Validate Kubernetes Manifests with kubeconform

Validate manifests against the target server schema with kubeconform in CI before they reach the cluster.

~25 minkubernetesopsvalidation

Task

Add schema validation to CI so malformed Kubernetes manifests fail before apply.

When to use this

A typo in an apiVersion reaches the cluster and fails mid-rollout, causing a partial deployment.

Prerequisites

kubeconform installed in CI
A pinned Kubernetes schema version
Manifests generated or stored in Git

Steps

1. Validate all manifests against the target Kubernetes version.

kubeconform -kubernetes-version 1.30.0 -strict -summary \
  -ignore-missing-schemas ./deploy/**/*.yaml

Expected output: Invalid apiVersion or field errors are reported with file and line before apply.

2. Wire it as a required CI step.

- name: Validate manifests
  run: |
    kubeconform -strict -summary -ignore-missing-schemas deploy/

Expected output: Pull requests that break schemas fail the required check.

Troubleshooting

Problem

Custom resources flagged as unknown

Solution

Export CRD schemas or use -ignore-missing-schemas for known custom resources.

Problem

Helm templates not validated

Solution

Render with helm template first, then validate the rendered output.

Limitations

Schema validation is not runtime admission testing.
CRDs need their own schemas to be checked.
Does not validate values or cross-resource references.

What this recipe does

Add schema validation to CI so malformed Kubernetes manifests fail before apply.

A typo in an apiVersion reaches the cluster and fails mid-rollout, causing a partial deployment.

Prerequisites

kubeconform installed in CI
A pinned Kubernetes schema version
Manifests generated or stored in Git

Procedure

Validate all manifests against the target Kubernetes version.

kubeconform -kubernetes-version 1.30.0 -strict -summary \
  -ignore-missing-schemas ./deploy/**/*.yaml

Expected result: Invalid apiVersion or field errors are reported with file and line before apply.

Wire it as a required CI step.

- name: Validate manifests
  run: |
    kubeconform -strict -summary -ignore-missing-schemas deploy/

Expected result: Pull requests that break schemas fail the required check.

How to confirm it worked

Run the commands above and confirm every expected result in order. If a step does not produce the stated output, use the troubleshooting notes before continuing. A passing run shows an intentionally broken manifest fails CI while a correct one passes before any cluster apply.

Troubleshooting

Custom resources flagged as unknown — Export CRD schemas or use -ignore-missing-schemas for known custom resources.

Helm templates not validated — Render with helm template first, then validate the rendered output.

Limitations

Schema validation is not runtime admission testing.
CRDs need their own schemas to be checked.
Does not validate values or cross-resource references.