Kubernetes YAML Validator

A Kubernetes YAML validator checks your manifest files for structural correctness and best practices. This includes required fields like apiVersion, kind, and metadata; image tag pinning; CPU and memory resource limits; liveness and readiness probes; hardcoded secrets in environment variables; namespace specification; and YAML syntax errors like tab characters.

Using :latest means every Pod restart or new node may pull a different image version, leading to non-deterministic deployments. A :latest tag on one node may differ from another, causing subtle bugs. Pin to a specific version tag (e.g. nginx:1.25.3) or a full image digest (sha256:...) for reproducible, auditable deployments. This is especially critical in production where rollbacks need to be predictable.

Requests tell the Kubernetes scheduler how much CPU and memory a container needs — the scheduler uses this to place the Pod on a suitable Node. Limits cap the maximum resources a container can consume. If a container exceeds its CPU limit, it gets throttled. If it exceeds its memory limit, the container is OOMKilled (killed and restarted). Best practice: always set both. Use millicores for CPU (e.g. 500m = 0.5 CPU) and mebibytes for memory (e.g. 256Mi).

A liveness probe checks if the container is still running and healthy. If it fails, Kubernetes restarts the container. A readiness probe checks if the container is ready to receive traffic. If it fails, the Pod is removed from Service endpoints — traffic stops routing to it until it recovers. Use liveness probes to catch deadlocks; use readiness probes to prevent routing to containers that are still starting up or temporarily degraded.

Never hardcode passwords, API keys, or tokens directly in Pod spec environment variables — they show up in kubectl describe output and logs. Instead, use Kubernetes Secrets (valueFrom.secretKeyRef) to inject sensitive values. For production, consider external secret management: HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, or Azure Key Vault, synced to the cluster via an operator like External Secrets Operator.

Without an explicit namespace, resources deploy to the 'default' namespace. In multi-team or production environments, the default namespace quickly becomes cluttered and lacks proper RBAC isolation. Explicitly specify namespaces in manifests so deployments are always predictable regardless of your kubectl context. Create namespaces per team, environment, or application for clean separation of concerns.