--- title: Validating, scoring, and gating Kubernetes configuration... description: A walkthrough of integrating multiple Kubernetes configuration validation tools (Kyverno, OPA Gatekeeper, Kubescape, kube-linter, kube-score, kubepug,... canonical: https://daily.dev/posts/validating-scoring-and-gating-kubernetes-configuration-after-every-change-1umvnppcm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Validating, scoring, and gating Kubernetes configuration after every change | daily.dev og:description: A walkthrough of integrating multiple Kubernetes configuration validation tools (Kyverno, OPA Gatekeeper, Kubescape, kube-linter, kube-score, kubepug,... og:url: https://daily.dev/posts/validating-scoring-and-gating-kubernetes-configuration-after-every-change-1umvnppcm og:image: https://api.daily.dev/og/posts/1UMVnPpCM.png og:image:alt: Validating, scoring, and gating Kubernetes configuration after every change og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Validating, scoring, and gating Kubernetes configuration after every change **[ITNEXT](https://daily.dev/sources/itnext)** · 8 min read · 0 upvotes · 0 comments ## Summary A walkthrough of integrating multiple Kubernetes configuration validation tools (Kyverno, OPA Gatekeeper, Kubescape, kube-linter, kube-score, kubepug, kubeconform) with ConfigHub to automatically validate, score, and gate deployments after every configuration change. The approach converts tool output to a consistent JSON format and attaches Apply Gates to block or warn on violations. A key motivation is supporting AI agents that generate Kubernetes YAML — fast, structured validation feedback enables agents to iterate and self-correct without waiting for CI pipelines. A demo shows Claude Code diagnosing policy violations and proposing fixes across a fleet of units. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How is validating Kubernetes config with admission webhooks different from kubectl apply --dry-run=server --validate=true? Admission webhook validation through triggers does not require cluster credentials, gives more control over which specific checks run so failure causes can be isolated and reported separately, and makes it easier to extract detailed failure information. This makes it more suitable for programmatic consumption by AI agents than parsing dry-run output. _Anyone building agent-driven Kubernetes workflows can dig into validation approaches like these on daily.dev._ ### Which Kubernetes policy and validation tools can be integrated with ConfigHub triggers? ConfigHub triggers currently support Kyverno (CEL-based, via CLI and admission webhook), Open Policy Agent Gatekeeper and Kubescape (both Rego-based), kube-linter and kube-score for production readiness, kubepug for deprecated API detection, and kubeconform for schema validation. Each tool's output is normalized into a consistent JSON format with messages, resource types, failing paths, and scores. _Developers comparing Kubernetes policy tooling can track options like these on daily.dev._ ### Why do AI coding agents need validating triggers instead of relying on CI to check Kubernetes configuration? AI agents generate and modify Kubernetes YAML but make mistakes and are not reliably aware of organizational policies even when given skill documents, so they need fast, concise, machine-readable verification to iterate and fix their own output. CI-based rendering and validation can take minutes and requires git commit and push cycles, which is too slow for an agent's act-and-fix loop compared to trigger-based checks. _Teams pairing AI agents with Kubernetes config changes can follow guardrail patterns like these on daily.dev._ ## Similar posts on daily.dev - [Vetting Kubernetes configuration with Kyverno prior to deployment](https://daily.dev/posts/vetting-kubernetes-configuration-with-kyverno-prior-to-deployment-m3cfjuial) · ITNEXT · 1 upvotes · 0 comments - [Four Layers of Validation in Kubernetes with Claude Code](https://daily.dev/posts/four-layers-of-validation-in-kubernetes-with-claude-code-kckstnypq) · MetalBear · 0 upvotes · 0 comments - [Top 12 Policy as Code \(PaC\) Tools in 2025](https://daily.dev/posts/top-12-policy-as-code-pac-tools-in-2025-fcemrkpds) · Spacelift · 2 upvotes · 0 comments - [Guardrails, not gates: rethinking policy in platform teams](https://daily.dev/posts/guardrails-not-gates-rethinking-policy-in-platform-teams-29yyf9e18) · CNCF · 1 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#ai-agents](https://daily.dev/tags/ai-agents), [#kyverno](https://daily.dev/tags/kyverno) [View this post on daily.dev](https://daily.dev/posts/validating-scoring-and-gating-kubernetes-configuration-after-every-change-1umvnppcm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Validating, scoring, and gating Kubernetes configuration after every change","url":"https://daily.dev/posts/validating-scoring-and-gating-kubernetes-configuration-after-every-change-1umvnppcm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/validating-scoring-and-gating-kubernetes-configuration-after-every-change-1umvnppcm"},"datePublished":"2026-07-29T16:31:43.414Z","dateModified":"2026-09-13T19:05:35.425Z","description":"A walkthrough of integrating multiple Kubernetes configuration validation tools (Kyverno, OPA Gatekeeper, Kubescape, kube-linter, kube-score, kubepug,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d0b3e996b70f636124be9fe965805c0c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d0b3e996b70f636124be9fe965805c0c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ITNEXT","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ITNEXT","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/itnext2","url":"https://daily.dev/sources/itnext"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/validating-scoring-and-gating-kubernetes-configuration-after-every-change-1umvnppcm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,ai-agents,kyverno","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ITNEXT","item":"https://daily.dev/sources/itnext"},{"@type":"ListItem","position":3,"name":"Validating, scoring, and gating Kubernetes configuration after every change"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/validating-scoring-and-gating-kubernetes-configuration-after-every-change-1umvnppcm#faq","mainEntity":[{"@type":"Question","name":"How is validating Kubernetes config with admission webhooks different from kubectl apply --dry-run=server --validate=true?","acceptedAnswer":{"@type":"Answer","text":"Admission webhook validation through triggers does not require cluster credentials, gives more control over which specific checks run so failure causes can be isolated and reported separately, and makes it easier to extract detailed failure information. This makes it more suitable for programmatic consumption by AI agents than parsing dry-run output. Anyone building agent-driven Kubernetes workflows can dig into validation approaches like these on daily.dev."}},{"@type":"Question","name":"Which Kubernetes policy and validation tools can be integrated with ConfigHub triggers?","acceptedAnswer":{"@type":"Answer","text":"ConfigHub triggers currently support Kyverno (CEL-based, via CLI and admission webhook), Open Policy Agent Gatekeeper and Kubescape (both Rego-based), kube-linter and kube-score for production readiness, kubepug for deprecated API detection, and kubeconform for schema validation. Each tool's output is normalized into a consistent JSON format with messages, resource types, failing paths, and scores. Developers comparing Kubernetes policy tooling can track options like these on daily.dev."}},{"@type":"Question","name":"Why do AI coding agents need validating triggers instead of relying on CI to check Kubernetes configuration?","acceptedAnswer":{"@type":"Answer","text":"AI agents generate and modify Kubernetes YAML but make mistakes and are not reliably aware of organizational policies even when given skill documents, so they need fast, concise, machine-readable verification to iterate and fix their own output. CI-based rendering and validation can take minutes and requires git commit and push cycles, which is too slow for an agent's act-and-fix loop compared to trigger-based checks. Teams pairing AI agents with Kubernetes config changes can follow guardrail patterns like these on daily.dev."}}]} ```