Skip to content
Latchkey

kubectl "error validating data" - Fix Manifest Validation in CI

kubectl validated your manifest against the resource schema and found something that does not belong - an unknown field, a wrong type, or a misplaced key. Nothing is applied until the manifest validates.

What this error means

kubectl apply aborts before contacting the cluster (or right after fetching the schema) with error validating data: ValidationError(...), naming the field it could not place. The same YAML fails the same way every run - it is a static error in the manifest.

kubectl output
error validating data: ValidationError(Deployment.spec.template.spec.containers[0]):
unknown field "imagePullPolicyy" in io.k8s.api.core.v1.Container; if you choose to ignore
these errors, turn validation off with --validate=false

Common causes

A misspelled or unknown field

A typo like imagePullPolicyy, or a field that does not exist on that resource version, fails schema validation. Server-side apply rejects unknown fields by default.

Wrong type or indentation

A scalar where a list is expected (or vice versa), or a key nested one level too deep, produces a ValidationError for a field that "should" exist but landed in the wrong place.

How to fix it

Dry-run against the server before applying

A server-side dry run validates the manifest against the live API schema without changing anything, surfacing the exact bad field in CI.

Terminal
kubectl apply --dry-run=server -f deploy.yaml

Check the field against the resource schema

  1. Read the field name in the error - it names the exact path that failed.
  2. Run kubectl explain deployment.spec.template.spec.containers to see the valid fields and types.
  3. Fix the typo or correct the nesting, then re-run the dry run until it is clean.

Lint manifests in CI

Catch schema errors before they reach the cluster with a static validator.

Terminal
kubeconform -strict -summary deploy.yaml

How to prevent it

  • Run kubectl apply --dry-run=server in CI before the real apply.
  • Validate manifests with kubeconform or the API schema in the pipeline.
  • Pin the apiVersion to one your cluster actually serves.

Related guides

Tired of flaky CI? Latchkey auto-heals failed jobs and retries them for you. Start free →