Loading page
About this tool
Turn key=value pairs or an .env file into ConfigMap and base64-encoded Secret manifests with validated keys.
This generator converts .env-style KEY=VALUE lines into ready-to-apply Kubernetes ConfigMap and Secret manifests, base64-encoding Secret values per RFC 4648 exactly as kubectl create secret does. Keys are validated against the API rule [-._a-zA-Z0-9]+ (max 253 characters) and the total payload against the 1 MiB object limit, so the YAML applies cleanly the first time. Everything runs locally in the browser — configuration values never leave the page.
Open Kubernetes ConfigMap and Secret Generator on AltFTool — it loads instantly in your browser.
Paste your code or data sample into the workspace.
Pick the format, conversion, or analysis you need.
Copy the polished result straight back into your project.
Values are UTF-8 base64-encoded with a pure JS encoder verified against Node's Buffer — nothing is uploaded.
Keys are checked against the exact apimachinery regex and 253-character cap before you ever run kubectl.
One paste produces a plaintext ConfigMap and an encoded Secret, plus type-specific checks for tls and basic-auth.
No — by default Secret values are only base64-encoded, which anyone can reverse instantly. Real protection comes from RBAC limiting who can read Secrets, enabling encryption at rest for etcd, and using external stores (Vault, cloud secret managers, sealed-secrets) for anything committed to git.
Letters, digits, hyphen, underscore and dot — the pattern [-._a-zA-Z0-9]+ — with a maximum length of 253 characters. Spaces, slashes and colons are rejected by the API server, which is the most common reason a generated manifest fails to apply.
1 MiB (1,048,576 bytes) per object, a limit imposed by etcd's default maximum object size. Anything larger — certificates bundles, ML models, large JSON files — belongs in a volume, an image layer or object storage, not in a ConfigMap.
data holds base64-encoded values and is what the API stores and returns; stringData is a write-only convenience field where you provide plaintext and the API server encodes and merges it into data on write. If the same key appears in both, stringData wins.