Use cozyvalues-gen with packages/apps/* - #1307
Nick Volynkin (NickVolynkin) wants to merge 0 commit into
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Warning Rate limit exceededNick Volynkin (@NickVolynkin) has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 0 minutes and 28 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (56)
WalkthroughThis change set systematically enhances Helm chart configuration documentation and schema files across multiple app packages. It replaces the previous README and schema generation tooling with a unified Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant Makefile
participant CozyGen as cozyvalues-gen
participant Schema as values.schema.json
participant Readme as README.md
participant Values as values.yaml
Dev->>Makefile: run make generate
Makefile->>CozyGen: cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
CozyGen->>Values: Read parameter docs/types
CozyGen->>Schema: Update schema with explicit types/metadata
CozyGen->>Readme: Generate README with type-annotated tables
CozyGen-->>Makefile: Done
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello Nick Volynkin (@NickVolynkin), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request introduces a new standardized approach for generating documentation and schema across multiple applications. By migrating to cozyvalues-gen and updating parameter definitions, it aims to improve the clarity, consistency, and programmatic validation of application configurations.
Highlights
- Documentation and Schema Generation Tool Migration: The build process for various applications has been updated to use
cozyvalues-geninstead ofreadme-generator-for-helmand manualyqcommands. This streamlines the generation ofREADME.mddocumentation andvalues.schema.jsonfiles fromvalues.yaml. - Standardized Parameter Documentation: Parameter definitions in
values.yamlfiles now include explicit type annotations (e.g.,{int},{string},{quantity},{map[string]object}) using@paramand@fielddirectives. This provides clearer, machine-readable documentation for all configurable parameters. - Enhanced JSON Schema Definitions: The
values.schema.jsonfiles have undergone significant updates to reflect the new explicit type information and improve validation. This includes addingpatternandx-kubernetes-int-or-stringfor resource quantity fields, restructuring complex parameters into nested objects with defined properties and defaults, and usingadditionalPropertiesfor map-like structures.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | Gemini (@gemini-code-assist) | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments or fill out our survey to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request introduces a major refactoring to standardize documentation and schema generation across all applications using a new tool, cozyvalues-gen. This is a valuable improvement for consistency and maintainability.
My review has identified several critical issues in the generated schemas for kubernetes, vm-disk, and vm-instance that must be addressed. Additionally, there are a number of medium-severity documentation and schema inconsistencies across various applications that impact clarity and user experience. I've provided detailed comments and suggestions for each issue. Once these are resolved, this PR will be a great step forward.
| "addons": { | ||
| "properties": { | ||
| "description": "Cluster addons configuration", | ||
| "default": { | ||
| "certManager": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable cert-manager, which automatically creates and manages SSL/TLS certificates.", | ||
| "type": "boolean" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "valuesOverride": {} | ||
| }, | ||
| "cilium": { | ||
| "properties": { | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "valuesOverride": {} | ||
| }, | ||
| "fluxcd": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable FluxCD", | ||
| "type": "boolean" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "valuesOverride": {} | ||
| }, | ||
| "gatewayAPI": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable the Gateway API", | ||
| "type": "boolean" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false | ||
| }, | ||
| "gpuOperator": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable the GPU-operator", | ||
| "type": "boolean" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "valuesOverride": {} | ||
| }, | ||
