rm kubeconform

2026-08-10 17:12:47 -04:00
parent 552d3dd289
commit f79a175021
1 changed files with 0 additions and 66 deletions
@@ -39,72 +39,6 @@ RUN arch="$(apk --print-arch | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')"
 # packaged for Alpine either, so same treatment as yq: current upstream release, run it
 # in the same layer so a truncated download fails the build.
 #
 # ALL schemas are VENDORED, which is the whole point of this layer. The yamllint MCP
 # server in 50W/kube-manifests runs this image with NO network egress.
 #
 # Note that kubeconform's `-schema-location default` is a REMOTE URL
 # (raw.githubusercontent.com), so it is useless here — with no egress it fails for
 # EVERY kind, including built-ins like ConfigMap, and reports a download error rather
 # than anything about the manifest. Both schema sets below are therefore local, and
 # consumers must NOT pass `default`:
 #   builtin/  yannh/kubernetes-json-schema, master-standalone-strict (~62 MB / 1505)
 #   crds/     datreeio/CRDs-catalog, only the groups this cluster uses (~18 MB / 229)
 #
 # The CRD half matters most: without a local HelmRelease schema, a corrupted Flux
 # HelmRelease — the exact thing this is here to catch — comes back "skipped" rather
 # than "invalid". The full datree catalog is ~211 MB / 4177 schemas; sparse checkout
 # means the other 4000 blobs are never downloaded. To cover a new group, add it to
 # $groups and rebuild.
 #
 # Groups with NO published schema anywhere (toolhive.stacklok.dev, kagent.dev,
 # openclaw.rocks, inference.llmkube.dev) are absent by necessity; kubeconform is
 # invoked with -ignore-missing-schemas so those resources report as "skipped".
 #
 # Set BEFORE the RUN below so the build-time verification uses the same value consumers
 # do. Used by the yamllint MCP shim in 50W/kube-manifests (toolhive/cm-yamllint-mcp.yaml).
 ENV KUBECONFORM_SCHEMAS=/usr/local/share/kubeconform
 # $groups is word-split on purpose — it is a list of directory names, and both
 # `sparse-checkout set` and the `for` loop want it expanded into separate arguments.
 # hadolint ignore=SC2086
 RUN groups="acid.zalan.do ceph.rook.io cert-manager.io trust.cert-manager.io \
        cilium.io external-secrets.io gateway.networking.k8s.io \
        grafana.integreatly.org helm.toolkit.fluxcd.io jetstream.nats.io \
        k8s.keycloak.org k8up.io kustomize.config.k8s.io \
        kustomize.toolkit.fluxcd.io metallb.io monitoring.coreos.com \
        monitoring.grafana.com networking.istio.io objectbucket.io \
        operator.victoriametrics.com security.istio.io \
        source.toolkit.fluxcd.io telemetry.istio.io valkey.io" \
    && arch="$(apk --print-arch | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')" \
    && curl -fsSL \
        "https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-${arch}.tar.gz" \
        | tar -xz -C /usr/local/bin kubeconform \
    && chmod 0755 /usr/local/bin/kubeconform \
    && kubeconform -v \
    && mkdir -p "${KUBECONFORM_SCHEMAS}/crds" "${KUBECONFORM_SCHEMAS}/builtin" \
    && git clone --depth 1 --filter=blob:none --sparse \
        https://github.com/datreeio/CRDs-catalog.git /tmp/crds \
    && git -C /tmp/crds sparse-checkout set $groups \
    && for g in $groups; do cp -a "/tmp/crds/$g" "${KUBECONFORM_SCHEMAS}/crds/"; done \
    && rm -rf /tmp/crds \
    && git clone --depth 1 --filter=blob:none --sparse \
        https://github.com/yannh/kubernetes-json-schema.git /tmp/kjs \
    && git -C /tmp/kjs sparse-checkout set master-standalone-strict \
    && cp -a /tmp/kjs/master-standalone-strict "${KUBECONFORM_SCHEMAS}/builtin/" \
    && rm -rf /tmp/kjs \
    # Prove the vendored schemas actually resolve, for a CRD kind AND a built-in kind.
    # `-schema-location default` is deliberately absent: it is a remote URL, so
    # including it would let this check pass on the network the build happens to have
    # and still fail in the egress-less pod. A missing or renamed schema directory
    # would otherwise only surface at run time as a silent "skipped", which is exactly
    # the failure this layer exists to prevent.
    && { printf 'apiVersion: helm.toolkit.fluxcd.io/v2\nkind: HelmRelease\nmetadata:\n  name: t\nspec:\n  interval: 1h\n  chart:\n    spec:\n      chart: c\n      sourceRef:\n        kind: HelmRepository\n        name: r\n'; \
         printf -- '---\napiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: c\n'; } \
        | kubeconform -strict -summary -verbose \
            -schema-location "${KUBECONFORM_SCHEMAS}/builtin/master-standalone-strict/{{.ResourceKind}}{{.KindSuffix}}.json" \
            -schema-location "${KUBECONFORM_SCHEMAS}/crds/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json" \
            -
 # Defaults that keep non-interactive agent shells from hanging or failing:
 #   * pagers off      — git/kubectl/helm otherwise block on `less` with no TTY
 #   * no git prompts  — a private remote without creds fails fast instead of waiting