From 84abda81cf6287e52d4d002f669677554f641dc5 Mon Sep 17 00:00:00 2001 From: kriyanshii Date: Wed, 2 Sep 2026 01:01:44 +0530 Subject: [PATCH 1/2] helm: generate values.schema.json from values.yaml --- .github/workflows/helm-validate.yml | 14 + Makefile | 4 + hack/helm-values-schema/main.go | 227 +++++++ hack/helm-values-schema/overlay.json | 120 ++++ .../values.schema.json | 581 +++++++++--------- 5 files changed, 666 insertions(+), 280 deletions(-) create mode 100644 hack/helm-values-schema/main.go create mode 100644 hack/helm-values-schema/overlay.json diff --git a/.github/workflows/helm-validate.yml b/.github/workflows/helm-validate.yml index 2b2c03c7..abe21ab0 100644 --- a/.github/workflows/helm-validate.yml +++ b/.github/workflows/helm-validate.yml @@ -127,6 +127,19 @@ jobs: - name: Regenerate and diff run: make manifests && git diff --exit-code helm/temporal-worker-controller/templates/rbac.yaml + helm-check-values-schema: + name: Check values.schema.json is generated + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version-file: go.mod + + - name: Regenerate and diff + run: make helm-values-schema && git diff --exit-code helm/temporal-worker-controller/values.schema.json + helm-validate-succeed: name: All Helm Validations Succeed needs: @@ -135,6 +148,7 @@ jobs: - helm-lint-crds - helm-template-crds - helm-check-rbac + - helm-check-values-schema runs-on: ubuntu-latest if: always() env: diff --git a/Makefile b/Makefile index 06a3ba45..3d9dd2ca 100644 --- a/Makefile +++ b/Makefile @@ -324,6 +324,10 @@ $(STAMPDIR)/helm-deps: $(HELM_MAIN_CHART)/Chart.lock | $(STAMPDIR) $(HELM) $(HELM_ISOLATED_ENV) $(HELM) dependency build $(HELM_MAIN_CHART) --skip-refresh @touch $@ +.PHONY: helm-values-schema +helm-values-schema: ## Generate helm/temporal-worker-controller/values.schema.json from values.yaml. + go run ./hack/helm-values-schema + .PHONY: controller-gen controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary. If wrong version is installed, it will be overwritten. $(CONTROLLER_GEN): $(LOCALBIN) diff --git a/hack/helm-values-schema/main.go b/hack/helm-values-schema/main.go new file mode 100644 index 00000000..5dcb0a59 --- /dev/null +++ b/hack/helm-values-schema/main.go @@ -0,0 +1,227 @@ +// Command helm-values-schema generates helm/temporal-worker-controller/values.schema.json +// from values.yaml, then deep-merges overlay.json for constraints that cannot be +// inferred (enums, patterns, extraEnv shape, and similar). +package main + +import ( + "encoding/json" + "fmt" + "os" + "os/exec" + "path/filepath" + "strconv" + "strings" + + "gopkg.in/yaml.v3" +) + +const ( + valuesRel = "helm/temporal-worker-controller/values.yaml" + schemaRel = "helm/temporal-worker-controller/values.schema.json" + overlayRel = "hack/helm-values-schema/overlay.json" +) + +func main() { + if err := run(); err != nil { + fmt.Fprintf(os.Stderr, "helm-values-schema: %v\n", err) + os.Exit(1) + } +} + +func run() error { + root, err := repoRoot() + if err != nil { + return err + } + + raw, err := os.ReadFile(filepath.Join(root, valuesRel)) + if err != nil { + return err + } + overlayJSON, err := os.ReadFile(filepath.Join(root, overlayRel)) + if err != nil { + return err + } + + var doc yaml.Node + if err := yaml.Unmarshal(raw, &doc); err != nil { + return fmt.Errorf("parse %s: %w", valuesRel, err) + } + if len(doc.Content) == 0 { + return fmt.Errorf("%s is empty", valuesRel) + } + + generated := schemaFromNode(doc.Content[0]) + if generated == nil { + return fmt.Errorf("failed to infer schema from %s", valuesRel) + } + + var overlay any + if err := json.Unmarshal(overlayJSON, &overlay); err != nil { + return fmt.Errorf("parse overlay.json: %w", err) + } + + merged := deepMerge(generated, overlay) + out, err := json.MarshalIndent(merged, "", " ") + if err != nil { + return err + } + out = append(out, '\n') + + dest := filepath.Join(root, schemaRel) + if