From f79a1750218139c4935dec674ab990368045074e Mon Sep 17 00:00:00 2001
From: Ryan D McGuire <ryand_mcguire@sweetwater.com>
Date: Mon, 10 Aug 2026 17:12:47 -0400
Subject: [PATCH] rm kubeconform

---
 images/node-agent/Dockerfile | 66 ------------------------------------
 1 file changed, 66 deletions(-)

diff --git a/images/node-agent/Dockerfile b/images/node-agent/Dockerfile
index 0f3ca27..c61949f 100644
--- a/images/node-agent/Dockerfile
+++ b/images/node-agent/Dockerfile
@@ -39,72 +39,6 @@ RUN arch="$(apk --print-arch | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')"
 # packaged for Alpine either, so same treatment as yq: current upstream release, run it
 # in the same layer so a truncated download fails the build.
 #
-# ALL schemas are VENDORED, which is the whole point of this layer. The yamllint MCP
-# server in 50W/kube-manifests runs this image with NO network egress.
-#
-# Note that kubeconform's `-schema-location default` is a REMOTE URL
-# (raw.githubusercontent.com), so it is useless here — with no egress it fails for
-# EVERY kind, including built-ins like ConfigMap, and reports a download error rather
-# than anything about the manifest. Both schema sets below are therefore local, and
-# consumers must NOT pass `default`:
-#   builtin/  yannh/kubernetes-json-schema, master-standalone-strict (~62 MB / 1505)
-#   crds/     datreeio/CRDs-catalog, only the groups this cluster uses (~18 MB / 229)
-#
-# The CRD half matters most: without a local HelmRelease schema, a corrupted Flux
-# HelmRelease — the exact thing this is here to catch — comes back "skipped" rather
-# than "invalid". The full datree catalog is ~211 MB / 4177 schemas; sparse checkout
-# means the other 4000 blobs are never downloaded. To cover a new group, add it to
-# $groups and rebuild.
-#
-# Groups with NO published schema anywhere (toolhive.stacklok.dev, kagent.dev,
-# openclaw.rocks, inference.llmkube.dev) are absent by necessity; kubeconform is
-# invoked with -ignore-missing-schemas so those resources report as "skipped".
-#
-# Set BEFORE the RUN below so the build-time verification uses the same value consumers
-# do. Used by the yamllint MCP shim in 50W/kube-manifests (toolhive/cm-yamllint-mcp.yaml).
-ENV KUBECONFORM_SCHEMAS=/usr/local/share/kubeconform
-
-# $groups is word-split on purpose — it is a list of directory names, and both
-# `sparse-checkout set` and the `for` loop want it expanded into separate arguments.
-# hadolint ignore=SC2086
-RUN groups="acid.zalan.do ceph.rook.io cert-manager.io trust.cert-manager.io \
-        cilium.io external-secrets.io gateway.networking.k8s.io \
-        grafana.integreatly.org helm.toolkit.fluxcd.io jetstream.nats.io \
-        k8s.keycloak.org k8up.io kustomize.config.k8s.io \
-        kustomize.toolkit.fluxcd.io metallb.io monitoring.coreos.com \
-        monitoring.grafana.com networking.istio.io objectbucket.io \
-        operator.victoriametrics.com security.istio.io \
-        source.toolkit.fluxcd.io telemetry.istio.io valkey.io" \
-    && arch="$(apk --print-arch | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')" \
-    && curl -fsSL \
-        "https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-${arch}.tar.gz" \
-        | tar -xz -C /usr/local/bin kubeconform \
-    && chmod 0755 /usr/local/bin/kubeconform \
-    && kubeconform -v \
-    && mkdir -p "${KUBECONFORM_SCHEMAS}/crds" "${KUBECONFORM_SCHEMAS}/builtin" \
-    && git clone --depth 1 --filter=blob:none --sparse \
-        https://github.com/datreeio/CRDs-catalog.git /tmp/crds \
-    && git -C /tmp/crds sparse-checkout set $groups \
-    && for g in $groups; do cp -a "/tmp/crds/$g" "${KUBECONFORM_SCHEMAS}/crds/"; done \
-    && rm -rf /tmp/crds \
-    && git clone --depth 1 --filter=blob:none --sparse \
-        https://github.com/yannh/kubernetes-json-schema.git /tmp/kjs \
-    && git -C /tmp/kjs sparse-checkout set master-standalone-strict \
-    && cp -a /tmp/kjs/master-standalone-strict "${KUBECONFORM_SCHEMAS}/builtin/" \
-    && rm -rf /tmp/kjs \
-    # Prove the vendored schemas actually resolve, for a CRD kind AND a built-in kind.
-    # `-schema-location default` is deliberately absent: it is a remote URL, so
-    # including it would let this check pass on the network the build happens to have
-    # and still fail in the egress-less pod. A missing or renamed schema directory
-    # would otherwise only surface at run time as a silent "skipped", which is exactly
-    # the failure this layer exists to prevent.
-    && { printf 'apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n  name: t\nspec:\n  interval: 1h\n  chart:\n    spec:\n      chart: c\n      sourceRef:\n        kind: HelmRepository\n        name: r\n'; \
-         printf -- '---\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: c\n'; } \
-        | kubeconform -strict -summary -verbose \
-            -schema-location "${KUBECONFORM_SCHEMAS}/builtin/master-standalone-strict/{{.ResourceKind}}{{.KindSuffix}}.json" \
-            -schema-location "${KUBECONFORM_SCHEMAS}/crds/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json" \
-            -
-
 # Defaults that keep non-interactive agent shells from hanging or failing:
 #   * pagers off      — git/kubectl/helm otherwise block on `less` with no TTY
 #   * no git prompts  — a private remote without creds fails fast instead of waiting