# datree: Manifest Policy Checks (Deprecated)

> datree test policy-checked Kubernetes manifests but the project is discontinued. Reference for datree test, its offline mode, and modern replacements for CI.

Source: https://latchkey.dev/learn/command-reference/datree-deprecated  
Updated: 2026-06-30

datree test ran schema validation plus policy checks on Kubernetes manifests, but Datree was discontinued; use kubeconform with kube-score, Polaris, or KubeLinter instead.

Datree combined manifest validation and best-practice policy in one CLI, with a hosted policy dashboard. The product was shut down, so this page exists to help you recognize and replace datree steps in inherited pipelines.

## What it does

datree test validated manifests against Kubernetes schemas and evaluated a set of built-in and custom policies, reporting rule violations. It offered an offline mode, but its default flow relied on a hosted backend that no longer exists.

## Common usage

```Terminal
# legacy invocation
datree test deployment.yaml
# offline mode used in air-gapped CI
datree test deployment.yaml --offline local
# modern replacements (validation + best practices)
kubeconform -summary -strict deployment.yaml
kube-score score deployment.yaml
```

## Options

| Flag | What it does |
| --- | --- |
| <path> | Manifest file, directory, or glob to test |
| --offline <mode> | Run without the hosted backend (local) |
| -o, --output <fmt> | Output format: json, yaml, xml, JUnit, simple |
| --only-k8s-files | Restrict to files that look like Kubernetes manifests |

## Migration and CI

Because the Datree service is gone, jobs that call datree without --offline can hang or fail contacting the backend. Split its two jobs across maintained tools: kubeconform for schema validation and kube-score, Polaris, or KubeLinter for best-practice policy. For Rego-style custom rules, conftest or Kyverno CLI cover the gap.

## Common errors in CI

"command not found: datree" on refreshed runner images signals the tool was removed; do not reinstall it, migrate off. Network timeouts or "failed to send report" errors come from the retired hosted backend. If a legacy step still runs, force --offline local to avoid the dead API, then plan the replacement.

## Using this in CI

A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.

```Terminal
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods

# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info

# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes
```

> Always set `--request-timeout` in CI. Without it an unreachable API server hangs until the job times out, which turns a thirty-second failure into a twenty-minute one.

## FAQ

### datree: Manifest Policy Checks (Deprecated)?

Datree combined manifest validation and best-practice policy in one CLI, with a hosted policy dashboard. The product was shut down, so this page exists to help you recognize and replace datree steps in inherited pipelines.

### What it does?

datree test validated manifests against Kubernetes schemas and evaluated a set of built-in and custom policies, reporting rule violations. It offered an offline mode, but its default flow relied on a hosted backend that no longer exists.

### Migration and CI?

Because the Datree service is gone, jobs that call datree without --offline can hang or fail contacting the backend. Split its two jobs across maintained tools: kubeconform for schema validation and kube-score, Polaris, or KubeLinter for best-practice policy. For Rego-style custom rules, conftest or Kyverno CLI cover the gap.

### Common errors in CI?

"command not found: datree" on refreshed runner images signals the tool was removed; do not reinstall it, migrate off. Network timeouts or "failed to send report" errors come from the retired hosted backend. If a legacy step still runs, force --offline local to avoid the dead API, then plan the replacement.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt