Sanitize Kubernetes manifests

devops-utils sanitize reads a Kubernetes YAML file and replaces the values of every Secret’s data / stringData keys with ***secret_hidden**. Key names, document order, and every other resource in the file are left untouched, so the result still reads like the manifest you started from — it just can’t leak a credential.

No extra is required: pip install devops-utils is enough.

What it does

Given manifest.yml:

apiVersion: v1
kind: Secret
metadata:
  name: api-credentials
type: Opaque
data:
  DB_PASSWORD: c3VwZXItc2VjcmV0
  API_TOKEN: aGFtbWVydGltZQ==
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
data:
  LOG_LEVEL: debug

devops-utils sanitize manifest.yml -o -

apiVersion: v1
data:
  API_TOKEN: '***secret_hidden**'
  DB_PASSWORD: '***secret_hidden**'
kind: Secret
metadata:
  name: api-credentials
type: Opaque
---
apiVersion: v1
data:
  LOG_LEVEL: debug
kind: ConfigMap
metadata:
  name: api-config

The ConfigMap passes through untouched — only kind: Secret documents are masked.

Use cases

Paste a manifest into a ticket, chat, or an LLM prompt

The most common one. Dump the live object, mask it, and paste the result anywhere:

kubectl get secret api-credentials -o yaml > /tmp/secret.yml
devops-utils sanitize /tmp/secret.yml -o - | pbcopy   # or xclip / clip.exe

Attach a redacted manifest to a work item

devops-utils sanitize deploy.yml -o deploy.sanitized.yml
devops-utils azdo attach 42 ./deploy.sanitized.yml --comment "Redacted manifest"

Snapshot a whole namespace for a review

kubectl get all,secret,configmap -n staging -o yaml > staging.yml
devops-utils sanitize staging.yml -o staging.review.yml

Pre-commit guard for an example manifest

Keep a checked-in examples/deploy.yml honest by regenerating it from the real one:

devops-utils sanitize deploy.yml -o examples/deploy.yml --force

Options

Flag	Effect
`-o`, `--output`	Destination file, or `-` for stdout. Defaults to `<file>__debug__`
`--force`	Overwrite the output file without asking
`--debug`	Report each masked key on stderr

With no -o, the output lands next to the input as manifest.yml__debug__ — handy for a quick look, easy to forget about, so prefer an explicit -o.

Writing to an existing file prompts for confirmation unless --force is given; -o - never prompts, which is what makes it safe to put in a pipe.

From an agent or the MCP server

The same masking is available as sanitize_manifest(manifest: str) -> str — both as an MCP tool and as a plain Python callable — taking the manifest as a string rather than a path:

from devops_utils.agent.tools import sanitize_manifest

redacted = sanitize_manifest(open("manifest.yml", encoding="utf-8").read())

Unlike the Azure DevOps write tools, it needs no confirmation gate: it touches nothing outside its own input.