| "ingressNginx": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable the Ingress-NGINX controller (requires nodes labeled with the 'ingress-nginx' role).", | ||
| "type": "boolean" | ||
| }, | ||
| "exposeMethod": { | ||
| "default": "Proxied", | ||
| "description": "Method to expose the Ingress-NGINX controller. (allowed values: Proxied, LoadBalancer)", | ||
| "type": "string", | ||
| "enum": [ | ||
| "Proxied", | ||
| "LoadBalancer" | ||
| ] | ||
| }, | ||
| "hosts": { | ||
| "default": [], | ||
| "description": "List of domain names that the parent cluster should route to this tenant cluster. Taken into account only when `exposeMethod` is set to `Proxied`.", | ||
| "items": {}, | ||
| "type": "array" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "exposeMethod": "Proxied", | ||
| "hosts": {}, | ||
| "valuesOverride": {} | ||
| }, | ||
| "monitoringAgents": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable monitoring agents (Fluent Bit and VMAgents) to send logs and metrics. If tenant monitoring is enabled, data is sent to tenant storage; otherwise, it goes to root storage.", | ||
| "type": "boolean" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "valuesOverride": {} | ||
| }, | ||
| "velero": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable velero for backup and restore k8s cluster.", | ||
| "type": "boolean" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "valuesOverride": {} | ||
| }, | ||
| "verticalPodAutoscaler": { | ||
| "properties": { | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "valuesOverride": {} | ||
| } | ||
| }, | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "controlPlane": { | ||
| "properties": { | ||
| "description": "Control Plane Configuration", | ||
| "default": { | ||
| "apiServer": { | ||
| "properties": { | ||
| "resources": { | ||
| "default": {}, | ||
| "description": "Explicit CPU and memory configuration for the API Server. When left empty, the preset defined in `resourcesPreset` is applied.", | ||
| "type": "object" | ||
| }, | ||
| "resourcesPreset": { | ||
| "default": "medium", | ||
| "description": "Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge.", | ||
| "type": "string", | ||
| "enum": [ | ||
| "nano", | ||
| "micro", | ||
| "small", | ||
| "medium", | ||
| "large", | ||
| "xlarge", | ||
| "2xlarge" | ||
| ] | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "resources": {}, | ||
| "resourcesPreset": "medium" | ||
| }, | ||
| "controllerManager": { | ||
| "properties": { | ||
| "resources": { | ||
| "default": {}, | ||
| "description": "Explicit CPU and memory configuration for the Controller Manager. When left empty, the preset defined in `resourcesPreset` is applied.", | ||
| "type": "object" | ||
| }, | ||
| "resourcesPreset": { | ||
| "default": "micro", | ||
| "description": "Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge.", | ||
| "type": "string", | ||
| "enum": [ | ||
| "nano", | ||
| "micro", | ||
| "small", | ||
| "medium", | ||
| "large", | ||
| "xlarge", | ||
| "2xlarge" | ||
| ] | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "resources": {}, | ||
| "resourcesPreset": "micro" | ||
| }, | ||
| "konnectivity": { | ||
| "properties": { | ||
| "server": { | ||
| "properties": { | ||
| "resources": { | ||
| "default": {}, | ||
| "description": "Explicit CPU and memory configuration for Konnectivity. When left empty, the preset defined in `resourcesPreset` is applied.", | ||
| "type": "object" | ||
| }, | ||
| "resourcesPreset": { | ||
| "default": "micro", | ||
| "description": "Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge.", | ||
| "type": "string", | ||
| "enum": [ | ||
| "nano", | ||
| "micro", | ||
| "small", | ||
| "medium", | ||
| "large", | ||
| "xlarge", | ||
| "2xlarge" | ||
| ] | ||
| } | ||
| }, | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| }, | ||
| "replicas": { | ||
| "default": 2, | ||
| "description": "Number of replicas for Kubernetes control-plane components.", | ||
| "type": "number" | ||
| "server": { | ||
| "resources": {}, | ||
| "resourcesPreset": "micro" | ||
| } | ||
| }, | ||
| "replicas": 2, | ||
| "scheduler": { | ||
| "properties": { | ||
| "resources": {}, | ||
| "resourcesPreset": "micro" | ||
| } | ||
| } |
There was a problem hiding this comment.
The schemas for addons and controlPlane are incomplete. They only contain a default block and are missing the properties block that defines their structure, types, and validation rules. This is a significant regression from the previous schema and removes important validation for these complex objects.
