k8s-manifest-generator

A production Deployment needs resource requests and limits, liveness and readiness probes, a specific image tag, and a security context running as non-root. Use the deployment template with 3 replicas, maxUnavailable set to 0, and pod anti-affinity for high availability.

Use ClusterIP for internal microservice communication, LoadBalancer for external public access via cloud providers, NodePort for direct node access in development, and headless Services for StatefulSets. The choice depends on whether traffic originates inside or outside the cluster.

ConfigMaps store non-sensitive configuration data like environment variables and config files, while Secrets store sensitive data like passwords and TLS certificates. Secrets should never be committed to Git in plain text; use Sealed Secrets, External Secrets Operator, or Vault instead.

Run kubectl apply with --dry-run=client or --dry-run=server to validate manifests without applying them. You can also use kubeval, kube-score, or kube-linter for deeper static analysis of best practices and security configurations.

Check pod status with kubectl describe pod to find image pull errors, resource constraints, or failing probes. Review cluster events with kubectl get events and verify that referenced ConfigMaps, Secrets, and namespaces actually exist.