What the Kubernetes Manifest Visualizer does
This visualiser reads multi-document Kubernetes YAML and draws how the objects connect: Ingress rules to Services, Services to the workloads their selectors match, workloads to the ConfigMaps, Secrets, volumes and service accounts they use, and autoscalers and policies to their targets. It flags broken links on the way - a Service that selects no pods, an Ingress pointing at a missing Service or port, a Deployment whose selector does not match its own template, a mount with no volume.
Paste raw manifests or the output of helm template or kustomize build. Everything is parsed in your browser with a safe YAML reader; nothing is applied to a cluster or sent anywhere.
How to use it
- Paste your YAML, several documents separated by ---, or drop a .yaml or .json file.
- Choose Visualise. The graph reads left to right: entry points, Services and policies, workloads, then configuration and storage.
- Read the findings. Problems are references that cannot work as written; warnings name objects the manifests expect to exist already; notes explain behaviour worth knowing.
- Use the object table to see every object and what it links to, and download the graph as SVG or the analysis as JSON.
Reading the results
A Service links to a workload when every key in its selector matches the workload's pod template labels in the same namespace - the same subset match Kubernetes uses. Extra labels on the pods do not matter.
Named target ports must match a containerPort name; numeric ports that a container does not declare are only a warning, because declaring containerPort is informational.
A missing ConfigMap, Secret or ServiceAccount is a warning rather than a problem: it may already exist in the cluster or be created by another tool. The graph shows it with a dashed red arrow only when a reference is definitely broken.
Worked example: a shop with a broken Service
The example has an Ingress for shop.example.com with / going to Service web and /api going to Service api, two Deployments, a ConfigMap and an HPA, all in the shop namespace.
Service web selects app: web and targets the named port http, which the web container declares, so the Ingress to Service to Deployment chain is complete. Service api selects app: api-server, but the api Deployment's pods are labelled app: api, so the Service has no endpoints and /api would return errors - the one problem reported.
Two warnings and two notes follow: the Secret db-credentials and service account api are not in the manifests, the TLS secret shop-tls is expected from elsewhere, and the web Deployment sets replicas while an HPA also scales it.
What counts as a link
Ingress backends and TLS secrets; Service selectors; ConfigMaps and Secrets used as volumes, projected volumes, envFrom or single env values; PersistentVolumeClaims; service accounts; StatefulSet volume claim templates; HorizontalPodAutoscaler targets; and the pod selectors of NetworkPolicies and PodDisruptionBudgets.
Objects that link to nothing, such as a ConfigMap no workload reads, still appear in the graph, which is often the quickest way to spot leftovers.
Limitations: what the result does not prove
- It only knows what you paste. Objects already in the cluster, created by operators or injected by admission webhooks are invisible, so treat missing-object warnings as questions.
- Custom resources (for example Gateway API routes, Istio or cert-manager objects) are listed and drawn but their references are not followed.
- The YAML reader refuses anchors, aliases and custom tags. Render Helm charts with helm template first; templates with {{ }} are not valid YAML.
Privacy: where your data goes
Everything you paste, type or drop is processed in this browser tab. It is not uploaded, logged, stored or sent to analytics. Session recording and tag-manager scripts are switched off on this page.
Standards and sources
- Kubernetes API reference - checked 19 Sep 2026
- Kubernetes - Labels and selectors
- Kubernetes - Service
- Kubernetes - Ingress
Frequently asked questions
Why does my Service have no endpoints?
Usually because its selector does not match the pod labels - a typo, a different label key, or a namespace mismatch. The visualiser flags a Service that selects nothing in the manifest and shows its selector so you can compare it with the pod template labels.
Can I visualise a Helm chart?
Yes, after rendering it: run helm template with your values and paste the output. The chart's own template files contain {{ }} expressions, which are not YAML until Helm renders them.
What does it mean when a Deployment's selector does not match its template?
apps/v1 requires spec.selector to match spec.template.metadata.labels, and the API server rejects the object otherwise. It is a common copy-paste mistake when renaming an app.
Is it safe to paste manifests that contain Secrets?
The YAML never leaves your browser. Even so, Kubernetes Secret data is only base64-encoded, not encrypted, so avoid pasting real secret values anywhere you would not paste a password.
Why is a missing Secret only a warning?
Secrets are often created separately - by a secrets manager, a sealed-secrets controller or cert-manager - so a manifest that references one without defining it is normal. If it does not exist at run time, the pod will not start, so the warning tells you to check.
Does it check resource requests or security settings?
Not here. For requests, limits and node capacity use the Kubernetes Resource Calculator; for security context, privileges and host access use the Kubernetes Security Checker.
Last reviewed by the A2Z.Tools team against the sources listed above.