Please ensure that cozyvalues-gen generates the full schema definition for these properties, including all sub-properties, types, and constraints, similar to how nodeGroups is defined.
| "cloudInit": { | ||
| "default": "", | ||
| "description": "cloud-init user data config. See cloud-init documentation for more details.", | ||
| "type": "string" | ||
| "description": "cloud-init user data config. See cloud-init documentation for more details: [format](https://cloudinit.readthedocs.io/en/latest/explanation/format.html), [examples](https://cloudinit.readthedocs.io/en/latest/explanation/format.html)." | ||
| }, |
There was a problem hiding this comment.
The cloudInit property in the schema is missing a type definition. A property in a JSON schema must have a type. Based on the README.md, this should likely be "type": "object" or another appropriate type. Without a type, the schema is invalid and cannot be used for validation.
| "http": { | ||
| "description": "Download image from an HTTP source", | ||
| "type": "string" | ||
| }, |
There was a problem hiding this comment.
There is a critical inconsistency in the schema for source.http. The schema defines it as a string, but the template (templates/dv.yaml) and the comment in values.yaml expect it to be an object with a url property (e.g., source: { http: { url: ... } }).
This will cause failures when users try to configure an HTTP source. The schema must be corrected to reflect the expected object structure.
| | `addons` | Cluster addons configuration | `object` | `{}` | | ||
| | `addons.certManager` | Cert-manager: automatically creates and manages SSL/TLS certificate | `object` | `{}` | | ||
| | `addons.certManager.enabled` | Enable cert-manager, which automatically creates and manages SSL/TLS certificates. | `bool` | `false` | | ||
| | `addons.certManager.valuesOverride` | value} Custom values to override | `map[string]object` | `{}` | |
There was a problem hiding this comment.
The description for addons.certManager.valuesOverride and other valuesOverride fields in this table contains a typo: value} Custom values to override. The closing brace } is misplaced.
This seems to stem from a typo in the values.yaml comments, such as ## @field addons.certManager.valuesOverride {map[string}value} Custom values to override. Please correct it to {map[string]object} in values.yaml to fix the generated documentation.
| "vhost": { | ||
| "description": "Virtual Host", | ||
| "type": "object", | ||
| "required": [ | ||
| "roles" | ||
| ], | ||
| "properties": { | ||
| "roles": { | ||
| "description": "Virtual host roles list", | ||
| "type": "object" | ||
| } | ||
| } | ||
| }, |
There was a problem hiding this comment.
The schema defines a top-level vhost property, which seems redundant. The values.yaml file only contains a vhosts map, and the comments suggest vhost is intended as a type definition for the items within that map.
This top-level vhost property is likely a generator artifact and could confuse users. It should be removed from the schema's top-level properties.
| replicas: 2 | ||
| ## @param nginx.resources Explicit CPU and memory configuration for each nginx replica. When left empty, the preset defined in `resourcesPreset` is applied. | ||
| resources: {} | ||
| ## @field nginx.resources {*resources} Explicit CPU and memory configuration for each replica. When left empty, the preset defined in `resourcesPreset` is applied. |
There was a problem hiding this comment.
There's an inconsistency in the type annotation for resources. For haproxy, it's {resources}, but for nginx, it's {*resources}. The asterisk usually indicates an optional/nullable type, which causes nginx.resources to be rendered differently in the README.md (*object type and null value).
For consistency with haproxy.resources and to ensure correct documentation generation, please remove the asterisk.
## @field nginx.resources {resources} Explicit CPU and memory configuration for each replica. When left empty, the preset defined in `resourcesPreset` is applied.
| | `resources.memory` | The amount of memory allocated to the virtual machine | `*string` | `""` | | ||
| | `resources.sockets` | The number of CPU sockets allocated to the virtual machine (used to define vCPU topology) | `*string` | `""` | | ||
| | `sshKeys` | List of SSH public keys for authentication. Can be a single key or a list of keys. | `[]string` | `[]` | | ||
| | `cloudInit` | cloud-init user data config. See cloud-init documentation for more details: [format](https://cloudinit.readthedocs.io/en/latest/explanation/format.html), [examples](https://cloudinit.readthedocs.io/en/latest/explanation/format.html). | `object` | `{}` | |
There was a problem hiding this comment.