err := os.WriteFile(dest, out, 0o644); err != nil { + return err + } + fmt.Printf("wrote %s\n", schemaRel) + return nil +} + +func repoRoot() (string, error) { + out, err := exec.Command("git", "rev-parse", "--show-toplevel").Output() + if err != nil { + return "", fmt.Errorf("find repo root: %w", err) + } + return strings.TrimSpace(string(out)), nil +} + +func schemaFromNode(n *yaml.Node) map[string]any { + if n == nil { + return map[string]any{"type": "object"} + } + switch n.Kind { + case yaml.DocumentNode: + if len(n.Content) == 0 { + return map[string]any{"type": "object"} + } + return schemaFromNode(n.Content[0]) + case yaml.MappingNode: + s := map[string]any{"type": "object"} + if len(n.Content) == 0 { + return s + } + props := map[string]any{} + for i := 0; i+1 < len(n.Content); i += 2 { + key := n.Content[i] + val := n.Content[i+1] + prop := schemaFromNode(val) + if desc := commentDescription(key, val); desc != "" { + prop["description"] = desc + } + props[key.Value] = prop + } + s["properties"] = props + return s + case yaml.SequenceNode: + s := map[string]any{"type": "array"} + if len(n.Content) > 0 { + s["items"] = schemaFromNode(n.Content[0]) + } + return s + case yaml.ScalarNode: + return map[string]any{"type": scalarType(n)} + default: + return map[string]any{"type": "object"} + } +} + +func scalarType(n *yaml.Node) any { + switch n.Tag { + case "!!bool": + return "boolean" + case "!!int": + return "integer" + case "!!float": + return "number" + case "!!null": + return []any{"string", "null"} + default: + if n.Value == "true" || n.Value == "false" { + return "boolean" + } + if _, err := strconv.ParseInt(n.Value, 10, 64); err == nil && n.Style != yaml.SingleQuotedStyle && n.Style != yaml.DoubleQuotedStyle { + return "integer" + } + return "string" + } +} + +func commentDescription(key, val *yaml.Node) string { + parts := []string{ + cleanComment(key.HeadComment), + cleanComment(key.LineComment), + cleanComment(val.HeadComment), + cleanComment(val.LineComment), + } + var b strings.Builder + for _, p := range parts { + if p == "" { + continue + } + if b.Len() > 0 { + b.WriteString("\n") + } + b.WriteString(p) + } + return b.String() +} + +func cleanComment(c string) string { + if c == "" { + return "" + } + var lines []string + for _, line := range strings.Split(c, "\n") { + line = strings.TrimRight(line, " \t") + line = strings.TrimSpace(line) + line = strings.TrimPrefix(line, "#") + if strings.HasPrefix(line, " ") { + line = line[1:] + } + if line == "" { + if len(lines) > 0 && lines[len(lines)-1] != "" { + lines = append(lines, "") + } + continue + } + lines = append(lines, line) + } + return strings.TrimSpace(strings.Join(lines, "\n")) +} + +func deepMerge(base, overlay any) any { + bm, bok := asMap(base) + om, ook := asMap(overlay) + if !bok || !ook { + if overlay == nil { + return base + } + return overlay + } + out := make(map[string]any, len(bm)+len(om)) + for k, v := range bm { + out[k] = v + } + for k, v := range om { + if existing, ok := out[k]; ok { + out[k] = deepMerge(existing, v) + } else { + out[k] = v + } + } + return out +} + +func asMap(v any) (map[string]any, bool) { + switch m := v.(type) { + case map[string]any: + return m, true + case map[any]any: + out := make(map[string]any, len(m)) + for k, val := range m { + out[fmt.Sprint(k)] = val + } + return out, true + default: + return nil, false + } +} diff --git a/hack/helm-values-schema/overlay.json b/hack/helm-values-schema/overlay.json new file mode 100644 index 00000000..ebeec192 --- /dev/null +++ b/hack/helm-values-schema/overlay.json @@ -0,0 +1,120 @@ +{ + "$schema": "https://json-schema.org/draft-07/schema#", + "required": [], + "properties": { + "image": { + "properties": { + "pullPolicy": { + "enum": ["Always", "IfNotPresent", "Never"] + }, + "pullSecrets": { + "items": { + "type": "object", + "required": ["name"], + "properties": { + "name": { + "type": "string", + "description": "Name of the secret containing registry credentials" + } + } + } + } + } + }, + "resources": { + "properties": { + "limits": { + "properties": { + "cpu": { + "pattern": "^[0-9]+(\\.