Feature: Make json-schema files available

[bjartek]

We are using https://kubeval.instrumenta.dev/ to validate kubernetes manifests against their schema. Currently we are skipping kinds that does not have a schema since we do not have access to the AZO schema files. Can you make them available in the release in github or in some other way?

[matthchr]

@bjartek - I'm not super familiar with kubeval, but their documentation on CRDs says:

Currently kubeval relies on schemas generated from the Kubernetes API. This means it's not possible to validate resources using CRDs.

Since all ASO resources are CRDs, it seems validating them using kubeval isn't supported?

The schemas for the CRDs are the CRDs themselves, which are really OpenAPI schemas and should adhere to the Kubernetes structural schema.

[bjartek]

That documentation is wrong. I will get them to fix it.

Here is how the flux ppl do it https://github.com/fluxcd/flux2-kustomize-helm-example/blob/main/scripts/validate.sh

[matthchr]

I see, and they generate those schemas by running an action which you can see defined here. Specifically they seem to be executing this python script to extract the JSON schema from the OpenAPI specification.

To workaround our lack of schemas right now you can just transform the CRD YAMLs into JSON schemas yourself by using that same script/Dockerfile. The YAMLs are in included in the ASO release in the setup.yaml file.

I'm a bit surprised that Kubeval doesn't just understand how to do that itself though - it seems awkward to require CRD authors to do what amounts to some simple transformations on the CRDs they're publishing. Kubeval could just as easily do those transforms on their side and it'd work for every CRD out of the box. Actually I see that even others have pointed this out in this issue (this issue also has some docs around how to do the conversions).

[bjartek]

Awesome research! I will look into this :)

[theunrepentantgeek]

This discussion seems to have resolved the original request; closing the issue.