Skip to content

Commit 1394d33

Browse files
pantierrapantierra
committed
ci: made helm lint check the json schema.
1 parent 0c3173d commit 1394d33

3 files changed

Lines changed: 387 additions & 305 deletions

File tree

‎helm/values.schema.json‎

Lines changed: 384 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,384 @@
1+
{
2+
"$schema": "https://json-schema.org/draft-07/schema#",
3+
"type": "object",
4+
"properties": {
5+
"replicaCount": {
6+
"type": "integer",
7+
"minimum": 1,
8+
"description": "Number of replicas for the deployment"
9+
},
10+
"image": {
11+
"type": "object",
12+
"properties": {
13+
"repository": {
14+
"type": "string",
15+
"description": "Docker image repository",
16+
"default": "ghcr.io/developmentseed/stac-auth-proxy"
17+
},
18+
"pullPolicy": {
19+
"type": "string",
20+
"enum": ["IfNotPresent", "Always", "Never"],
21+
"description": "Kubernetes image pull policy"
22+
},
23+
"tag": {
24+
"type": "string",
25+
"description": "Docker image tag",
26+
"default": "latest"
27+
}
28+
}
29+
},
30+
"env": {
31+
"type": "object",
32+
"properties": {
33+
"UPSTREAM_URL": {
34+
"type": "string",
35+
"pattern": "^https?://.+",
36+
"description": "URL of the STAC API to proxy"
37+
},
38+
"WAIT_FOR_UPSTREAM": {
39+
"type": ["boolean", "string"],
40+
"description": "Wait for upstream API to become available before starting proxy",
41+
"default": "true"
42+
},
43+
"CHECK_CONFORMANCE": {
44+
"type": ["boolean", "string"],
45+
"description": "Ensure upstream API conforms to required conformance classes before starting proxy",
46+
"default": "true"
47+
},
48+
"ENABLE_COMPRESSION": {
49+
"type": ["boolean", "string"],
50+
"description": "Enable response compression",
51+
"default": "true"
52+
},
53+
"HEALTHZ_PREFIX": {
54+
"type": "string",
55+
"description": "Path prefix for health check endpoints",
56+
"default": "/healthz"
57+
},
58+
"OVERRIDE_HOST": {
59+
"type": ["boolean", "string"],
60+
"description": "Override the host header for the upstream API",
61+
"default": "true"
62+
},
63+
"ROOT_PATH": {
64+
"type": "string",
65+
"description": "Path prefix for the proxy API",
66+
"default": ""
67+
},
68+
"OIDC_DISCOVERY_URL": {
69+
"type": "string",
70+
"pattern": "^https?://.+",
71+
"description": "OpenID Connect discovery document URL"
72+
},
73+
"OIDC_DISCOVERY_INTERNAL_URL": {
74+
"type": "string",
75+
"pattern": "^https?://.+",
76+
"description": "Internal network OpenID Connect discovery document URL"
77+
},
78+
"DEFAULT_PUBLIC": {
79+
"type": ["boolean", "string"],
80+
"description": "Default access policy for endpoints",
81+
"default": "false"
82+
},
83+
"PRIVATE_ENDPOINTS": {
84+
"type": ["object", "string"],
85+
"description": "Endpoints explicitly marked as requiring authentication and possibly scopes"
86+
},
87+
"PUBLIC_ENDPOINTS": {
88+
"type": ["object", "string"],
89+
"description": "Endpoints explicitly marked as not requiring authentication"
90+
},
91+
"ENABLE_AUTHENTICATION_EXTENSION": {
92+
"type": ["boolean", "string"],
93+
"description": "Enable authentication extension in STAC API responses",
94+
"default": "true"
95+
},
96+
"OPENAPI_SPEC_ENDPOINT": {
97+
"type": ["string", "null"],
98+
"description": "Path of OpenAPI specification",
99+
"default": "/api"
100+
},
101+
"OPENAPI_AUTH_SCHEME_NAME": {
102+
"type": "string",
103+
"description": "Name of the auth scheme to use in the OpenAPI spec",
104+
"default": "oidcAuth"
105+
},
106+
"OPENAPI_AUTH_SCHEME_OVERRIDE": {
107+
