Sign inSign up

antithesishq/k8s-validator

By antithesishq

•Updated about 1 year ago

Local validator for testing Kubernetes manifests for Antithesis.

Image
Integration & delivery
Developer tools
0

10K+

antithesishq/k8s-validator repository overview

⁠k8s-validator

⁠Overview

k8s-validator is a lightweight container image that helps you validate Kubernetes manifests before deploying them into Antithesis⁠ Kubernetes environments. This helps catch misconfigurations early. You can use it in your local tests, or as part of your CI/CD pipelines. It performs the following checks:

  • Schema correctness using kubeconform⁠
  • Deprecated APIs using pluto⁠
  • Custom best-practice policies using conftest⁠ and Rego rules tailored for single-node, air-gapped k3s clusters

👉 See the Kubernetes Best Practices Docs⁠ for details on the specific DOs and DON’Ts enforced by the Rego policies.

⁠Usage

You can validate a directory of manifests by mounting it on the container:

docker run --rm -v $(pwd):/manifests:ro docker.io/antithesishq/k8s-validator:1.0.0

By default the image runs the built-in validate.sh script which executes:

  1. kubeconform – schema validation
  2. pluto – deprecated API detection
  3. conftest – custom policy checks

⁠Example Output

The tool runs three steps and prints output like:

### 1. Schema Validation (kubeconform) ###
✖ /manifests/bad/bad_daemonset.yaml: DaemonSet bad-daemonset is invalid: problem validating schema. Check JSON formatting: jsonschema: additionalProperties 'label' not allowed
✖ /manifests/bad/bad_pod.yaml: Pod bad_pod is invalid: problem validating schema. Check JSON formatting: jsonschema: additionalProperties 'port' not allowed
Summary: 15 resources found in 15 files - Valid: 12, Invalid: 2, Errors: 0, Skipped: 1

----------------------------------------------------------
### 2. Deprecated API Checks (pluto) ###
NAME      NAMESPACE    KIND                      VERSION               REPLACEMENT      DEPRECATED   DEPRECATED IN   REMOVED   REMOVED IN   REPL AVAIL   REPL AVAIL IN  
bad-hpa   antithesis   HorizontalPodAutoscaler   autoscaling/v2beta2   autoscaling/v2   true         v1.23.0         false     v1.26.0      false                       


Want more? Automate Pluto for free with Fairwinds Insights!
 🚀 https://fairwinds.com/insights-signup/pluto 🚀 

----------------------------------------------------------
### 3. Custom Policy Checks (conftest) ###

450 tests, 411 passed, 23 warnings, 16 failures, 0 exceptions
FAIL - /manifests/bad/bad_pod.yaml - main - Pod 'bad_pod' uses 'imagePullPolicy: Always' which will not work in an air-gapped cluster
...
WARN - /manifests/bad/bad_daemonset.yaml - main - DaemonSet 'bad-daemonset' container 'nginx' missing readinessProbe. readinessProbes are recommended for better pod lifecycle management and readiness detection
...

Exit codes:

  • 0 if all checks pass (there can still be warnings present in the output)
  • 1 if any schema errors, deprecated APIs, or policy violations are found

Tag summary

Content type

Image

Digest

sha256:ec797565c…

Size

73.9 MB

Last updated

about 1 year ago

docker pull antithesishq/k8s-validator