[0-9]+)?([m]?)$" + }, + "memory": { + "pattern": "^[0-9]+([kKmMgGtTpP]i?)?$" + } + } + }, + "requests": { + "properties": { + "cpu": { + "pattern": "^[0-9]+(\\.[0-9]+)?([m]?)$" + }, + "memory": { + "pattern": "^[0-9]+([kKmMgGtTpP]i?)?$" + } + } + } + } + }, + "terminationGracePeriodSeconds": { + "minimum": 1 + }, + "metrics": { + "properties": { + "port": { + "minimum": 1, + "maximum": 65535 + } + } + }, + "webhook": { + "properties": { + "port": { + "minimum": 1, + "maximum": 65535 + } + } + }, + "extraEnv": { + "items": { + "type": "object", + "required": ["name"], + "properties": { + "name": { + "type": "string", + "minLength": 1, + "description": "Environment variable name" + }, + "value": { + "type": "string", + "description": "Literal environment variable value" + }, + "valueFrom": { + "type": "object", + "description": "Kubernetes EnvVarSource, such as secretKeyRef or configMapKeyRef" + } + } + } + }, + "extraVolumes": { + "items": { + "type": "object" + } + }, + "extraVolumeMounts": { + "items": { + "type": "object" + } + }, + "kubeRBACProxy": { + "properties": { + "image": { + "properties": { + "pullPolicy": { + "enum": ["Always", "IfNotPresent", "Never"] + } + } + }, + "extraArgs": { + "items": { + "type": "string" + } + }, + "volumeMounts": { + "items": { + "type": "object" + } + } + } + } + } +} diff --git a/helm/temporal-worker-controller/values.schema.json b/helm/temporal-worker-controller/values.schema.json index b2d11e2b..9e0dbd19 100644 --- a/helm/temporal-worker-controller/values.schema.json +++ b/helm/temporal-worker-controller/values.schema.json @@ -1,362 +1,383 @@ { "$schema": "https://json-schema.org/draft-07/schema#", - "type": "object", - "required": [], "properties": { - "image": { - "type": "object", + "affinity": { + "description": "Default podAntiAffinity uses preferredDuringSchedulingIgnoredDuringExecution to spread manager\npods across nodes. For strict HA, switch to requiredDuringSchedulingIgnoredDuringExecution.", + "type": "object" + }, + "authProxy": { + "description": "deprecated. disable authenticated metrics endpoint access with the\nmetrics.disableAuth value.", "properties": { - "repository": { - "type": "string", - "description": "Container image repository" + "enabled": { + "type": "boolean" + } + }, + "type": "object" + }, + "certmanager": { + "properties": { + "caBundle": { + "description": "caBundle is only used when enabled: false (i.e. you are managing webhook TLS yourself).\nSet this to the base64-encoded PEM CA certificate that signed the TLS certificate in\nthe \"webhook-server-cert\" Secret. The Kubernetes API server uses this to verify the\nwebhook server's TLS certificate.\nLeave empty when enabled: true — cert-manager injects the CA bundle automatically.", + "type": "string" }, - "tag": { - "type": "string", - "description": "Container image tag" + "enabled": { + "description": "enabled controls creation of the cert-manager Issuer and Certificate used for\nwebhook TLS. cert-manager must be installed in the cluster (either via the\nsubchart above or separately).\nSet to false only if you are providing your own TLS certificate (see caBundle below).", + "type": "boolean" }, + "install": { + "description": "install controls whether cert-manager is installed as a Helm subchart.\nSet to true if cert-manager is not already installed in the cluster.\nSee https://cert-manager.io/docs/installation/", + "type": "boolean" + } + }, + "type": "object" + }, + "containerSecurityContext": { + "description": "containerSecurityContext overrides the default container-level securityContext for both\nthe manager and kube-rbac-proxy containers when set. If empty (default), the chart uses\nthe legacy behavior (allowPrivilegeEscalation: false + capabilities.drop: ALL).