search

willthames / kubernetes-validate

Other
45 stars 5 forks source link

Validation for metadata.labels #21

Open gitkent opened 1 year ago

gitkent commented 1 year ago

Hi all,

We are trying to put some validation in place for our Kubernetes manifests YAML files and we noticed that it is not validating the labels mapping value as per its requirements:

❯ kubernetes-validate  /tmp/test-ns.yaml
INFO /tmp/test-ns.yaml passed for resource namespace/test1 against version 1.26

❯ oc apply -f /tmp/test-ns.yaml --dry-run=server --validate=true
The Namespace "test1" is invalid: metadata.labels: Invalid value: "my value": a valid label must be an empty string or consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyValue',  or 'my_value',  or '12345', regex used for validation is '(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?')

❯ cat /tmp/test-ns.yaml | grep "my value"
    mykey: my value

By any chance we can have validation for this?

Kent

willthames commented 1 year ago

I'm not sure if this is possible or not, but would love to have this happen. I'll see if I can work it out.

willthames commented 1 year ago

I think the problem might be that with your oc apply the validation happens at server-side - there is nothing in the kubernetes swagger file that says what a label must look like, so kubernetes-validate can't know without talking to a server (which is a use-case I don't really want to deal with).

I'll see if there's a better source of truth for label definitions than the swagger file (as there are so many use cases this would be really helpful for)

gitkent commented 1 year ago

Thanks for looking into that @willthames

Agreed. it would be better to not talking to server and leave it as standalone. Keep us posted if you could find any source of truth for the label definition, otherwise maybe can consider do validation using the given regex '(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?' which seems to be the permanent requirement. - Just a suggestion) :-)

and yes it would be very useful as we have tonnes of manifests (not just namespace) have metadata.labels defined while many contributors from different teams making changes to our k8s manifests.

Kent