform general structural checks, but authoritative CRD validation requires the schema installed in the target cluster.
Is a clean result proof that the manifest will deploy?
No. Cluster version, admission policies, RBAC, quotas, images, storage, and runtime dependencies can still cause deployment failures.