Kubernetes Manifest Validator

devops.validate_kubernetes_yaml

ProductionEngine wrapper (Class A)Deterministicstrictfastv1.0.0

No network

Overview

You pass Kubernetes YAML and we validate it against the pinned k8s-1.31-core schema profile and a fixed policy catalog (resource limits, privileged containers, probes). Unknown kinds are reported as findings, not hard failures. We do not contact a cluster, render Helm, or run Kustomize. Do not use this as a substitute for dry-run against your live cluster.

Agents that invent Kubernetes validity confuse schema structure with cluster admission. We label what we check and what we do not.

Reliability

STRICT and deterministic within the pinned schemaProfile in _meta. Domain errors (not retryable — fix input): K8S_YAML_INVALID (YAML cannot be parsed — correct the manifest); K8S_DOCUMENT_LIMIT_EXCEEDED (more than 32 documents — split the file); YAML_ALIAS_LIMIT_EXCEEDED (YAML alias limit hit — remove alias chains); K8S_POLICY_UNKNOWN (unrecognized policy name — use REQUIRE_RESOURCE_LIMITS, DISALLOW_PRIVILEGED, or REQUIRE_PROBES). Schema and policy violations appear in findings[] with codes such as K8S_MISSING_PROBES.

Context footprint

One call replaces multi-step schema lookup and policy linting. A successful call costs 1 execution credit.

When to use it

When you need honest schema and policy findings against a pinned API subset.

When you need dry-run against a live cluster or CRD validation.

Scope

Note

Schema-structural validation plus named policies for a curated API-version subset.

Non-goals

Does not contact a cluster or emulate admission controllers
Does not validate arbitrary CRDs without a caller schema
Does not render Helm or Kustomize
Does not guarantee a passing manifest will apply to every cluster

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

parsingvalidation

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input512 KB

How we handle your data

Sensitive output possible

What this means

This skill may receive sensitive content and may return submitted, transformed, extracted, or reformatted content.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
This skill does not target sensitive data.
Output may reveal sensitive derived information

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
manifest	string	Yes	Multi-document Kubernetes YAML validated without cluster access.
policies	array	No	Bounded optional array of supported policy identifiers; omit it for the default policy set. The item shape is defined by the nested schema and the array contains from 0 through 256 items.
options	object	No	Purpose-bound bounded Kubernetes validation options; omit it for safe defaults. Its purpose-bound option properties are bounded to 128 entries — unconstrained RFC 8259 JSON items.

Output schema

Field	Type	Required	Description
valid	boolean	Yes	Whether no error-severity finding exists.
documents	array	Yes	Bounded manifest-document receipts in source order. The item shape is defined by the nested schema and the array contains from 0 through 100000 items.
findings	array	Yes	Bounded array of safe structured DevOps findings. The item shape is defined by the nested schema and the array contains from 0 through 20000 items.
_meta	object	Yes	Closed Kubernetes validator metadata receipt. Its documented receipt properties are bounded to 256 entries — unconstrained RFC 8259 JSON items.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"devops.validate_kubernetes_yaml","input":{"manifest":"apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: x\n"}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("devops.validate_kubernetes_yaml", {"manifest":"apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: api\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: api\n  template:\n    metadata:\n      labels:\n        app: api\n    spec:\n      containers:\n        - name: api\n          image: nginx:1.27\n          resources:\n            limits:\n              cpu: \"500m\"\n              memory: 512Mi\n          livenessProbe:\n            httpGet:\n              path: /health\n              port: 8080\n          readinessProbe:\n            httpGet:\n              path: /health\n              port: 8080\n","policies":["REQUIRE_RESOURCE_LIMITS","DISALLOW_PRIVILEGED","REQUIRE_PROBES"]});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.
K8S_YAML_INVALID	400	No	The request payload failed this skill's input validation.
K8S_DOCUMENT_LIMIT_EXCEEDED	429	No	A size, quota, rate, or time limit was exceeded.
YAML_ALIAS_LIMIT_EXCEEDED	422	No	The input was rejected as unsafe.
K8S_POLICY_UNKNOWN	400	No	The skill does not support the requested variant.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not contact a cluster or emulate admission controllers
Does not validate arbitrary CRDs without a caller schema
Does not render Helm or Kustomize
Does not guarantee a passing manifest will apply to every cluster
Dry-run against a live cluster or admission webhook
CRD validation without a supplied schema

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "devops.validate_kubernetes_yaml",
  "input": {
    "manifest": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: api\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: api\n  template:\n    metadata:\n      labels:\n        app: api\n    spec:\n      containers:\n        - name: api\n          image: nginx:1.27\n          resources:\n            limits:\n              cpu: \"500m\"\n              memory: 512Mi\n          livenessProbe:\n            httpGet:\n              path: /health\n              port: 8080\n          readinessProbe:\n            httpGet:\n              path: /health\n              port: 8080\n",
    "policies": [
      "REQUIRE_RESOURCE_LIMITS",
      "DISALLOW_PRIVILEGED",
      "REQUIRE_PROBES"
    ]
  }
}

Examples

Valid Deployment with limits and probes

Inputjson

{
  "manifest": "apiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: api\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: api\n  template:\n    metadata:\n      labels:\n        app: api\n    spec:\n      containers:\n        - name: api\n          image: nginx:1.27\n          resources:\n            limits:\n              cpu: \"500m\"\n              memory: 512Mi\n          livenessProbe:\n            httpGet:\n              path: /health\n              port: 8080\n          readinessProbe:\n            httpGet:\n              path: /health\n              port: 8080\n",
  "policies": [
    "REQUIRE_RESOURCE_LIMITS",
    "DISALLOW_PRIVILEGED",
    "REQUIRE_PROBES"
  ]
}

Expected outputjson

{
  "valid": true,
  "_meta": {
    "schemaProfile": "k8s-1.31-core",
    "policiesEvaluated": 3,
    "documentCount": 1
  },
  "documents": [
    {
      "kind": "Deployment",
      "apiVersion": "apps/v1",
      "namespace": "default",
      "valid": true,
      "index": 0,
      "name": "api"
    }
  ],
  "findings": []
}

Missing probes fail REQUIRE_PROBES policy