The link to the cloud-init examples is broken; it points to the format documentation instead. Please correct the URL to point to the examples page.
| | `cloudInit` | cloud-init user data config. See cloud-init documentation for more details: [format](https://cloudinit.readthedocs.io/en/latest/explanation/format.html), [examples](https://cloudinit.readthedocs.io/en/latest/explanation/format.html). | `object` | `{}` | | |
| | `cloudInit` | cloud-init user data config. See cloud-init documentation for more details: [format](https://cloudinit.readthedocs.io/en/latest/explanation/format.html), [examples](https://cloudinit.readthedocs.io/en/latest/reference/examples.html). | `object` | `{}` | |
| "default": { | ||
| "cleanupStrategy": "--keep-last=3 --keep-daily=3 --keep-within-weekly=1m", | ||
| "enabled": false, | ||
| "resticPassword": "ChaXoveekoh6eigh4siesheeda2quai0", | ||
| "s3AccessKey": "oobaiRus9pah8PhohL1ThaeTa4UVa7gu", | ||
| "s3Bucket": "s3.example.org/clickhouse-backups", | ||
| "s3Region": "us-east-1", | ||
| "s3SecretKey": "ju3eum4dekeich9ahM1te8waeGai0oog", | ||
| "schedule": "0 2 * * *" | ||
| }, | ||
| "required": [ | ||
| "cleanupStrategy", | ||
| "enabled", | ||
| "resticPassword", | ||
| "s3AccessKey", | ||
| "s3Bucket", | ||
| "s3Region", | ||
| "s3SecretKey", | ||
| "schedule" | ||
| ], |
There was a problem hiding this comment.
The schema for backup now defines a default for the entire object and lists all its properties as required. This changes the behavior for users. Previously, they could override a single property like backup.enabled and rely on defaults for other properties. Now, they must either omit the backup block entirely to use the default, or specify all required properties if they provide the backup block.
This can be less user-friendly and more error-prone. Consider reverting to per-property defaults to improve usability.
This pattern is repeated for complex objects in other schemas throughout this PR.
| | `metricsStorages[i].vminsert.minAllowed` | Minimum allowed resources (requests) for each component | `*object` | `null` | | ||
| | `metricsStorages[i].vminsert.minAllowed.cpu` | CPU limit (maximum available value) | `*string` | `null` | | ||
| | `metricsStorages[i].vminsert.minAllowed.memory` | Memory limit (maximum available value) | `*string` | `null` | | ||
| | `metricsStorages[i].vminsert.maxAllowed` | Maximum allowed resources (limits) for each component | `*object` | `null` | | ||
| | `metricsStorages[i].vminsert.maxAllowed.cpu` | CPU request (minimal available value) | `*string` | `null` | | ||
| | `metricsStorages[i].vminsert.maxAllowed.memory` | Memory request (minimal available value) | `*string` | `null` | |
There was a problem hiding this comment.
The descriptions for minAllowed and maxAllowed resources appear to be swapped. minAllowed should correspond to minimum resource requests, while maxAllowed should correspond to maximum resource limits.
The current descriptions are confusing. For example, minAllowed.cpu is described as "CPU limit (maximum available value)", which is incorrect.
This issue is present for vminsert, vmselect, and vmstorage components. Please correct the descriptions to align with their intended purpose.
| "cpu": { | ||
| "description": "CPU request (minimal available value)", | ||
| "type": "string", | ||
| "default": "100m", | ||
| "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", | ||
| "x-kubernetes-int-or-string": true | ||
| }, | ||
| "memory": { | ||
| "description": "Memory request (minimal available value)", | ||
| "type": "string", | ||
| "default": "256Mi", | ||
| "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", | ||
| "x-kubernetes-int-or-string": true | ||
| } |
There was a problem hiding this comment.
