Question: can the pkg/validation/ module be used to validate Manifests against the Kubernetes Swagger file?

[yannh]

Hello! I've spent some time hacking on kubeval, and a separate, similar project called kubeconform. Both rely on JSON schemas generated from the Kubernetes Swagger file: https://github.com/instrumenta/kubernetes-json-schema . Rationale described by kubeval is that Go Tooling is not convenient to validate against OpenAPI schemas, whereas there is ample tooling for validating against JSON Schemas.

What is the relation between the pkg/validation/ module and go-swagger?
Can that module validate a Kubernetes manifest, using Kubernetes' Swagger file as schema?

Skipping the OpenAPI > JSON Schema conversion step would make tools like kubeval or kubeconform quite simpler and easier to maintain :) Note that I might be a bit confused with regard to the differences between Swagger, OpenAPI (2.0? 3.0?) and jsonschemas.

Thanks a lot!

[sttts]

pkg/validation is a go-swagger fork stripped down to implement exactly the semantics of our CRD validation API. go-swagger introduced unexpected changes in the past "to be a better swagger implementation", but it changed our API in unexpected and "forbidden" ways.

Technically you could validate manifests. But don't expect any compatibility of these packages in the future. They change in ways we need them in k/k, without taking care of the ecosystem (this is true for the whole repository, it is basically internal to k/k).

[yannh]

@sttts I'm a bit confused 🤔 I want to validate Kubernetes manifests and Kubernetes CRDs - I would love to stay as close as possible to k/k's validation as possible (ideally if it breaks in Kubernetes, it should break in kubeval/kubeconform). Is the logic to validate CRDs different than the logic to validate other Resources such as Services & Deployments?

We (Kubeval/Kubeconform) have problems with having to maintain JSON Schemas (see instrumenta/kubernetes-json-schema#26 ) so being able to validate OpenAPI directly using K/K's swagger file, without having to convert first, would be a nice time-saver.

Are there benefits to converting to JSON Schemas first? Is there tooling I could use to validate against K8S swagger file directly? Doesnt for example kubectl uses this package for validation? Apologies again if this issue is more a support request than a question 😢

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-contributor-experience at kubernetes/community.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-contributor-experience at kubernetes/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.