Kubernetes Manifest Generator

Deployment, Service, Ingress, ConfigMap, Secret and autoscaling YAML from a form.

● Runs 100% in your browser — nothing you type leaves this page.

App

Name

Namespace

Empty = the current namespace of kubectl.

Image

With a version tag, e.g. registry.example.com/myapp:1.4.2.

Replicas

Container port

Health check path

Used for the startup, readiness and liveness probes. Empty = no probes.

Resources

CPU request

Memory request

Memory limit

CPU limit

CPU in cores or millicores (500m = half a core), memory in Mi / Gi. A CPU limit is optional: it throttles the app even when the node is idle.

Configuration (ConfigMap)

One KEY=value per line. They reach the container as environment variables.

Secrets (Secret)

Not saved in the page link: only the key names are.

NetworkService

Service type

Service port

Ingress (HTTP from outside)

Scaling and securityAutoscale on CPU (HorizontalPodAutoscaler)Read-only root filesystem (with a writable /tmp)Explain with comments

app.yaml

# Generated by OhSudo — https://ohsudo.com/tools/kubernetes-manifest-generator/
# Apply: kubectl apply -f app.yaml
# Plain settings, loaded as environment variables (envFrom). Pods read them at start: restart after a change
apiVersion: v1
kind: ConfigMap
metadata:
  name: myapp-config
  labels:
    app.kubernetes.io/name: myapp
data:
  LOG_LEVEL: info
---
# Runs the pods. Security settings meet the "restricted" Pod Security Standard:
# non-root, no privilege escalation, no Linux capabilities, default seccomp profile
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app.kubernetes.io/name: myapp
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: myapp
  template:
    metadata:
      labels:
        app.kubernetes.io/name: myapp
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: myapp
          image: registry.example.com/myapp:1.0.0
          ports:
            - name: http
              containerPort: 8080
          envFrom:
            - configMapRef:
                name: myapp-config
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              memory: 256Mi
          startupProbe:
            httpGet:
              path: /health
              port: http
            periodSeconds: 5
            failureThreshold: 30
          readinessProbe:
            httpGet:
              path: /health
              port: http
            periodSeconds: 5
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /health
              port: http
            periodSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
---
# A stable name and IP in front of the pods; only ready pods get traffic
apiVersion: v1
kind: Service
metadata:
  name: myapp
  labels:
    app.kubernetes.io/name: myapp
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: myapp
  ports:
    - name: http
      port: 80
      targetPort: http

Apply it

$ kubectl apply --dry-run=server -f app.yaml

$ kubectl apply -f app.yaml

$ kubectl rollout status deployment/myapp

$ kubectl get pods,svc -l app.kubernetes.io/name=myapp

Save it as app.yaml. --dry-run=server lets the API server check everything without changing the cluster.

The address bar updates as you go, so you can bookmark or share the result.

How to use it

Name the app and give the image with a version tag.
Set the port the container listens on and a health check path, if the app has one.
Fill in the resources, and the settings and secrets the app reads from environment variables.
Turn on what you need: a Service, an Ingress for HTTP(S) from outside, autoscaling.
Save the result as app.yaml, check it with kubectl apply --dry-run=server -f app.yaml, then apply it.

What you get

One file with everything, in order: ConfigMap and Secret first, then the Deployment that uses them, the Service, the Ingress and the HorizontalPodAutoscaler.
Pods that pass the “restricted” Pod Security Standard: non-root, no privilege escalation, every Linux capability dropped, the default seccomp profile, and no service account token unless you need one. Optionally a read-only root filesystem with a writable /tmp.
Startup, readiness and liveness probes that don’t kill a slow-starting app: liveness only begins after the startup probe succeeds (see the liveness probe kills a healthy app).
Requests and a memory limit, so the scheduler knows what the pod needs (Pending: Insufficient cpu is about requests) and one leaking pod can’t take the whole node.
Autoscaling done right: with an HPA the Deployment has no replicas field, so kubectl apply doesn’t reset the number of pods the HPA chose.
Values quoted where kubectl needs it: yes, on or 8080 in a ConfigMap stay strings instead of breaking the apply.

Every combination of options is checked automatically: with kubeconform against the Kubernetes schemas, and by a real Kubernetes API server with strict field validation and the restricted Pod Security policy. One of them is rolled out for real, and reached through its Service.

