6.5Integrating Validation into CI

# .github/workflows/k8s-validation.yml
name: Kubernetes Manifest Validation
on:
  pull_request:
    paths:
      - 'k8s/**'
      - 'charts/**'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Schema validation
        run: kubeconform -strict -summary k8s/

      - name: Best practices check
        run: |
          kube-score score k8s/*.yaml
          EXIT_CODE=$?
          if [ $EXIT_CODE -ne 0 ]; then
            echo "kube-score found issues. Review above output."
            exit 1
          fi

      - name: Policy audit
        run: |
          polaris audit --audit-path k8s/ \
            --set-exit-code-below-score 80 \
            --format=pretty

Manifest validation is one of the highest-value, lowest-cost practices in Kubernetes security. It runs in seconds, catches real issues, and prevents misconfigurations that take hours to debug in production.