And also because the API schema doesn't express state machine constraints. For example, you can't modify some fields of a statefulset or a job after they've be

And also because the API schema doesn't express state machine constraints. For example, you can't modify some fields of a statefulset or a job after they've been created. The read-only state of certain fields depend on the status of the object. Validating purely with OpenAPI also won't catch things like a volume mount referencing a secret that doesn't exist. At the company I work for, I built some tools for deploying apps that wrap around kubectl, Helm, etc. To "lint" a Kubernetes manifest for deploy, the tool pipes the data through "kubectl apply --server-dry-run" first. (You can also use --dry-run for pure client-side validation.) Works pretty good.