"type": ["object", "string", "null"],
108+
"description": "Override for the auth scheme in the OpenAPI spec"
109+
},
110+
"ITEMS_FILTER_CLS": {
111+
"type": ["string", "null"],
112+
"description": "CQL2 expression factor for item-level filtering"
113+
},
114+
"ITEMS_FILTER_ARGS": {
115+
"type": ["array", "string"],
116+
"description": "Positional arguments for CQL2 expression factor"
117+
},
118+
"ITEMS_FILTER_KWARGS": {
119+
"type": ["object", "string"],
120+
"description": "Keyword arguments for CQL2 expression factor"
121+
}
122+
},
123+
"required": [
124+
"UPSTREAM_URL",
125+
"OIDC_DISCOVERY_URL"
126+
]
127+
},
128+
"service": {
129+
"type": "object",
130+
"required": ["type", "port"],
131+
"properties": {
132+
"type": {
133+
"type": "string",
134+
"enum": ["ClusterIP", "NodePort", "LoadBalancer"],
135+
"description": "Kubernetes service type"
136+
},
137+
"port": {
138+
"type": "integer",
139+
"minimum": 1,
140+
"maximum": 65535,
141+
"description": "Service port number"
142+
}
143+
}
144+
},
145+
"ingress": {
146+
"type": "object",
147+
"properties": {
148+
"enabled": {
149+
"type": "boolean",
150+
"description": "Enable ingress resource"
151+
},
152+
"className": {
153+
"type": "string",
154+
"description": "Ingress class name (e.g., nginx)"
155+
},
156+
"annotations": {
157+
"type": "object",
158+
"additionalProperties": {
159+
"type": "string"
160+
},
161+
"description": "Annotations for the ingress resource"
162+
},
163+
"host": {
164+
"type": "string",
165+
"description": "Hostname for the ingress"
166+
},
167+
"tls": {
168+
"type": "object",
169+
"properties": {
170+
"enabled": {
171+
"type": "boolean",
172+
"description": "Enable TLS configuration"
173+
},
174+
"secretName": {
175+
"type": "string",
176+
"description": "Name of the TLS secret (optional, will be auto-generated if empty)"
177+
}
178+
},
179+
"required": ["enabled"]
180+
}
181+
}
182+
},
183+
"resources": {
184+
"type": "object",
185+
"properties": {
186+
"limits": {
187+
"type": "object",
188+
"properties": {
189+
"cpu": {
190+
"type": "string",
191+
"pattern": "^[0-9]+m?$|^[0-9]+\\.[0-9]+$",
192+
"description": "CPU limit (e.g., 500m, 1.5)"
193+
},
194+
"memory": {
195+
"type": "string",
196+
"pattern": "^[0-9]+(Ki|Mi|Gi|Ti|Pi|Ei|[kMGTPE]i?)?$",
197+
"description": "Memory limit (e.g., 512Mi, 1Gi)"
198+
}
199+
}
200+
},
201+
"requests": {
202+
"type": "object",
203+
"properties": {
204+
"cpu": {
205+
"type": "string",
206+
"pattern": "^[0-9]+m?$|^[0-9]+\\.[0-9]+$",
207+
"description": "CPU request (e.g., 200m, 0.5)"
208+
},
209+
"memory": {
210+
"type": "string",
211+
"pattern": "^[0-9]+(Ki|Mi|Gi|Ti|Pi|Ei|[kMGTPE]i?)?$",
212+
"description": "Memory request (e.g., 256Mi, 1Gi)"
213+
}
214+
}
215+
}
216+
}
217+
},
218+
"securityContext": {
219+
"type": "object",
220+
"properties": {
221+
"runAsNonRoot": {
222+
"type": "boolean",
223+
"description": "Requires the container to run without root privileges"
224+
},
225+
"runAsUser": {
226+
"type": "integer",
227+
"description": "The UID to run the entrypoint of the container process"
228+
},
229+
"runAsGroup": {
230+
"type": "integer",
231+
"description": "The GID to run the entrypoint of the container process"
232+
}
233+
},
234+
"description": "Pod-level security context"
235+
},
236+
"containerSecurityContext": {
237+
"type": "object",
238+
"properties": {
239+
"allowPrivilegeEscalation": {
240+
"type": "boolean",
241+
"description": "Controls whether a process can gain more privileges than its parent process"