The descriptions for maxAllowed and minAllowed resources and their sub-properties are swapped. maxAllowed should refer to resource limits (maximums), but its description says "CPU request (minimal available value)". Conversely, minAllowed should refer to requests (minimums), but its description mentions limits.
This is confusing and should be corrected to avoid misconfiguration. This issue is repeated for vmselect and vmstorage as well.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 36
🔭 Outside diff range comments (3)
packages/apps/virtual-machine/values.schema.json (1)
85-102: Unintended empty enum value forinstanceProfileThe last list item is an empty string, effectively allowing
instanceProfile: "", which is most likely accidental and defeats validation.
Remove the trailing""unless there is a real use-case.- "windows.2k25.virtio", - "" + "windows.2k25.virtio"packages/apps/vm-instance/values.schema.json (1)
118-123: Remove stray empty string frominstanceProfileenumSame issue as in virtual-machine schema – permits invalid empty value.
packages/apps/mysql/values.yaml (1)
55-72: Hard-coded example secrets will ship to clusters – blank them out
backup.s3AccessKey,backup.s3SecretKey, andbackup.resticPasswordcontain realistic-looking values that will be rendered into live Kubernetes manifests if users install the chart without overriding them. This is a security foot-gun and violates the common Helm convention of leaving secrets empty (or commented) invalues.yaml.The same block also hard-codes an S3 bucket path containing “postgres-backups”, which is misleading in a MySQL chart.
- s3Bucket: s3.example.org/postgres-backups - s3AccessKey: oobaiRus9pah8PhohL1ThaeTa4UVa7gu - s3SecretKey: ju3eum4dekeich9ahM1te8waeGai0oog - resticPassword: ChaXoveekoh6eigh4siesheeda2quai0 + # 👉 Supply real values via `helm install --set-file …` or Secret references + s3Bucket: "" # e.g. s3.example.org/mysql-backups + s3AccessKey: "" + s3SecretKey: "" + resticPassword: ""Consider commenting these keys out entirely or moving them to a dedicated
Secrettemplate.
🧹 Nitpick comments (25)
packages/apps/kafka/README.md (1)
14-21: Documentation drifts from intended typesThe README lists
topics[i].configasmap[string]object.
Kafka expects flat string values (cleanup.policy,segment.ms, …). Usemap[string]stringto avoid misleading chart users.packages/apps/http-cache/values.yaml (1)
28-33: Unclear*prefix in type hints – please verify generator support
haproxy.resourcesis annotated as{resources}(Line 30) while the analogousnginx.resourcesblock is annotated as{*resources}and its leaf fields as{*quantity}.
If the asterisk denotes “optional” it should be applied consistently to both HAProxy and Nginx sections; if it is a typo, Cozy Stack’scozyvalues-genmay silently ignore the type, breaking schema validation.Please run a quick check that the resulting
values.schema.jsonstill contains theresourcesobject schema (withcpu/memoryquantities) for both HAProxy and Nginx.Also applies to: 46-49
.github/workflows/pre-commit.yml (1)
29-33: Consider dropping legacy tool & add checksum for supply-chain safety
- With all Makefiles migrated to
cozyvalues-gen, the repository may no longer requirereadme-generator-for-helm; removing it will save ~20 MB and a network call per CI run.- For both binaries, curl-pipe-tar installs straight from GitHub without integrity checks. Adding SHA-256 verification (or
--checksumonce GH provides it) mitigates the risk of a compromised release artifact.Example hardening snippet:
curl -sSLO https://github.com/cozystack/cozyvalues-gen/releases/download/v0.7.0/cozyvalues-gen-linux-amd64.tar.gz echo "<expected_sha> cozyvalues-gen-linux-amd64.tar.gz" | sha256sum -c - tar -xzvf cozyvalues-gen-linux-amd64.tar.gz -C /usr/local/bin cozyvalues-genpackages/apps/vm-disk/README.md (1)
9-15: Clarify “storage” type as a Kubernetes quantityThe Type column shows plain
string, but the value must follow the Kubernetes quantity syntax (1Gi,500Mi, …).