Common commands

kubectl apply --dry-run=server -f app.yaml     # let the API server check it, change nothing
kubectl apply -f app.yaml
kubectl rollout status deployment/myapp        # wait until the new pods are ready
kubectl get pods -l app.kubernetes.io/name=myapp
kubectl describe pod <pod>                     # events: probes, OOM kills, image pulls
kubectl rollout undo deployment/myapp          # back to the previous version
kubectl create secret generic myapp-secrets --from-env-file=.env   # a Secret without YAML

Warning

A Secret in YAML is not encrypted — the values are only base64-encoded, and anyone who can read the file can read them. Keep the Secret out of git: create it with kubectl create secret, or use Sealed Secrets or External Secrets. Secret values you type here stay in your browser and are never put in the page link.

FAQ

Why does my pod fail with “container has runAsNonRoot and image will run as root”?

The image runs as root (no USER in its Dockerfile), and runAsNonRoot: true refuses to start it. Change the image to run as a non-root user — the Dockerfile Generator does. If the image’s USER is a name (USER node) rather than a number, Kubernetes can’t verify it is non-root either; use the numeric UID (USER 1000), or set runAsUser in the pod. The details are in container has runAsNonRoot and image will run as root.

How do I deploy new versions automatically?

The CI/CD Pipeline Generator writes a pipeline that builds the image and points this Deployment at it, then waits for the rollout to finish.

Why is my pod stuck in ImagePullBackOff?

The node can’t pull the image: a wrong name or tag, a private registry without credentials, or a rate limit. The fixes are in ImagePullBackOff.

Why no CPU limit by default?

A CPU limit throttles the app even when the node has idle CPU, which shows up as slow responses rather than errors. A CPU request is what the scheduler and autoscaling use. Memory is different: there the limit protects the rest of the node, so it is set by default.

Ingress or Gateway API?

Ingress works with every Ingress controller (Traefik, HAProxy, cloud load balancers…), and almost every cluster supports it. Gateway API is the newer, more flexible API for the same job, but it needs a controller that supports it. Leave the class empty to use the cluster’s default Ingress class.

Does the HPA work right away?

Only if the cluster has metrics-server (most managed clusters do). Without it the HPA shows <unknown> targets and doesn’t scale. Check with kubectl top pods.

kubectl says “localhost:8080 was refused”

kubectl has no kubeconfig, so it doesn’t know where your cluster is. See The connection to the server localhost:8080 was refused.

The pod shows CreateContainerConfigError or Evicted

The first means a Secret or ConfigMap is missing: see CreateContainerConfigError. The second means the node ran short of resources: see Evicted.

Which commands do I need after applying this?

They’re in the kubectl Cheat Sheet.

Articles

Learn more

CreateContainerConfigError

Kubernetes

Kubernetes CreateContainerConfigError: a missing Secret or ConfigMap, and how to find it

Fix Kubernetes CreateContainerConfigError: kubectl describe names the missing Secret, ConfigMap or key. Check the namespace and the key, then let the pod restart.

Beginner · 4 min read

Evicted

Kubernetes

Kubernetes pods "Evicted": find the pressure on the node, and stop it from coming back

Fix Kubernetes pods with status Evicted: read why with describe, handle DiskPressure and MemoryPressure on the node, clean up, set requests and limits, delete old pods.

Intermediate · 4 min read

localhost:8080 was refused

Kubernetes

kubectl "The connection to the server localhost:8080 was refused": your kubeconfig is missing

Fix kubectl "The connection to the server localhost:8080 was refused": kubectl has no kubeconfig. Set it up for kubeadm, k3s, minikube, EKS, GKE or AKS, and under sudo.

Beginner · 3 min read

container has runAsNonRoot and image will run as root

Kubernetes

Kubernetes "container has runAsNonRoot and image will run as root": fix the image or the pod

CreateContainerConfigError with runAsNonRoot: the image runs as root or has a non-numeric USER. Fix the Dockerfile, set runAsUser, and keep restricted security.

Intermediate · 4 min read

ImagePullBackOff

Kubernetes

Kubernetes ImagePullBackOff and ErrImagePull: find out why the image won’t pull

Fix ImagePullBackOff: read the pull error in kubectl describe, then fix the image name or tag, registry credentials, Docker Hub rate limits, network or architecture.

Beginner · 4 min read

0/3 nodes are available: Insufficient cpu

Kubernetes

Kubernetes pod stuck in Pending: "0/3 nodes are available: Insufficient cpu"

Fix pods stuck in Pending: read the FailedScheduling event, then fix CPU and memory requests, taints, node selectors, volumes or the cluster size.

Intermediate · 4 min read

CrashLoopBackOff

Kubernetes

Kubernetes CrashLoopBackOff: 7 causes and how to find yours

CrashLoopBackOff means the container keeps exiting. Read the exit code and the previous logs, then fix the crash, OOM kill, probe or command.

Intermediate · 6 min read