Flux CRDs json schemas for use with kubeval

[brpaz]

Hello.

Are the json schemas for flux CRDs (HelmRelease, GitRepository etc) available somewhere, so that I can use kubeval for validating my manifests?

[seaneagan]

I assume this would mean creating some CI (ideally a reusable github action) which generates the JSON schemas from CRDs in one repo and pushes them to a separate JSON schema github repo, which would then serve as an argument to kubeval's --additional-schema-locations option. It looks like there were some community efforts around doing this for for Helm Operator v1 HelmRelease. Long term it would be great to see an "official" version of this for Flux v2 CRDs, but short term a POC would be great as well if anyone out there has the bandwidth?

[brpaz]

Yep. That sums the way I was thinking of using them with kubeval additional-schema-locations property.

I think it would be nice to have some generic cli tool that could extract Open API definisions from Kubernetes CRDs. That way it could be used by multiple projects, I have done a quick search and couldnt find any. Not sure how they do it at /kubernetes-json-schema.

Then would be a matter of running the tool on CI to generate the schemas and publish somewhere. (Could be GitHub Pages, Netlify).

I might give it a try If I have some time to build a cli tool in Golang to do that conversion. Need to investigate better.

[willejs]

Any updates on this @stefanprodan? I have seen the PR in pkg... I am happy to help if needed.

[stefanprodan]

I got it working here fluxcd/kustomize-controller#276, if you look at the CI jobs you'll see that kubval validates the Flux Kustomization:

kubeval config/samples/kustomize_v1beta1_kustomization.yaml --strict --schema-location=file://./bin
PASS - config/samples/kustomize_v1beta1_kustomization.yaml contains a valid Kustomization (webapp-dev)
PASS - config/samples/kustomize_v1beta1_kustomization.yaml contains a valid Kustomization (webapp-production)

I'm stuck on some Python changes and I would appreciate some help.

[stefanprodan]

This has been implemented in flux2 v0.12.2. Here is an example on how to validate Flux custom resources:

# download Flux OpenAPI schemas
mkdir -p /tmp/flux-crd-schemas/master-standalone-strict
curl -sL https://github.com/fluxcd/flux2/releases/latest/download/crd-schemas.tar.gz | tar zxf - -C /tmp/flux-crd-schemas/master-standalone-strict

# validate Flux custom resources
kubeval my-helm-release.yaml --strict --additional-schema-locations=file:///tmp/flux-crd-schemas

For an example of how to validate Kubernetes manifests in CI see: fluxcd/flux2-kustomize-helm-example#19

[chuegel]

Well, I do not need to validate them but the validate.sh script is running against them.

[jgz]

I'm having the same problem. I followed the examples and everything was working fine until I added sops. Now e2e and the test actions are failing.

[cwrau]

@stefanprodan is there a possiblity to host those schemas as plaintext somewhere? Maybe just as a release asset?

If I want to include the json schema in another schema, or just reference it plainly,, like with # yaml-language-server: $schema=https://????,,, using a compressed file isn't possible

[stefanprodan]

See https://github.com/fluxcd-community/flux2-schemas

[cwrau]

See https://github.com/fluxcd-community/flux2-schemas

Ah, didn't see that, thanks!

[stefanprodan]

Plain text schemas are published here https://github.com/fluxcd-community/flux2-schemas

[rcarre]

Thx @stefanprodan for the Url pointing to Flux CRDs OpenAPI schemas
Unless I am wrong, these schemas do not specify the the OpenAPI extensions x-kubernetes-patch-* in order to apply Kustomize Strategic Merge Patch to Flux CRDs, do they ?
In such a case, I should manage a customized key:value x-kubernetes-patch-strategy:merge to avoid default behavior, which in Kustomize, is replace
Have a good day

[rcarre]

Solved by Strategic Merge instead of JSON patch