New linter for kubernetes templates

[distorhead]

Key points

• 2 commands:
  1. werf helm lint — call lint procedure using current values.
  2. werf helm lint-matrix — call lint procedure multiple times using matrix-generator of values.
• Add docs for each command.
• Accumulate all lint errors, then deduplicate, then print.
• .helm/matrix_test.yaml -> .helm/values-matrix.yaml
• Call lint procedure in the deploy process. In the end of deploy process print linting errors if any. But lint procedure should not fail deploy process for now even if lint errors occurred.
• Add howto guide to docs "Testing Helm charts" about testing charts using matrix linting.
• Check gitlab helm-lint output: should be the same as in the terminal.
• Helm-lint: print rendered template in the case of the error.
• Check apiVersion of kubernetes objects.

Lint procedures

Take lint procedures from the deckhouse project

https://github.com/flant/deckhouse

Forgotten spec.serviceName for StatefulSet

1. Define new StatefulSet apps/v1 without spec.serviceName.
2. Run werf deploy — it will create a resource, but should give a warning:

   │   WARNING Validation of target data failed: statefulset/mysts1: ValidationError(StatefulSet.spec): missing required field "serviceName" in io.k8s.api.apps.v1.StatefulSetSpec
   

3. Add spec.serviceName and rerun deploy. Werf will give an error:

   Error: release upgrade failed: StatefulSet.apps "mysts1" is invalid: spec: Forbidden: updates to statefulset spec for fields other than 'replicas', 'template', and 'updateStrategy' are forbidden
   

Werf linting procedure should prevent this situation by not allowing to create StatefulSet in the first place.

Double env variable definition

Failed to create three way merge patch when container environment variable specified multiple times: kubernetes/kubernetes#86163.

Do not allow creation of resources with environment variables definition duplicates.

Other

• Add support for the https://github.com/instrumenta/kubeval
• Add support for the https://kubesec.io/
  • Enabled by default. Lint also should be enabled by default in deploy. Configure lint and kubesec in werf.yaml: on|off, strict|non-strict, level of warnings.
• Werf helm lint should not skip the following incorrect manifest of probe:

  initialDelaySeconds: 0