#!/usr/bin/env bash
This script downloads the Flux OpenAPI schemas, then it validates the
Flux custom resources and the kustomize overlays using kubeconform.
This script is meant to be run locally and in CI before the changes
are merged on the main branch that’s synced by Flux.
Copyright 2023 The Flux authors. All rights reserved.
Licensed under the Apache License, Version 2.0 (the “License”);
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an “AS IS” BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Prerequisites
- yq v4.34
- kustomize v5.0
- kubeconform v0.6
set -o errexit
set -o pipefail
mirror kustomize-controller build options
kustomize_flags=(“–load-restrictor=LoadRestrictionsNone”)
kustomize_config=”kustomization.yaml”
skip Kubernetes Secrets due to SOPS fields failing validation
kubeconform_flags=(“-skip=Secret”)
kubeconform_config=(“-strict” “-ignore-missing-schemas” “-schema-location” “default” “-schema-location” “/tmp/flux-crd-schemas” “-verbose”)
echo “INFO - Downloading Flux OpenAPI schemas”
mkdir -p /tmp/flux-crd-schemas/master-standalone-strict
curl -sL https://github.com/fluxcd/flux2/releases/latest/download/crd-schemas.tar.gz | tar zxf - -C /tmp/flux-crd-schemas/master-standalone-strict
find . -type f -name ‘*.yaml’ -print0 | while IFS= read -r -d $’\0’ file;
do
echo “INFO - Validating $file”
yq e ‘true’ “$file” > /dev/null
done
echo “INFO - Validating clusters”
find ./clusters -maxdepth 2 -type f -name ‘*.yaml’ -print0 | while IFS= read -r -d $’\0’ file;
do
kubeconform “${kubeconform_flags[@]}” “${kubeconform_config[@]}” “${file}”
if [[ ${PIPESTATUS[0]} != 0 ]]; then
exit 1
fi
done
echo “INFO - Validating kustomize overlays”
find . -type f -name $kustomize_config -print0 | while IFS= read -r -d $’\0’ file;
do
echo “INFO - Validating kustomization ${file/%$kustomize_config}”
kustomize build “${file/%$kustomize_config}” “${kustomize_flags[@]}” |
kubeconform “${kubeconform_flags[@]}” “${kubeconform_config[@]}”
if [[ ${PIPESTATUS[0]} != 0 ]]; then
exit 1
fi
done
