How to Validate Manifests Before a GitOps Sync

kubeconform validates rendered manifests against Kubernetes API schemas, so a typo fails the PR check instead of a live sync.

In a pull_request job, build the manifests with kustomize build and pipe them to kubeconform -strict. A schema error fails the check before the change can merge and deploy.

Steps

• Render the overlay with kustomize build.
• Pipe the output into kubeconform -strict.
• Add CRD schema locations for custom resources.
• Run it on pull_request so it gates the merge.

Workflow

on: [pull_request]
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: |
          curl -sSL https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz \
            | tar xz -C /usr/local/bin kubeconform
      - run: |
          kustomize build overlays/production |
          kubeconform -strict -summary \
            -schema-location default \
            -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json'

Gotchas

• Without a CRD schema location, custom resources are skipped; add the catalog URL to cover them.
• -strict rejects unknown fields, catching the typos a plain apply would silently ignore.

Related guides