Layered Manifest Architecture

The generator produces K8s resources in a layered pattern inspired by Kustomize's
base + overlay model, without requiring Kustomize itself:

{
  "app": "api-gateway",
  "image": "nginx:1.25",
  "replicas": 3,
  "ports": [{"name": "http", "port": 80}],
  "env": "production",
  "resources": {
    "requests": {"cpu": "500m", "memory": "512Mi"},
    "limits": {"cpu": "1", "memory": "1Gi"}
  },
  "ingress": {"host": "api.docs.example.com", "tls": true},
  "probes": {
    "liveness": {"path": "/healthz", "initialDelay": 10},
    "readiness": {"path": "/ready", "initialDelay": 5}
  }
}

Running python src/k8s_generator.py --config examples/app_spec.json --output-dir ./k8s/
produces six files per spec: Deployment, Service, HPA, Ingress, ConfigMap,
and a kustomization.yaml wrapper.

Base Overlays

The --env flag selects environment-specific overrides:

Flag	Replicas	CPU	Memory	Ingress
`dev`	1	250m	256Mi	No TLS
`staging`	2	500m	512Mi	TLS staging cert
`production`	3+	1	1Gi	TLS + WAF

Security Hardening (Default On)

Every generated Deployment applies these security contexts automatically:

securityContext:
  runAsNonRoot: true
  runAsUser: 1001
  fsGroup: 1001
  seccompProfile:
    type: RuntimeDefault
containers:
  - securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]

Resource Validation

The --validate-only flag runs the full validation pipeline without generating
output. It checks for: port conflicts, missing ConfigMap keys, label selector
mismatches, probe path existence, and resource quota compliance.

Included with Kubernetes Manifests

Ready for the complete Kubernetes Manifests?