K8s Clinic

Paste your manifests — posture, inventory, ranked findings, corrected YAML.

Back to SkillSafe
Or pick files: manifests are read and checked entirely in your browser. Only their size is sent, to price the run — the YAML itself is uploaded when you press Review, and not before.
Context — cluster, delivery pipeline, anything already handled elsewhere
How it works

Nothing to hand? Load the — a Deployment on :latest with one replica, no probes, no limits and a password inlined as an env var — or the — carefully written, restricted-PSS-compatible, and still carrying a NetworkPolicy that forgets to allow DNS. Both replay a saved run for free.

1

Paste the YAML — the prescan is free

Split on ---, no AI, and none of your YAML leaves the page: the prescan reads each document it can parse in your browser, tells you how many it could not read, and lists what it mechanically found. The resource inventory, then the flags — mutable or missing image tags, absent requests and limits, missing liveness or readiness probes, single replicas, privileged or host-namespace pods, no securityContext, NodePort and LoadBalancer exposure, secret-looking env vars with literal values, and workloads with no namespace. Each group explains why it matters. This part costs nothing and happens while you type.

2

The AI reviews them — this is the metered part

A senior platform architect's pass: a posture call on the YAML as pasted — never a claim about your cluster — with the single most important change named, the inventory with each object's role, and prioritized findings across security, reliability, scaling, cost, GitOps, observability and hygiene — each with the problem, the concrete impact, the fix and a corrected YAML fragment. The review is asked to confirm or explicitly set aside every prescan flag, and the result panel reports any it left unaddressed. It is instructed to cite only resources that appear in your manifests. Pricing is honest: a worst-case amount is reserved before the run and only what the run actually uses is charged — the meter next to the button shows both.

3

Fix, export, re-run

Quick wins for the one-line changes, focus areas tied to specific findings for the real work, a blockers-only view, per-finding Copy YAML and Copy as PR comment, your own manifests downloadable with every finding written in as comments, the findings table as CSV, and Markdown or JSON export. Past reviews are saved to your SkillSafe account (mirrored on this device), and when you edit the YAML the prescan tells you for free which flags your edit fixed, which are new and which are still open — before you pay for a second review.

What it does not see

K8s Clinic reads only the YAML you paste. It cannot see the live cluster or what is already running in it, RBAC or NetworkPolicy defined in files you did not paste, admission control such as PodSecurity, OPA or Kyverno, the namespace’s own labels and quotas, the image registry or what is inside the images, the CNI, or the StorageClass. So the strongest verdict it can reach is “nothing in this YAML is blocking” — never “this is safe to apply”. The free prescan is regex-based rather than a real YAML parser, so it always reports how many of your documents it could read and names the ones it could not: a document it failed on is never quietly counted as clean.

If a review is cut short — because the stream dies or your balance runs out mid-answer — you see only text that actually arrived. Part-written sentences and half-finished findings are discarded rather than completed for you, sections that never arrived are labelled not received rather than None, and no posture is invented. Running again afterwards performs a real new review, not a replay of the cut-off one: an accidental double-submit of identical input is deduplicated and not charged twice, but a deliberate second review always runs.

Derived from the @sickn33/kubernetes-architect skill (MIT license).