envcheck k8s-sync

Ensure Kubernetes manifests match your .env files.

Usage

envcheck k8s-sync [OPTIONS] <MANIFESTS> --env <ENV_FILE>

Arguments

  • <MANIFESTS>... - Kubernetes YAML files (supports glob patterns)

Options

OptionDescription
-e, --env <FILE>Reference .env file (required)
-f, --format <FORMAT>Output format: text, json, github
-q, --quietSuppress output, use exit codes
--ignore-namespaces <NS>Comma-separated namespaces to ignore

Supported Resources

  • Deployments - spec.template.spec.containers[*].env
  • StatefulSets - spec.template.spec.containers[*].env
  • DaemonSets - spec.template.spec.containers[*].env
  • CronJobs - spec.jobTemplate.spec.template.spec.containers[*].env
  • Secrets - stringData and data keys
  • ConfigMaps - data keys
  • Multi-document YAML - Files with --- separator

Exit Codes

CodeMeaning
0No mismatches
1Missing keys found
2Unused keys found (info)

Examples

Check all manifests

envcheck k8s-sync k8s/base/*.yaml --env .env.example

Output:

W005: Key in K8s but missing in .env: API_ENDPOINT
W006: Key in .env but unused in K8s: LOCAL_DEV_KEY

Recursive directory scan

envcheck k8s-sync k8s/**/*.yaml --env .env.example

GitHub Actions format

envcheck k8s-sync k8s/base/*.yaml --env .env.example --format=github

Output:

::warning file=k8s/deployment.yaml,line=45,col=1::W005: Key in K8s but missing in .env: DATABASE_URL

Ignore specific namespace

envcheck k8s-sync k8s/**/*.yaml --env .env.example --ignore-namespaces=kube-system

Detected Issues

CodeRuleSeverityDescription
W005K8s Missing EnvWarningEnvironment variable used in K8s but not defined in .env
W006Unused EnvInfoKey in .env but never referenced in K8s manifests

How It Works

The command parses YAML files and extracts:

  1. Container environment variables from env: and envFrom:
  2. Secret references from valueFrom.secretKeyRef
  3. ConfigMap references from valueFrom.configMapKeyRef
  4. Secret data from Secret.stringData and Secret.data
  5. ConfigMap data from ConfigMap.data

These are then compared against keys in your .env file.

Use Cases

Pre-commit hook

#!/bin/sh
git diff --name-only --cached | grep -E '\.ya?ml$' | \
    xargs envcheck k8s-sync --env .env.example

CI/CD validation

- name: Validate K8s manifests
  run: envcheck k8s-sync k8s/**/*.yaml --env .env.example

Helm chart validation (post-render)

helm template myapp ./chart > /tmp/rendered.yaml
envcheck k8s-sync /tmp/rendered.yaml --env .env.example

See Also