Skip to content

PREFLIGHT SIMULATOR

KubeFlight

A local-first, deterministic Kubernetes preflight engine that analyzes rendered manifests, simulates scheduler placement, evaluates security, RBAC, and network policy, estimates cost, and returns an evidence-backed safety decision — without an LLM.

Apache-2.0 v0.2.0 Deterministic — no LLM

Get the highlights.

  • 51
    severities — critical, high, medium, low, info
  • 52
    report formats — text, JSON, HTML, Markdown, SARIF
  • 03
    LLM calls used to decide whether a deployment is safe
  • 0.2.04
    current release version
  • 65
    read-only resource kinds granted in live-cluster mode

KubeFlight is an Apache-2.0, local-first Kubernetes deployment simulator and preflight engine from Zyvor AI Labs. It analyzes rendered manifests, optionally compares them with a baseline and a target-cluster snapshot, simulates placement, evaluates security/RBAC/network policy, estimates change cost, and returns an evidence-backed safety decision.

A valid manifest can still fail in production because of node capacity, existing Pods, taints, affinity, NetworkPolicy, missing RBAC, removed APIs, cost growth, availability constraints, or downstream dependencies. KubeFlight puts those signals into one repeatable preflight — and it is intentionally deterministic: it does not use an LLM to decide whether a deployment is safe.

For the full picture — quick start, Docker/Kubernetes/Helm deployment, GitHub Action usage, RBAC contracts, and the cost model — see the README on GitHub.

Take a closer look

The simulator reads Node allocatable resources and subtracts requests from non-terminal Pods already assigned to each node, then greedily places each requested replica while applying hard placement predicates — accounting for application containers, init containers, native sidecar init containers, Pod overhead, and RuntimeClass fixed overhead.

KubeFlight constructs static dependencies from explicit connection-bearing fields (environment values, command/args, and KubeFlight dependency annotations) to submitted Services, then evaluates standard Kubernetes NetworkPolicy isolation in both directions.

ServiceAccount presence plus explicit API group/resource/subresource/ verb/resourceName contracts, expressed as a manifest annotation. KubeFlight evaluates submitted Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings against them.

Baseline and proposed dependency graphs are both retained. Reverse traversal across their union lets deleted Services/workloads keep their former dependents for blast-radius analysis.

A provider-neutral request/storage estimate and baseline delta — calibrated to your own CPU/GiB/GPU reference rates, not a specific cloud bill.

  • 🧩 Helm & Kustomize auto-render
  • 🛡️ Restricted Pod Security checks
  • 📊 Scheduler placement simulation
  • 🔐 RBAC contract evaluation
  • 🌐 NetworkPolicy ingress/egress
  • 💰 Provider-neutral cost estimation
  • 🔍 Baseline diff & blast-radius analysis
  • 📄 Text/JSON/HTML/Markdown/SARIF reports
  1. The five severities and what triggers each. See Rules. ↩
  2. Text, JSON, HTML, Markdown/PR summary, and SARIF — from the README's v0.2.0 capabilities table. See the README. ↩
  3. KubeFlight is intentionally deterministic — it does not use an LLM to decide whether a deployment is safe. See FAQ. ↩
  4. Current version per the project changelog. See CHANGELOG. ↩
  5. Live-cluster mode grants read-only get/list for Nodes, Namespaces, Pods, ServiceAccounts, StorageClasses and RuntimeClasses only — never Secrets, logs, exec, or writes. See the README. ↩