How do the Service and Deployment end up linked correctly?

The app name you type at the top becomes the app: label on the Deployment's pod template and the exact selector the Service matches against — the two most common hand-edit mistakes (a selector that doesn't match any pod's labels, or a port that doesn't match a container's) are not possible here because both sides are generated from the same field.

Are the Secret values actually encrypted?

No. Like every Kubernetes Secret, the values are base64-encoded for transport into the data: block, not encrypted — this tool automates that encoding step, it doesn't add confidentiality. Real protection still comes from cluster-level RBAC and etcd encryption-at-rest.

● runs entirely in your browser

Kubernetes App Builder

One guided form for a whole app: Deployment, Service, ConfigMap, Secret, Ingress, and autoscaling — all generated from the same fields, so labels and references always match. Nothing is ever uploaded.

App name

Container image

Container port

Replicas

Resources — sensible defaults, edit or blank out to omit

CPU request

CPU limit

Memory request

Memory limit

Environment variables — one KEY=value per line, set directly on the container

ConfigMap data — one KEY=value per line Mount as files in /etc/config instead of environment variables

Secret data — plaintext here, base64-encoded for you Mount as files in /etc/secret instead of environment variables

Service

Type

Service port

Ingress

Host

Path

Ingress class (optional)

Autoscaling (HorizontalPodAutoscaler)

Min replicas

Max replicas

Target CPU utilization %

Generated manifests

How it works

Everything is generated from the app name and the fields above, not typed by hand twice — the app: label on the Deployment's pod template and the Service's selector are the same value, the Service's targetPort is the same container port the Deployment exposes, and the Ingress's backend and the HPA's scaleTargetRef point at the names this form just generated. ConfigMap and Secret data default to envFrom (the whole object injected as environment variables); the "mount as files" checkbox switches that section to a volume and volumeMount instead. Secret values are base64-encoded automatically using the same UTF-8-safe encode this site's .env to Kubernetes ConfigMap/Secret tool uses, so values round-trip correctly for non-ASCII text.

FAQ

How do the Service and Deployment end up linked correctly?: The app name you type at the top becomes the app: label on the Deployment's pod template and the exact selector the Service matches against — the two most common hand-edit mistakes (a selector that doesn't match any pod's labels, or a port that doesn't match a container's) are not possible here because both sides are generated from the same field.
Are the Secret values actually encrypted?: No. Like every Kubernetes Secret, the values are base64-encoded for transport into the data: block, not encrypted — this tool automates that encoding step, it doesn't add confidentiality. Real protection still comes from cluster-level RBAC and etcd encryption-at-rest.

Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.

Say thanks — $3