\nExample for restricted Pod Security Standards / Kyverno compliance:\n containerSecurityContext:\n allowPrivilegeEscalation: false\n readOnlyRootFilesystem: true\n runAsGroup: 65532\n seccompProfile:\n type: RuntimeDefault\n capabilities:\n drop:\n - \"ALL\"", + "type": "object" + }, + "extraEnv": { + "description": "extraEnv adds Kubernetes EnvVar entries to the manager container. Each entry\nneeds a name and either a literal value or a valueFrom source\n(secretKeyRef / configMapKeyRef). The Go runtime, gRPC (Temporal SDK), and\nnet/http (controller-runtime / client-go) honor standard proxy variables.\n\nUse extraVolumes/extraVolumeMounts together with SSL_CERT_FILE to trust a\nprivate CA. The controller verifies the Temporal server certificate against\nthe system trust store; Go reads SSL_CERT_FILE.\n\nextraEnv:\n - name: HTTP_PROXY\n value: \"http://proxy.corp.example.com:8080\"\n - name: HTTPS_PROXY\n value: \"http://proxy.corp.example.com:8080\"\n - name: NO_PROXY\n value: \"localhost,127.0.0.1,.svc,.cluster.local,10.0.0.0/8\"\n - name: SSL_CERT_FILE\n value: /etc/ssl/custom-ca/ca.crt\n - name: API_TOKEN\n valueFrom:\n secretKeyRef:\n name: controller-secrets\n key: api-token", + "items": { + "properties": { + "name": { + "description": "Environment variable name", + "minLength": 1, + "type": "string" + }, + "value": { + "description": "Literal environment variable value", + "type": "string" + }, + "valueFrom": { + "description": "Kubernetes EnvVarSource, such as secretKeyRef or configMapKeyRef", + "type": "object" + } + }, + "required": [ + "name" + ], + "type": "object" + }, + "type": "array" + }, + "extraVolumeMounts": { + "description": "extraVolumeMounts adds volume mounts to the manager container. Volumes must be\nsupplied via extraVolumes above.\n\nextraVolumeMounts:\n - name: custom-ca\n mountPath: /etc/ssl/custom-ca\n readOnly: true", + "items": { + "type": "object" + }, + "type": "array" + }, + "extraVolumes": { + "description": "extraVolumes adds volumes to the manager pod, alongside the webhook certificate\nvolume the chart already creates.\n\nextraVolumes:\n - name: custom-ca\n secret:\n secretName: custom-ca", + "items": { + "type": "object" + }, + "type": "array" + }, + "image": { + "properties": { "pullPolicy": { - "type": "string", "enum": [ "Always", "IfNotPresent", "Never" ], - "description": "Container image pull policy" + "type": "string" }, "pullSecrets": { - "type": "array", "items": { - "type": "object", "properties": { "name": { - "type": "string", - "description": "Name of the secret containing registry credentials" + "description": "Name of the secret containing registry credentials", + "type": "string" } }, "required": [ "name" - ] + ], + "type": "object" + }, + "type": "array" + }, + "repository": { + "type": "string" + }, + "tag": { + "description": "Defaults to Chart.appVersion if not specified", + "type": "string" + } + }, + "type": "object" + }, + "kubeRBACProxy": { + "description": "Configure the kube-rbac-proxy sidecar that protects the controller metrics\nendpoint. The sidecar is enabled unless metrics.disableAuth is true.", + "properties": { + "containerSecurityContext": { + "description": "Overrides the global containerSecurityContext for this sidecar only.