Labeling it explicitly helps users:-| `storage` | The size of the disk allocated for the virtual machine | `string` | `5Gi` | +| `storage` | The size of the disk (Kubernetes quantity, e.g. `5Gi`) | `{quantity}` | `5Gi` |Same applies to any other quantity-typed fields elsewhere in the doc set.
packages/apps/vm-instance/Makefile (1)
3-8: Keep the enum patch in sync with the new schema layout
cozyvalues-genmight nestinstanceProfiledeeper (e.g., underspec).
If that happens, the currentyqassignment will miss its target and the enum list will not be written.Also, the commented-out block for
instanceTypeis dead code—remove it to avoid confusion.-#INSTANCE_TYPES=... -# && yq -i -o json ".properties.instanceType.enum = $${INSTANCE_TYPES}" values.schema.jsonpackages/apps/clickhouse/Makefile (1)
6-8: Mirror the.PHONYfix & ensure schema still exposes presetsSame concerns as with the MySQL Makefile: declare the rule phony and validate that the preset enumeration did not disappear after switching generators.
packages/apps/redis/values.yaml (1)
3-8: Consistent resource field annotations
@field resources.cpu/resources.memoryare marked*quantity, while the parentresourcesis*resources.
Becausecozyvalues-gendereferences*resourcesto an object schema, repeating*quantityis redundant and sometimes rendered asany. Consider:-## @field resources.cpu {*quantity} CPU -## @field resources.memory {*quantity} Memory +## @field resources.cpu {quantity} CPU +## @field resources.memory {quantity} Memorypackages/apps/vm-disk/values.yaml (1)
31-33: Minor wording-clarity“Defines if disk should be considered optical” → “Marks the disk as optical (read-only ISO semantics)”.
packages/apps/vpn/values.yaml (1)
33-41: Slice of pointers unusual for plain strings
externalIPs {[]*string}suggests a slice of string pointers – unnecessary in YAML/JSON.
Use{[]string}unless a null/absent distinction is required per element.packages/apps/kubernetes/values.yaml (1)
12-16: Redundant@field node {node}annotationLine 14 repeats the definition that is already expressed by
nodeGroups.md0 {node}and adds no extra context. Keeping both may confuse the generator about hierarchy.Safe to delete:
-## @field node {node} Node configurationpackages/apps/nats/Makefile (1)
1-5: Markgenerateas.PHONYand future-proof the targetMake is caching sensitive—without
.PHONY, a leftover file calledgeneratewould skip your rule.+PHONY: generate generate: cozyvalues-gen -v values.yaml -s values.schema.json -r README.mdVery small, but saves head-scratching later.
packages/apps/virtual-machine/values.yaml (1)
24-26: Strip trailing whitespace to keep YAML lint-cleanYAMLlint flagged Line 25 for trailing spaces. They do not change semantics but pollute diffs and will keep the file failing the lint step.
-## @field systemDisk.storageClass {*string} StorageClass used to store the data␠␠ +## @field systemDisk.storageClass {*string} StorageClass used to store the datapackages/apps/http-cache/README.md (1)
80-87: Keep type annotations consistent between HAProxy and Nginx tables
haproxy.resourcesis typed asobject, while the equivalentnginx.resourcesis*object. Pick one convention (prefer*objectfor optional objects, as used elsewhere) to avoid confusion.-| `haproxy.resources` | Explicit CPU and memory configuration for each replica. When left empty, the preset defined in `resourcesPreset` is applied. | `object` | `{}` | +| `haproxy.resources` | Explicit CPU and memory configuration for each replica. When left empty, the preset defined in `resourcesPreset` is applied. | `*object` | `null` |packages/apps/http-cache/values.schema.json (1)
41-44: Consider restoring an explicit default forstorageClassREADME shows
""as default, but the schema omits it. Add"default": ""for parity unless an unset value has special meaning.packages/apps/virtual-machine/README.md (1)
57-58: Minor wording tweak for clarityAdd a subject to avoid the LanguageTool warning.
