kubernetes-sigs/kubectl-validate

Feature Request: Ignore certain fields

EsDmitrii opened this issue · 6 comments

EsDmitrii commented

Hi!
I have started using this great tool and have encountered some problems that need to be solved:

  1. I am using ArgoCD with some plugins, for example the Vault plugin. Argocd before deployment, when it templates manifests, it accesses the vault to get the secrets in the path described in the manifest.
    When the manifest is checked by the kubectl-validate tool, it triggers the error like this:
Secret.core "secretnamehere" is invalid: [<nil>: Invalid value: "": "data.pass" must validate at least one schema (anyOf), data.pass: Invalid value: "<path:projects/data/path/to/secret/in/vault/#pass>": data.pass in body must be of type byte: "<path:projects/data/path/to/secret/in/vault/#pass>", <nil>: Invalid value: "": "data.pass" must validate all the schemas (allOf). None validated]

Because manifests are not yet rendered by ArgoCD and they contain paths to the Vault secret like in Helm scheme.
Is there any way to skip checks with magic comment like in kics or any other ways:)
I ask this because now I get a lot invalid errors in CI.

  1. Is there any way to create reports for integrate with CI? For example SAST, xml, etc (I use GitlabCI).
    This is nice to have to track issues
alexzielenski commented

Making sure I understand this issue correctly:

  1. Seems like you have some fields which are post-processed by ArgoCD, you want to skip validation of these fields. Would it render the files locally?
  2. The tool does have an option --output json which may be helpful for this use case
EsDmitrii commented
alexzielenski commented

Im hesitant to add support in the tool for this use case without seeing how others are using preprocessors. I'm changing the issue title to better reflect this use case of ignoring certain fields, so otheres can post their usage stories. For now I believe this can be worked around by post processing the errors to remove errors for such fields, (or preprocessing the input with dummy secrets)

k8s-triage-robot commented

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

alexzielenski commented

/remove-lifecycle stale
/lifecycle frozen

alexzielenski commented

It should be possible to augment desired schemas to add opaque fields using --overlay-schemas. Inject a subschema for the field you want to ignore using x-kubernetes-preserve-unknown-fields