K8s-Ressourcen-Generator

Generating Production-Ready Kubernetes YAML Manifests

Writing Kubernetes YAML from scratch is tedious and error-prone — forgetting resource limits, health probes, security contexts, or proper label conventions leads to manifests that deploy successfully but fail production readiness reviews. The Resource Generator creates complete, best-practice YAML templates from simple configuration selections, producing manifests that include resource requests and limits, health probes, security contexts, proper labels, and annotations from the start.

Select your resource type — Deployment, Service, ConfigMap, Secret, Ingress, PersistentVolumeClaim, CronJob, Job, StatefulSet, or DaemonSet — configure the essential parameters, and receive a complete YAML manifest ready for customization and deployment. The generated output follows Kubernetes community best practices and CIS Benchmark security recommendations, saving teams from repetitive boilerplate while enforcing organizational standards.

Supported Resource Types

The generator produces templates for all common Kubernetes workload and configuration resources:

• Deployment: Stateless workloads with rolling update strategy, resource limits, health probes, security context, and pod disruption budgets.
• StatefulSet: Stateful workloads with ordered deployment, persistent volume claims, and headless service configuration.
• DaemonSet: Node-level agents with appropriate tolerations and node selectors.
• CronJob: Scheduled tasks with concurrency policies, deadline settings, and history limits.
• Service: ClusterIP, NodePort, and LoadBalancer services with proper selectors.
• Ingress: HTTP routing rules with TLS configuration and annotations for common ingress controllers (nginx, traefik, ALB).
• ConfigMap / Secret: Configuration and sensitive data resources with proper labeling and annotation patterns.
• PersistentVolumeClaim: Storage requests with access modes and storage class specifications.

Built-in Security and Best Practices

Every generated manifest includes security hardening by default:

• runAsNonRoot: true — Prevents containers from running as root
• readOnlyRootFilesystem: true — Blocks filesystem modification attempts
• allowPrivilegeEscalation: false — Prevents privilege escalation attacks
• capabilities.drop: ["ALL"] — Removes all Linux capabilities by default
• Resource requests and limits — Prevents resource starvation and noisy neighbor issues
• Liveness and readiness probes — Enables automatic recovery and traffic management
• Pinned image tags — Avoids mutable :latest references

These defaults align with the Kubernetes Pod Security Standards "restricted" profile, providing the highest security posture. Teams can selectively relax restrictions where necessary while starting from a secure baseline rather than adding security as an afterthought.

Label and Annotation Conventions

Generated resources follow the Kubernetes recommended label conventions for consistent resource management across tools and dashboards:

• app.kubernetes.io/name — Application name
• app.kubernetes.io/version — Current version of the application
• app.kubernetes.io/component — Component within the architecture (frontend, backend, database)
• app.kubernetes.io/part-of — Higher-level application this belongs to
• app.kubernetes.io/managed-by — Tool managing the resource (helm, kustomize, manual)

Consistent labeling enables kubectl filtering, dashboard grouping, and policy enforcement across all resources in the cluster regardless of which team or tool created them.

Code Examples

Generated Production-Ready Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-server
  labels:
    app.kubernetes.io/name: api-server
    app.kubernetes.io/version: "1.0.0"
    app.kubernetes.io/component: backend
    app.kubernetes.io/managed-by: manual
spec:
  replicas: 3
  selector:
    matchLabels:
      app.kubernetes.io/name: api-server
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app.kubernetes.io/name: api-server
    spec:
      serviceAccountName: api-server
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
      containers:
        - name: api-server
          image: registry.example.com/api-server:1.0.0
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8080
              protocol: TCP
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5