\nWhen empty, the global containerSecurityContext remains the fallback.", + "type": "object" + }, + "extraArgs": { + "description": "Additional arguments for kube-rbac-proxy.", + "items": { + "type": "string" + }, + "type": "array" + }, + "image": { + "properties": { + "pullPolicy": { + "enum": [ + "Always", + "IfNotPresent", + "Never" + ], + "type": "string" + }, + "registry": { + "type": "string" + }, + "repository": { + "type": "string" + }, + "sha": { + "type": "string" + }, + "tag": { + "type": "string" + } }, - "description": "List of secrets for pulling images from private registries" + "type": "object" + }, + "resources": { + "properties": { + "limits": { + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + }, + "type": "object" + }, + "requests": { + "properties": { + "cpu": { + "type": "string" + }, + "memory": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "volumeMounts": { + "description": "Additional volume mounts for kube-rbac-proxy. Volumes must be supplied by\nthe chart or another supported configuration option.", + "items": { + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, + "metrics": { + "properties": { + "disableAuth": { + "description": "Set to true if you want your controller-manager to expose the /metrics\nendpoint w/o any authn/z.\n\nIf false (the default), a kube-rbac-proxy sidecar\n(https://github.com/brancz/kube-rbac-proxy) is injected into the manager\npod. It listens on HTTPS port 8443 and proxies to the manager's metrics\nendpoint on localhost, authorizing each request via Kubernetes\nSubjectAccessReviews. The manager binds metrics to 127.0.0.1 so it is only\nreachable through the proxy.\n\nSet to true when network-level controls already restrict access\n(NetworkPolicy, service mesh, same-namespace Prometheus), your scraper\ncannot present a bearer token, or simplicity is preferred (e.g.\ndev/staging).", + "type": "boolean" + }, + "enabled": { + "type": "boolean" + }, + "port": { + "maximum": 65535, + "minimum": 1, + "type": "integer" } - } + }, + "type": "object" + }, + "namespace": { + "properties": { + "create": { + "type": "boolean" + } + }, + "type": "object" + }, + "nodeSelector": { + "type": "object" }, "podAnnotations": { - "type": "object", - "description": "Additional pod annotations", - "additionalProperties": { - "type": "string" - } + "type": "object" }, "podLabels": { - "type": "object", - "description": "Additional pod labels", - "additionalProperties": { - "type": "string" - } + "type": "object" + }, + "podSecurityContext": { + "description": "podSecurityContext overrides the default pod-level securityContext entirely when set.\nIf empty (default), the chart uses the legacy behavior above (runAsNonRoot: true +\noptional seccompProfile toggle).\nExample for restricted Pod Security Standards / Kyverno compliance:\n podSecurityContext:\n runAsNonRoot: true\n runAsUser: 65532\n runAsGroup: 65532\n fsGroup: 65532\n seccompProfile:\n type: RuntimeDefault", + "type": "object" + }, + "priorityClassName": { + "description": "Optional Pod priority scheduling. Prefer priorityClassName (references a\ncluster PriorityClass). Set priority only when you need an explicit integer;\nsee https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/\npriority: 1000", + "type": "string" + }, + "prometheus": { + "description": "Not yet supported", + "properties": { + "enabled": { + "type": "boolean" + } + }, + "type": "object" + }, + "rbac": { + "description": "All RBAC will be applied under this service account in\nthe deployment namespace. You may disable creation of this resource\nif your manager will use a service account that exists at\nruntime. Be sure to update serviceAccount.name if changing\nservice account names.", + "properties": { + "create": { + "description": "Specifies whether RBAC resources should be created", + "type": "boolean" + }, + "createEndUserRoles": { + "description": "createEndUserRoles controls whether the chart creates the optional ClusterRoles\nthat grant end users permission to edit/view temporal.io custom resources\n(connections, workerdeployments, workerresourcetemplates). These roles have no\nbindings by default — they exist so cluster admins can bind them as needed.