-| `sshKeys` | List of SSH public keys for authentication. Can be a single key or a list of keys. | `[]string` | `[]` | +| `sshKeys` | List of SSH public keys for authentication. It can be a single key or a list of keys. | `[]string` | `[]` |packages/apps/postgres/values.yaml (1)
94-95: Prefer realistic example credentials (maintainer preference).Long-term learning indicates the project avoids placeholders like
<access key>.
Consider switching to plausible-looking but non-functional examples to remain consistent.- s3AccessKey: "<access key>" - s3SecretKey: "<secret key>" + # Example credentials – NOT real secrets + s3AccessKey: "AKIAEXAMPLEKEY123" + s3SecretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"packages/apps/kubernetes/README.md (1)
127-127: Optional wording simplification“Considered only when” is shorter than “Taken into account only when”.
- | `addons.ingressNginx.hosts` | List of domain names that the parent cluster should route to this tenant cluster. Taken into account only when `exposeMethod` is set to `Proxied`. | `[]string` | `[]` | + | `addons.ingressNginx.hosts` | List of domain names routed to this tenant cluster. Considered only when `exposeMethod` is `Proxied`. | `[]string` | `[]` |packages/apps/vm-disk/values.schema.json (1)
19-22: Provide an explicit enum forsource.imageThe description lists fixed options (
ubuntu,fedora,cirros,alpine,talos) but the schema does not enforce them. Adding anenumlist prevents typos and lets UIs offer a dropdown."image": { "description": "Use image by name: uploaded as \"golden image\" or from the list: `ubuntu`, `fedora`, `cirros`, `alpine`, and `talos`.", - "type": "string" + "type": "string", + "enum": ["ubuntu", "fedora", "cirros", "alpine", "talos"] },packages/apps/vpn/values.schema.json (1)
60-73: Optional: prohibit unknown attributes inside each user objectConsider adding
"additionalProperties": falseinside the per-user object to prevent typos (e.g.,passwrod) from silently passing validation.packages/apps/clickhouse/values.schema.json (1)
11-16: Default credentials look real – consider neutral placeholdersThe schema ships realistic-looking
resticPassword,s3AccessKey, ands3SecretKeydefaults. Although they’re obviously examples, it is easy for users to miss that and accidentally deploy them unchanged, creating a security risk.- "resticPassword": "ChaXoveekoh6eigh4siesheeda2quai0", + "resticPassword": "<change-me>", ... - "s3AccessKey": "oobaiRus9pah8PhohL1ThaeTa4UVa7gu", + "s3AccessKey": "<ACCESS_KEY>", ... - "s3SecretKey": "ju3eum4dekeich9ahM1te8waeGai0oog", + "s3SecretKey": "<SECRET_KEY>",Using obvious placeholders keeps the example secure while still demonstrating proper structure.
Also applies to: 60-63
packages/apps/nats/values.schema.json (1)
37-40: Duplicate wording inresourcesdescription
"replica. When left empty, the preset defined in \resourcesPreset` is applied."` is repeated twice.- "description": "Explicit CPU and memory configuration for each NATS replica. When left empty, the preset defined in `resourcesPreset` is applied. replica. When left empty, the preset defined in `resourcesPreset` is applied.", + "description": "Explicit CPU and memory configuration for each NATS replica. When left empty, the preset defined in `resourcesPreset` is applied.",packages/apps/mysql/values.schema.json (1)
107-109: Inaccurate description – mentions MariaDB instead of MySQL- "description": "Number of MariaDB replicas", + "description": "Number of MySQL replicas",packages/apps/virtual-machine/values.schema.json (1)
109-133: Optional: forbid unknown keys insideresourcesIf you want to prevent typos such as
memroy, add"additionalProperties": falseto theresourcesobject.
