Improperly validates DaemonSet about kubeval

[garethr]

Thanks for reporting.

I think the answer here is additionalProperties, which should throw an error whenever a key not in the schema is used. This isn't in the upstream schema, but that might be an openapi vs json schema difference. I'll check and hopefully add that to everything.

[garethr]

So, according to the spec https://github.com/garethr/kubernetes-json-schema/blob/master/master-standalone/daemonset.json this should be valid.

Hopefully this is a generic behaviour of the API and I can patch kubeval accordingly. When I get a moment I'll ask on SIG API Machinery and open an upstream bug.

[garethr]

Posted to API SIG Machinery to sanity check https://groups.google.com/forum/#!topic/kubernetes-sig-api-machinery/sz948IbCH2A

[garethr]

So, looking into this further this behaviour is from kubectl not the Kubernetes API: https://github.com/kubernetes/kubernetes/blob/225b9119d6a8f03fcbe3cc3d590c261965d928d0/pkg/kubectl/validation/schema.go#L312

[garethr]

The deal appears to be:

• The Kubernetes API will accept additional properties, and simply ignore them
• However kubectl (since kubernetes/kubernetes#11914) will try and steer you towards avoiding additional properties, although you can ignore than with --validate=false

So kubeval is right, in the sense that the document is valid for the API. But it's probably more useful at least to allow this to do the same checks as kubectl. My plan at the moment is:

• To publish a new set of schemas with "additionalProperties": false on everything that doesn't already have it
• To set a strict flag on kubeval to switch to using these schemas
• To default that flag to True, so it's the default behaviour

[garethr]

I have a PR up with a fix for this in #32, I need a bit of time to add a few tests and some documentation but if you want to build from source you could check it out.

On the sample manifest with additional properties this now correctly flags the replica key.

kubeval --strict .\fixtures\extra_property.yaml
The document .\fixtures\extra_property.yaml contains an invalid DaemonSet
---> replicas: Additional property replicas is not allowed