# kubeconform -summary -strict: Validate Manifests

> kubeconform validates Kubernetes manifests against JSON schemas, fast and offline. Reference for -summary, -strict, -schema-location, and the schema-not-found errors in CI.

Source: https://latchkey.dev/learn/command-reference/kubeconform-strict-summary  
Updated: 2026-06-30

kubeconform checks that Kubernetes manifests conform to the API schemas for a given version, exiting non-zero when a resource is invalid.

kubeconform is the maintained successor to kubeval: a fast, parallel manifest validator that reads JSON schemas and works fully offline once schemas are cached. It is the standard first gate on any manifest PR.

## What it does

kubeconform parses each manifest and validates it against the OpenAPI-derived JSON schema for its apiVersion and kind. -summary prints a totals line; -strict rejects unknown fields (properties not in the schema). It fetches schemas from a schema store, or from a local path with -schema-location.

## Common usage

```Terminal
# validate against a target k8s version, strict, with a summary
kubeconform -summary -strict -kubernetes-version 1.29.0 deployment.yaml
# validate a directory of manifests
kubeconform -summary -strict ./manifests
# use a local (offline) schema location for CRDs
kubeconform -strict \
  -schema-location default \
  -schema-location './schemas/{{.ResourceKind}}.json' crd-resource.yaml
```

## Options

| Flag | What it does |
| --- | --- |
| -strict | Reject unknown/additional fields not in the schema |
| -summary | Print a summary of valid, invalid, skipped counts |
| -kubernetes-version <v> | Target API version to validate against (or master) |
| -schema-location <loc> | Schema source; repeatable, supports templated paths |
| -ignore-missing-schemas | Skip (not fail) resources with no schema, e.g. CRDs |
| -output <fmt> | Output format: text, json, junit, tap |

## In CI

Run kubeconform -summary -strict as the first manifest gate. For air-gapped runners, download the schema bundle once and pass -schema-location to a local path so it never hits the network. For CRDs, either add a schema-location that resolves them or use -ignore-missing-schemas to avoid false failures.

## Common errors in CI

"deployment.yaml - Deployment is invalid: ... additionalProperties ... not allowed" appears under -strict when a field is misspelled or unsupported. "could not find schema for <Kind>" (or "failed to download schema") means no schema-location resolved that kind, common for CRDs; add a schema-location or -ignore-missing-schemas. A non-zero exit accompanies any invalid resource; the -summary line shows the counts.

## Using this in CI

A runner has no kubeconfig, no cached context, and no interactive auth. Every kubectl invocation in CI needs the context supplied explicitly, and most confusing CI failures here are the command running against the wrong cluster or no cluster at all.

```Terminal
# never rely on the ambient context on a runner
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" get pods

# confirm what you are actually connected to before mutating anything
kubectl config current-context
kubectl cluster-info

# fail fast instead of hanging on an unreachable API server
kubectl --request-timeout=30s get nodes
```

> Always set `--request-timeout` in CI. Without it an unreachable API server hangs until the job times out, which turns a thirty-second failure into a twenty-minute one.

## FAQ

### kubeconform -summary -strict: Validate Manifests?

kubeconform is the maintained successor to kubeval: a fast, parallel manifest validator that reads JSON schemas and works fully offline once schemas are cached. It is the standard first gate on any manifest PR.

### What it does?

kubeconform parses each manifest and validates it against the OpenAPI-derived JSON schema for its apiVersion and kind. -summary prints a totals line; -strict rejects unknown fields (properties not in the schema). It fetches schemas from a schema store, or from a local path with -schema-location.

### In CI?

Run kubeconform -summary -strict as the first manifest gate. For air-gapped runners, download the schema bundle once and pass -schema-location to a local path so it never hits the network. For CRDs, either add a schema-location that resolves them or use -ignore-missing-schemas to avoid false failures.

### Common errors in CI?

"deployment.yaml - Deployment is invalid: ... additionalProperties ... not allowed" appears under -strict when a field is misspelled or unsupported. "could not find schema for <Kind>" (or "failed to download schema") means no schema-location resolved that kind, common for CRDs; add a schema-location or -ignore-missing-schemas.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt