This repository contains resources for the blog post:
"A Deep Dive Into Kubernetes Schema Validation"

This dir contains seven Kubernetes manifest files, each with a different misconfiguration:

wrong: apiVersion: apps/v1beta2
correct: apiVersion: apps/v1
reason: apps/v1beta2 was deprecated for resource type "Deployment" in Kubernetes version 1.18.0

wrong: kind: pod
correct: kind: Pod
reason: resource type must start with a capital letter - Pod

wrong: owner: ---
correct: owner: frodo-baggins
reason: labels values must start and end with an alphanumeric letter

wrong: protocol: 22
correct: protocol: TCP
reason: protocol type must be a string

wrong: Spec:
correct: spec:
reason: spec must start with a small 's'

wrong:

containers:
    - name: web

correct:

containers:
    - name: web
      image: nginx

reason: each container must include an image name

wrong:

spec:
containers:
  - name: web
    image: nginx
    ports:
      - name: web
        containerPort: 80
        protocol: TCP

correct:

spec:
  containers:
  - name: web
    image: nginx
    ports:
    - name: web
      containerPort: 80
      protocol: TCP

reason: Kubernetes\YAML indentation requires one tab space when listing containers

This dir contains 100 valid Kubernetes manifest files.
All files contain the same Kubernetes configuration.

kubeval: kubeval --strict misconfigs/*.yaml -v "1.18.0"
kubeconform: kubeconform -strict misconfigs/*.yaml
kubectl dry-run in client mode: kubectl apply -f misconfigs/ --dry-run=client
kubectl dry-run in server mode: kubectl apply -f misconfigs/ --dry-run=server

🔧 prerequisite - hyperfine installed

kubeval: hyperfine --warmup 5 'kubeval --strict benchmark/*.yaml -v "1.18.0"'
kubeconform: hyperfine --warmup 5 'kubeconform -strict benchmark/*.yaml'
kubectl dry-run in client mode: hyperfine --warmup 5 'kubectl apply -f benchmark/ --dry-run=client'
kubectl dry-run in server mode: hyperfine --warmup 5 'kubectl apply -f benchmark/ --dry-run=server'

• My article about K8s schema validation
• Open an issue here if you have any questions on this topic (k8s schema)
• kubectl --dry-run=client bug - kubernetes/issues/51475
• Datree's CLI tool to ensure K8s manifests and Helm charts follow best practices
• How to check CRDs and schema with Datree - docs