kubeconform -summary -strict: Validate Manifests
kubeconform checks that Kubernetes manifests conform to the API schemas for a given version, exiting non-zero when a resource is invalid.
kubeconform is the maintained successor to kubeval: a fast, parallel manifest validator that reads JSON schemas and works fully offline once schemas are cached. It is the standard first gate on any manifest PR.
What it does
kubeconform parses each manifest and validates it against the OpenAPI-derived JSON schema for its apiVersion and kind. -summary prints a totals line; -strict rejects unknown fields (properties not in the schema). It fetches schemas from a schema store, or from a local path with -schema-location.
Common usage
# validate against a target k8s version, strict, with a summary
kubeconform -summary -strict -kubernetes-version 1.29.0 deployment.yaml
# validate a directory of manifests
kubeconform -summary -strict ./manifests
# use a local (offline) schema location for CRDs
kubeconform -strict \
-schema-location default \
-schema-location './schemas/{{.ResourceKind}}.json' crd-resource.yamlOptions
| Flag | What it does |
|---|---|
| -strict | Reject unknown/additional fields not in the schema |
| -summary | Print a summary of valid, invalid, skipped counts |
| -kubernetes-version <v> | Target API version to validate against (or master) |
| -schema-location <loc> | Schema source; repeatable, supports templated paths |
| -ignore-missing-schemas | Skip (not fail) resources with no schema, e.g. CRDs |
| -output <fmt> | Output format: text, json, junit, tap |
In CI
Run kubeconform -summary -strict as the first manifest gate. For air-gapped runners, download the schema bundle once and pass -schema-location to a local path so it never hits the network. For CRDs, either add a schema-location that resolves them or use -ignore-missing-schemas to avoid false failures.
Common errors in CI
"deployment.yaml - Deployment is invalid: ... additionalProperties ... not allowed" appears under -strict when a field is misspelled or unsupported. "could not find schema for <Kind>" (or "failed to download schema") means no schema-location resolved that kind, common for CRDs; add a schema-location or -ignore-missing-schemas. A non-zero exit accompanies any invalid resource; the -summary line shows the counts.