6.2Validation Tool Comparison

Tool	Focus	Approach	CRD Support	Speed
kubeval	Schema validation	Validates against K8s API schemas	Limited	Fast
kubeconform	Schema validation	Faster kubeval replacement	Yes (via plugins)	Very fast
kube-score	Best practices	Opinionated checks (security, reliability)	No	Fast
Polaris	Policy enforcement	Fairwinds' policy engine	Yes	Fast
Datree	Policy enforcement	Built-in + custom rules	Yes	Fast
OPA/Gatekeeper	Admission control	Custom Rego policies in-cluster	Yes	Fast

kubeval and kubeconform

# kubeval: validates manifests against K8s API schemas
kubeval deployment.yaml --kubernetes-version 1.29.0

# kubeconform: faster kubeval replacement with CRD support
kubeconform -strict -kubernetes-version 1.29.0 deployment.yaml

# Validate all manifests in a directory
kubeconform -strict -summary k8s/

# Validate Helm-rendered templates
helm template myapp ./charts/myapp/ | kubeconform -strict

# Use with custom resource definitions
kubeconform -strict \
  -schema-location default \
  -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
  k8s/

kube-score

kube-score checks for best practices rather than schema validity:

# Score a deployment manifest
kube-score score deployment.yaml
# Output:
# apps/v1/Deployment myapp: (CRITICAL) Container has no readiness probe
# apps/v1/Deployment myapp: (CRITICAL) No network policy matching pod
# apps/v1/Deployment myapp: (WARNING) CPU limit is not set

# Score all manifests in a directory
kube-score score k8s/*.yaml

# Output as JSON for CI parsing
kube-score score deployment.yaml --output-format json

# Ignore specific checks
kube-score score deployment.yaml \
  --ignore-test container-cpu-limit \
  --ignore-test pod-networkpolicy

Polaris

Polaris provides both CLI scanning and in-cluster admission control:

# Audit local manifests
polaris audit --audit-path ./k8s/ --format=pretty
# Checks: resource limits, health probes, security context,
# image pull policy, host network access, privilege escalation

# Audit with a minimum score threshold
polaris audit --audit-path ./k8s/ --set-exit-code-below-score 80

# Run Polaris as a Kubernetes admission controller
helm repo add fairwinds-stable https://charts.fairwinds.com/stable
helm install polaris fairwinds-stable/polaris --namespace polaris