\nSet to false to skip creating them entirely.", + "type": "boolean" + }, + "restrictWatchNamespaces": { + "description": "restrictWatchNamespaces keeps the namespaces the controller watches and the\nnamespaces its RBAC grants access to in sync. Empty (the default) watches all\nnamespaces with cluster-wide RBAC (ClusterRole + ClusterRoleBinding). When set,\nthe manager role is emitted as a namespaced Role (one per listed namespace) bound\nvia a RoleBinding, plus a minimal cluster-scoped role for the two grants that\ncannot be namespaced (namespaces get, subjectaccessreviews create).", + "type": "array" + } + }, + "type": "object" + }, + "replicas": { + "description": "More than one replica is required for high availability.", + "type": "integer" }, "resources": { - "type": "object", + "description": "Configure the resources accordingly based on the project requirements.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", "properties": { "limits": { - "type": "object", "properties": { "cpu": { - "type": "string", "pattern": "^[0-9]+(\\.[0-9]+)?([m]?)$", - "description": "CPU limit (e.g., 500m, 1)" + "type": "string" }, "memory": { - "type": "string", "pattern": "^[0-9]+([kKmMgGtTpP]i?)?$", - "description": "Memory limit (e.g., 128Mi, 1Gi)" + "type": "string" } - } + }, + "type": "object" }, "requests": { - "type": "object", "properties": { "cpu": { - "type": "string", "pattern": "^[0-9]+(\\.[0-9]+)?([m]?)$", - "description": "CPU request (e.g., 10m, 1)" + "type": "string" }, "memory": { - "type": "string", "pattern": "^[0-9]+([kKmMgGtTpP]i?)?$", - "description": "Memory request (e.g., 64Mi, 1Gi)" + "type": "string" } - } + }, + "type": "object" } - } - }, - "terminationGracePeriodSeconds": { - "type": "integer", - "minimum": 1, - "description": "Termination grace period in seconds" - }, - "priority": { - "type": "integer", - "description": "Optional Pod priority integer. Prefer priorityClassName when possible." - }, - "priorityClassName": { - "type": "string", - "description": "Optional name of a PriorityClass for the manager Pod" + }, + "type": "object" }, - "rbac": { - "type": "object", + "securityContext": { + "description": "For common cases that do not require escalating privileges it is recommended to ensure that\nall your Pods/Containers are restrictive.\nMore info: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted\nPlease enable the following if your project does NOT have to work on old Kubernetes versions \u003c 1.19\nor on vendors versions which do NOT support this field by default (i.e. Openshift \u003c 4.11 ).", "properties": { - "create": { - "type": "boolean", - "description": "Whether to create RBAC resources" - }, - "restrictWatchNamespaces": { - "type": "array", - "items": { - "type": "string" + "seccompProfile": { + "properties": { + "enabled": { + "type": "boolean" + } }, - "description": "Namespaces the controller watches and is granted RBAC in. Empty (the default) watches all namespaces with cluster-wide RBAC (ClusterRole + ClusterRoleBinding); when set, the manager role is emitted as a namespaced Role (one per listed namespace) bound via a RoleBinding, plus a minimal cluster-scoped role for the two grants that cannot be namespaced (namespaces get, subjectaccessreviews create)." - }, - "createEndUserRoles": { - "type": "boolean", - "description": "Whether to create the optional end-user editor/viewer ClusterRoles for temporal.io custom resources. These have no bindings by default and exist for cluster admins to bind as needed. Set to false to skip creating them." + "type": "object" } - } + }, + "type": "object" }, "serviceAccount": { - "type": "object", "properties": { "create": { - "type": "boolean", - "description": "Whether to create a ServiceAccount" + "description": "Specifies whether a ServiceAccount should be created", + "type": "boolean" }, "name": { + "description": "The name of the ServiceAccount to use.