kubectl 1.34 (azure/setup-kubectl@v3) keeps an API-discovery roundtrip even with --dry-run=client --validate=false, hitting localhost:8080 and exiting 1 on connection refused. There is no kube-apiserver in CI.
kubeconform validates manifests against the upstream OpenAPI schema fully offline. Locally on the same 4 manifests this PR scans, kubeconform reports 13 resources found in 4 files - Valid: 13, Invalid: 0, Errors: 0, Skipped: 0, so the job will report green once the binary install step lands.
kube-score scan still runs after kubeconform on the same expanded glob (k8s/base/**/*.yaml + k8s/base/*.yaml) for best-practices feedback.
Co-Authored-By: Nakamoto, S <[email protected]>
Devin AIandNakamoto, S <[email protected]>
494299582c