YAML / Kubernetes Validator

Kubernetes manifest failures this catches

Syntax validation checks whether YAML can be parsed: indentation, mappings, sequences, scalar values and multiple documents separated by ---. Valid YAML is not automatically a valid Kubernetes manifest, so ObservKit also checks apiVersion, kind, metadata.name, spec and selected workload fields, and reports workload advice separately as recommendations.

Labels and selectors

A Deployment's spec.selector must match spec.template.metadata.labels, or the API rejects it — and in apps/v1 the selector is immutable after creation, so fixing it later means recreating the Deployment. A Service whose selector matches no pod labels is accepted but has no endpoints: traffic fails without an error at apply time.

kind: Service
spec:
  selector:
    app: checkout        # pods are labelled app: checkout-api
                         # → Service has no endpoints

Probes

A failing liveness probe restarts the container; a failing readiness probe removes the pod from Service endpoints without restarting it; a startup probe holds off the other two while a slow application starts. Two frequent mistakes: a liveness probe that checks a dependency such as a database, which restarts every replica when the database is down, and a liveness probe that fires before a slow start completes, which causes a restart loop that a startup probe would avoid.

Resource requests and limits

Requests are what the scheduler reserves when placing a pod; limits are enforced at runtime. A container that exceeds its memory limit is OOM-killed; one that reaches its CPU limit is throttled. A pod with no requests or limits gets the BestEffort QoS class and is among the first evicted under node pressure.

resources:
  requests: { cpu: 250m, memory: 256Mi }
  limits:   { memory: 512Mi }

Mistakes that are valid YAML

• A list item indented one level too shallow attaches to the wrong parent, for example an env entry that ends up outside its container.
• Tabs are not allowed for indentation and fail parsing.
• An unpinned image tag such as :latest makes rollouts unreproducible; ObservKit flags it as a recommendation.

Sources

• Deployments — Kubernetes documentation (selector rules)
• Service — Kubernetes documentation
• Liveness, readiness and startup probes — Kubernetes documentation
• Resource management for pods and containers — Kubernetes documentation
• Pod quality of service classes — Kubernetes documentation

Last reviewed: October 2026