\nIf not set and create is true, a name is generated.", "type": [ "string", "null" - ], - "description": "The name of the ServiceAccount to use. If null, a name will be generated using the release name." + ] } - } - }, - "securityContext": { - "type": "object", - "properties": { - "seccompProfile": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "description": "Whether to enable seccompProfile" - } - } - } - } - }, - "affinity": { - "default": {}, - "description": "A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).\n\nFor example:\naffinity:\n nodeAffinity:\n requiredDuringSchedulingIgnoredDuringExecution:\n nodeSelectorTerms:\n - matchExpressions:\n - key: foo.bar.com/role\n operator: In\n values:\n - master", + }, "type": "object" }, - "authProxy": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "description": "Whether to enable the auth proxy", - "deprecated": true - } - } + "terminationGracePeriodSeconds": { + "minimum": 1, + "type": "integer" }, - "metrics": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "description": "Whether to enable metrics" - }, - "port": { - "type": "integer", - "minimum": 1, - "maximum": 65535, - "description": "Port for metrics endpoint" - }, - "disableAuth": { - "type": "boolean", - "description": "Whether to disable authentication for metrics endpoint" - } - } + "tolerations": { + "type": "array" }, "webhook": { - "type": "object", "properties": { + "certDir": { + "type": "string" + }, "enabled": { - "type": "boolean", - "description": "Whether to enable webhook" + "description": "enabled controls the optional WorkerDeployment validating webhook.\nThe WorkerResourceTemplate validating webhook is always enabled and does\nnot require this flag.", + "type": "boolean" }, "port": { - "type": "integer", - "minimum": 1, "maximum": 65535, - "description": "Port for webhook server" - }, - "certDir": { - "type": "string", - "description": "Directory for webhook certificates" - } - } - }, - "certmanager": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "description": "Whether to enable cert-manager" - } - } - }, - "prometheus": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean", - "description": "Whether to enable Prometheus monitoring" - } - } - }, - "crds": { - "type": "object", - "properties": { - "create": { - "type": "boolean", - "description": "Whether to create CRDs" - } - } - }, - "namespace": { - "type": "object", - "properties": { - "create": { - "type": "boolean", - "description": "Whether to create the namespace" - } - } - }, - "nodeSelector": { - "default": {}, - "description": "The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).\n\nThis default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.", - "type": "object" - }, - "tolerations": { - "default": [], - "description": "A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).\n\nFor example:\ntolerations:\n- key: foo.bar.com/role\n operator: Equal\n value: master\n effect: NoSchedule", - "items": {}, - "type": "array" - }, - "extraEnv": { - "default": [], - "description": "Additional Kubernetes EnvVar entries for the manager container. Each entry needs a name and either a literal value or a valueFrom source.\n\nUse this for corporate HTTP(S) proxies (HTTP_PROXY, HTTPS_PROXY, NO_PROXY) — the Go runtime, gRPC, and net/http honor those variables. Use it with extraVolumes and extraVolumeMounts to trust a private CA via SSL_CERT_FILE.\n\nFor example:\nextraEnv:\n- name: HTTP_PROXY\n value: http://proxy.corp.example.com:8080\n- name: SSL_CERT_FILE\n value: /etc/ssl/custom-ca/ca.crt\n- name: API_TOKEN\n valueFrom:\n secretKeyRef:\n name: controller-secrets\n key: api-token", - "items": { - "type": "object", - "required": [ - "name" - ], - "properties": { - "name": { - "type": "string", - "minLength": 1, - "description": "Environment variable name" - }, - "value": { - "type": "string", - "description": "Literal environment variable value" - }, - "valueFrom": { - "type": "object", - "description": "Kubernetes EnvVarSource, such as secretKeyRef or configMapKeyRef" - } + "minimum": 1, + "type": "integer" } }, - "type": "array" - }, - "extraVolumes": { - "default": [], - "description": "Additional volumes for the manager Pod, alongside the webhook certificate volume the chart already creates.