242+
},
243+
"capabilities": {
244+
"type": "object",
245+
"properties": {
246+
"drop": {
247+
"type": "array",
248+
"items": {
249+
"type": "string"
250+
},
251+
"description": "List of capabilities to drop"
252+
}
253+
}
254+
}
255+
},
256+
"description": "Container-level security context"
257+
},
258+
"nodeSelector": {
259+
"type": "object",
260+
"additionalProperties": {
261+
"type": "string"
262+
},
263+
"description": "Node labels for pod assignment"
264+
},
265+
"tolerations": {
266+
"type": "array",
267+
"items": {
268+
"type": "object",
269+
"properties": {
270+
"key": {
271+
"type": "string"
272+
},
273+
"operator": {
274+
"type": "string",
275+
"enum": ["Exists", "Equal"]
276+
},
277+
"value": {
278+
"type": "string"
279+
},
280+
"effect": {
281+
"type": "string",
282+
"enum": ["NoSchedule", "PreferNoSchedule", "NoExecute"]
283+
}
284+
}
285+
},
286+
"description": "Pod tolerations"
287+
},
288+
"affinity": {
289+
"type": "object",
290+
"additionalProperties": true,
291+
"description": "Pod affinity rules"
292+
},
293+
"initContainers": {
294+
"type": "array",
295+
"items": {
296+
"type": "object",
297+
"additionalProperties": true
298+
},
299+
"description": "Init containers to run before the main container starts"
300+
},
301+
"extraContainers": {
302+
"type": "array",
303+
"items": {
304+
"type": "object",
305+
"additionalProperties": true
306+
},
307+
"description": "extraContainer containers to run alongside the main container"
308+
},
309+
"extraVolumes": {
310+
"type": "array",
311+
"items": {
312+
"type": "object",
313+
"additionalProperties": true
314+
},
315+
"description": "Additional volumes to mount (e.g., ConfigMaps for custom filter files)",
316+
"default": []
317+
},
318+
"extraVolumeMounts": {
319+
"type": "array",
320+
"items": {
321+
"type": "object",
322+
"required": ["name", "mountPath"],
323+
"properties": {
324+
"name": {
325+
"type": "string",
326+
"description": "Name of the volume to mount"
327+
},
328+
"mountPath": {
329+
"type": "string",
330+
"description": "Path within the container at which the volume should be mounted"
331+
},
332+
"subPath": {
333+
"type": "string",
334+
"description": "Path within the volume from which the container's volume should be mounted"
335+
},
336+
"readOnly": {
337+
"type": "boolean",
338+
"description": "Mounted read-only if true, read-write otherwise"
339+
}
340+
},
341+
"additionalProperties": true
342+
},
343+
"description": "Additional volume mounts for the container",
344+
"default": []
345+
},
346+
"serviceAccount": {
347+
"type": "object",
348+
"properties": {
349+
"create": {
350+
"type": "boolean",
351+
"description": "Specifies whether a service account should be created"
352+
},
353+
"annotations": {
354+
"type": "object",
355+
"additionalProperties": {
356+
"type": "string"
357+
},
358+
"description": "Annotations to add to the service account"
359+
},
360+
"name": {
361+
"type": "string",
362+
"description": "The name of the service account to use. If not set and create is true, a name is generated"
363+
},
364+
"imagePullSecrets": {
365+
"type": "array",
366+
"description": "Image pull secrets to add to the service account",
367+
"items": {
368+
"type": "object",
369+
"required": ["name"],
370+
"properties": {
371+
"name": {
372+
"type": "string",
373+
"description": "Name of the image pull secret"
374+
}
375+
}
376+
}
377+
}
378+
}
379+
}
380+
},
381+
"required": [
382+
"service"
383+
]
384+
}

0 commit comments

Comments
 (0)