<p>I am looking for a static validator that validates Kubernetes deployment or service yaml files based on custom rules. For example, I can have a rule to disallow some fields in the yaml files (although they are valid fields in K8s), or specify a range for values of a field. The validation is triggered independent of kubectl.</p>

<p>The closest solution I found is this kube-lint: <a href="https://github.com/viglesiasce/kube-lint" rel="nofollow noreferrer">https://github.com/viglesiasce/kube-lint</a>. However, it does not seem to be supported since the last commit is March 2017.</p>

<p>Can anyone let me know if there is anything else that does the dynamic validation on K8s yaml files based on custom rules?</p>

DylanS
<p>I believe the thing you are looking for is an <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/" rel="nofollow noreferrer">Admission Controller</a> and its two baked-in kinds "validating" and "mutating." However, as the docs say, if that's not powerful enough for your needs there is also <a href="https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/" rel="nofollow noreferrer">Dynamic Admission Controller</a>.</p>

<p>Be sure to watch <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/" rel="nofollow noreferrer">Pod Security Policies</a> as it matures out of beta (or, I guess, try it even now)</p>

<p>I haven't ever used them to know what the user experience is like (such as: does <code>kubectl</code> offer a friendly message, or just "401: Nope" kind of thing?), but as for the "disallow some fields" part, I am pretty confident they will do exactly as you wish.</p>