\n\nFor example:\nextraVolumes:\n- name: custom-ca\n secret:\n secretName: custom-ca", - "items": { - "type": "object" - }, - "type": "array" - }, - "extraVolumeMounts": { - "default": [], - "description": "Additional volume mounts for the manager container. Volumes must be supplied via extraVolumes.\n\nFor example:\nextraVolumeMounts:\n- name: custom-ca\n mountPath: /etc/ssl/custom-ca\n readOnly: true", - "items": { - "type": "object" - }, - "type": "array" - }, - "replicas": { - "default": 1, - "description": "Number of replicas of manager to run.\n\nThe default is 1, but in production set this to 2 or 3 to provide high availability.", - "type": "number" + "type": "object" }, - "kubeRBACProxy": { - "type": "object", - "description": "Configuration for the kube-rbac-proxy metrics sidecar", + "workerResourceTemplate": { + "description": "Configuration for WorkerResourceTemplate objects.", "properties": { - "image": { - "type": "object", - "properties": { - "registry": { - "type": "string", - "description": "kube-rbac-proxy image registry" - }, - "repository": { - "type": "string", - "description": "kube-rbac-proxy image repository" - }, - "tag": { - "type": "string", - "description": "kube-rbac-proxy image tag" - }, - "sha": { - "type": "string", - "description": "Optional kube-rbac-proxy image digest" - }, - "pullPolicy": { - "type": "string", - "enum": [ - "Always", - "IfNotPresent", - "Never" - ], - "description": "kube-rbac-proxy image pull policy" - } - } - }, - "extraArgs": { - "type": "array", - "items": { - "type": "string" - }, - "description": "Additional kube-rbac-proxy arguments" - }, - "containerSecurityContext": { - "type": "object", - "description": "kube-rbac-proxy container security context" - }, - "resources": { - "type": "object", - "description": "kube-rbac-proxy resource requirements" - }, - "volumeMounts": { - "type": "array", + "allowedResources": { + "description": "allowedResources defines which resource kinds may be embedded in WRT objects.\nThe webhook rejects any kind not listed here, and the controller is granted RBAC\nto manage exactly these resource types. An empty list rejects all kinds — at\nleast one entry must be configured.\n\nEach entry has three fields:\n kinds: kind names the webhook will accept (case-insensitive)\n apiGroups: API groups for the controller's RBAC policy\n resources: resource names for the controller's RBAC policy", "items": { + "properties": { + "apiGroups": { + "items": { + "type": "string" + }, + "type": "array" + }, + "kinds": { + "items": { + "type": "string" + }, + "type": "array" + }, + "resources": { + "items": { + "type": "string" + }, + "type": "array" + } + }, "type": "object" }, - "description": "Additional kube-rbac-proxy volume mounts" + "type": "array" } - } + }, + "type": "object" } - } + }, + "required": [], + "type": "object" } From 10b71087e076d043c70fa1f5e8a6ec7a8834cc13 Mon Sep 17 00:00:00 2001 From: kriyanshii Date: Wed, 2 Sep 2026 10:09:23 +0530 Subject: [PATCH 2/2] chore: run go mod tidy for helm-values-schema yaml dependency --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 9bed809b..55d4b0ef 100644 --- a/go.mod +++ b/go.mod @@ -15,6 +15,7 @@ require ( go.temporal.io/sdk/contrib/envconfig v1.0.1 go.temporal.io/server v1.31.2 google.golang.org/grpc v1.83.0 + gopkg.in/yaml.v3 v3.0.1 k8s.io/api v0.36.3 k8s.io/apiextensions-apiserver v0.36.0 k8s.io/apimachinery v0.36.3 @@ -214,7 +215,6 @@ require ( gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/validator.v2 v2.0.1 // indirect - gopkg.in/yaml.v3 v3.0.1 // indirect k8s.io/klog/v2 v2.140.0 // indirect k8s.io/kube-openapi v0.0.0-20260501160325-927ab1f70cd6 // indirect k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 // indirect