Kubeval — Kubernetes Manifest Validator

Introduction

Kubeval is a command-line tool that validates Kubernetes configuration files against the published API schemas for a specific Kubernetes version. By catching invalid field names, wrong types, and missing required fields before applying manifests, it prevents deployment failures and misconfiguration issues in CI pipelines.

What Kubeval Does

• Validates YAML and JSON Kubernetes manifests against official OpenAPI schemas
• Supports targeting specific Kubernetes versions to catch version-incompatible configs
• Processes individual files, directories, or stdin input for pipeline integration
• Reports validation errors with clear messages indicating the failing field and expected type
• Runs in strict mode to reject unknown fields not defined in the schema

Architecture Overview

Kubeval is a single Go binary that loads Kubernetes OpenAPI schemas (JSON Schema format) from a bundled or remote schema repository. For each input manifest, it identifies the apiVersion and kind, selects the matching schema, and runs JSON Schema validation against the resource spec. Schemas are fetched from GitHub by default but can be pointed at a custom mirror for air-gapped environments.

Self-Hosting & Configuration

• Download a single binary from GitHub releases for Linux, macOS, or Windows
• Specify Kubernetes version with --kubernetes-version flag
• Use --schema-location to point to custom or offline schema repositories
• Integrate into CI with exit code 1 on validation failures
• Combine with Helm by piping helm template output to kubeval via stdin

Key Features

• Fast validation with zero cluster dependencies; works entirely offline with bundled schemas
• Supports all standard Kubernetes resource types and custom resource definitions via schema extensions
• SARIF and JSON output formats for integration with code scanning platforms
• Glob patterns for validating entire directories of manifests recursively
• Exit codes distinguish between validation errors and tool failures for CI scripting

Comparison with Similar Tools

• kubeconform — Actively maintained fork of kubeval with better CRD support and parallel file processing
• kubectl --dry-run — Requires cluster access; kubeval validates purely against schemas without a cluster
• Datree — Policy enforcement with built-in rules; kubeval focuses on schema validation only
• Polaris — Best practices auditing; kubeval catches structural errors rather than policy violations

FAQ

Q: Is kubeval still maintained? A: Kubeval is in maintenance mode. For active development and CRD support, consider kubeconform, which is a compatible successor.

Q: Can kubeval validate custom resources (CRDs)? A: Limited CRD support exists via custom schema locations. kubeconform handles CRDs more robustly.

Q: How do I use kubeval with Helm charts? A: Pipe rendered templates: helm template mychart | kubeval --strict

Q: Does kubeval modify my manifests? A: No, kubeval is read-only. It validates and reports errors without changing any files.

Sources

• https://github.com/instrumenta/kubeval
• https://kubeval.instrumenta.dev/