Repository navigation
ci: data-driven render+schema validation (kill the flimsy bash) - #18
Merged
Merged
Conversation
Replace the hand-rolled kubeconform find + per-chart helm-lint bash with a committed, locally-runnable script. It discovers Applications from the manifests themselves, renders each chart with its layered valueFiles (helm template), and schema-checks the rendered output plus every other manifest carrying a kind. Semantic filter (has-kind vs not) replaces fragile path exclusions. Also fix cilium values: tunnel: vxlan was removed in Cilium 1.15 -> routingMode + tunnelProtocol (surfaced by the new render check; main CI was already red).
syscod3
added a commit
that referenced
this pull request
Aug 8, 2026
Replace the hand-rolled kubeconform find + per-chart helm-lint bash with a committed, locally-runnable script. It discovers Applications from the manifests themselves, renders each chart with its layered valueFiles (helm template), and schema-checks the rendered output plus every other manifest carrying a kind. Semantic filter (has-kind vs not) replaces fragile path exclusions. Also fix cilium values: tunnel: vxlan was removed in Cilium 1.15 -> routingMode + tunnelProtocol (surfaced by the new render check; main CI was already red).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
CI logic lived in the workflow YAML — a hand-rolled
findfor kubeconform andper-chart
helm lintsteps with inline Python. Structure-coupled and fragile: alayout change breaks it, and it isn't runnable locally. It was also already red
on
main(thefindswept a Talosinline-manifests.yaml, which has nokind).What
scripts/validate.py— committed, locally-runnable (python3 scripts/validate.py),data-driven. It discovers Argo
Applications from the manifests themselves,renders each chart with its layered
valueFiles(helm template), andschema-checks the rendered output (
kubeconform) plus every other manifestthat carries a
kind. Semantic filter (has-kindvs not) replaces the fragilepath exclusions — Helm values, Talos patches, and coord files are skipped
because they aren't Kubernetes manifests, not because a path was listed.
ci.yml— thekubeconform+helm-lintjobs collapse into onevalidatejob that just calls the script. Single source of truth, same locally and in CI.
infrastructure/cilium/values.yaml—tunnel: vxlanwas removed in Cilium1.15 (chart is pinned 1.17.1); split into
routingMode: tunnel+tunnelProtocol: vxlan.helm lintnever caught this; the render check does —Argo CD would have failed to sync it.
Verified
helm template+kubeconform -strictrun clean locally across all fiveApplications (cilium, cert-manager, harbor, arc-controller, tailscale-operator)
and the schema-check batch: 0 invalid, 0 errors.