kubeconform -strict: Reject Unknown Fields
kubeconform -strict treats unknown or misspelled fields as validation errors instead of ignoring them.
By default a typo like replcas validates fine because schemas allow additional properties. -strict turns those silent drops into hard failures, which is exactly what you want in CI.
What it does
-strict sets additionalProperties: false semantics, so any field not defined in the resource schema fails validation. This catches the misspelled keys that the API server would otherwise accept and ignore, leaving your config inert.
Common usage
kubeconform -strict -summary manifests/
kubeconform -strict -kubernetes-version 1.29.0 deploy.yamlOptions
| Flag | What it does |
|---|---|
| -strict | Fail on fields absent from the schema |
| -summary | Print valid/invalid/skipped counts |
| -verbose | Print each resource as it is checked |
| -skip | Kinds to exempt from validation |
In CI
Make -strict the default in pipelines. The classic catch is replcas instead of replicas: without -strict the Deployment validates and ships with the wrong replica count; with -strict the build fails with a clear message at the offending key.
Common errors in CI
problem validating schema. Check JSON formatting: ... additionalProperties "replcas" not allowed is the typo case (good, that is the point). For genuinely valid custom fields (some CRDs), -strict will over-report; scope it to core kinds and validate CRDs separately, or supply their real schemas via -schema-location.