diff --git a/slides/helm.yml b/slides/helm.yml index 617b7e20..e0265735 100644 --- a/slides/helm.yml +++ b/slides/helm.yml @@ -30,7 +30,7 @@ content: - k8s/helm-create-basic-chart.md - k8s/helm-create-better-chart.md - k8s/helm-dependencies.md - - k8s/helm-advanced.md + - k8s/helm-values-schema-validation.md - k8s/helm-secrets.md - k8s/cert-manager.md - k8s/gitlab.md diff --git a/slides/k8s/helm-values-schema-validation.md b/slides/k8s/helm-values-schema-validation.md new file mode 100644 index 00000000..f29beb41 --- /dev/null +++ b/slides/k8s/helm-values-schema-validation.md @@ -0,0 +1,108 @@ +--- +## Helm mistake + +- What if I put wrong values and deploy the helm chart ? + +.exercice[ + + - Install a helm release with wrong values: + + `helm install broken-release --set=foo=bar --set=ImAgeTAg=toto` +] + +- What happened ? + + - The `broken-release` is installed 😨 + +- Is-it really broken ? + + - Not really: helm just ignored the values it doesn't know about 😓 + +- Is there something we can do to avoid mistakes ? + + +--- + +## Helm values schema validation + +- With *values schema validation*, we can write a spec representing the possible + values accepted by the chart. + +- Moving away from the spec make helm bailing out the installation/upgrade + +- It uses [jsonschema](https://json-schema.org/) language which is a + + `"a vocabulary that allows you to annotate and validate JSON documents."` + +- But can be adapted like here to validate any markup language that consist in + `map|dict|associativearray` and `list|array|sequence|tuple` like *yaml* + +--- +.exercise[ + +- Let's create a `values.schema.json`: + ```json + { + "$schema": "http://json-schema.org/schema#", + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "repository": { + "type": "string", + "pattern": "^[a-z0-9-_]+$" + }, + "pullPolicy": { + "type": "string", + "pattern": "^(Always|Never|IfNotPresent)$" + } } } } } + ``` +] + +--- +## Testing Helm validation + +- Now we can test to install Wrong release: + +.exercise[ + +- Run: + + `helm install broken --set image=image.pullPolicy=ShallNotPass` + +- Run: + + `helm install should-break --set=foo=bar --set=ImAgeTAg=toto` +] + +- First fails, but second one still pass even if we put a `values.schema.json` ! + +- Why ? + +--- +## Bailing out on unkown properties + +- We told helm more about valid properties but not what to do with non-existing ones + +- We can fix that with `"additionalProperties": false`: + +.exercise[ + +- Edit `values.schema.json` to add `"additionalProperties": false` + ```json + { + "$schema": "http://json-schema.org/schema#", + "type": "object", + "properties": { + "image": { [...] } + }, + "additionalProperties": false + } + ``` + +- And test again: `helm install should-break --set=foo=bar --set=ImAgeTAg=toto` +] +--- + +