This small change catches user mistakes early without impacting legit fields.packages/apps/postgres/values.schema.json (1)
13-15: Placeholders conflict with repository conventionPrevious PRs established a preference for realistic-looking example credentials.
Replace<access key>/<secret key>with plausible dummy strings (similar to FerretDB) for consistency.packages/apps/mysql/values.yaml (1)
3-5: Replace “MariaDB” → “MySQL” to avoid product-name confusionSeveral docstrings still reference MariaDB, while this chart is clearly for MySQL. Keeping the names aligned prevents user confusion and keeps search/grep results trustworthy.
-## @param replicas {int} Number of MariaDB replicas +## @param replicas {int} Number of MySQL replicas ... -## @param resources {*resources} Explicit CPU and memory configuration for each MariaDB replica. When left empty, the preset defined in `resourcesPreset` is applied. +## @param resources {*resources} Explicit CPU and memory configuration for each MySQL replica. When left empty, the preset defined in `resourcesPreset` is applied.Also applies to: 12-12
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (62)
.github/workflows/pre-commit.yml(1 hunks)packages/apps/clickhouse/Makefile(1 hunks)packages/apps/clickhouse/README.md(1 hunks)packages/apps/clickhouse/values.schema.json(1 hunks)packages/apps/clickhouse/values.yaml(2 hunks)packages/apps/ferretdb/Makefile(1 hunks)packages/apps/ferretdb/README.md(1 hunks)packages/apps/ferretdb/values.schema.json(1 hunks)packages/apps/ferretdb/values.yaml(2 hunks)packages/apps/http-cache/Makefile(1 hunks)packages/apps/http-cache/README.md(1 hunks)packages/apps/http-cache/values.schema.json(1 hunks)packages/apps/http-cache/values.yaml(2 hunks)packages/apps/kafka/README.md(1 hunks)packages/apps/kafka/values.schema.json(1 hunks)packages/apps/kafka/values.yaml(2 hunks)packages/apps/kubernetes/Makefile(1 hunks)packages/apps/kubernetes/README.md(1 hunks)packages/apps/kubernetes/values.schema.json(1 hunks)packages/apps/kubernetes/values.yaml(2 hunks)packages/apps/mysql/Makefile(1 hunks)packages/apps/mysql/README.md(1 hunks)packages/apps/mysql/values.schema.json(1 hunks)packages/apps/mysql/values.yaml(3 hunks)packages/apps/nats/Makefile(1 hunks)packages/apps/nats/README.md(1 hunks)packages/apps/nats/values.schema.json(1 hunks)packages/apps/nats/values.yaml(2 hunks)packages/apps/postgres/Makefile(1 hunks)packages/apps/postgres/README.md(1 hunks)packages/apps/postgres/values.schema.json(1 hunks)packages/apps/postgres/values.yaml(3 hunks)packages/apps/rabbitmq/Makefile(1 hunks)packages/apps/rabbitmq/README.md(1 hunks)packages/apps/rabbitmq/values.schema.json(1 hunks)packages/apps/rabbitmq/values.yaml(2 hunks)packages/apps/redis/Makefile(1 hunks)packages/apps/redis/values.yaml(1 hunks)packages/apps/tcp-balancer/Makefile(1 hunks)packages/apps/tcp-balancer/README.md(1 hunks)packages/apps/tcp-balancer/values.schema.json(2 hunks)packages/apps/tcp-balancer/values.yaml(2 hunks)packages/apps/virtual-machine/Makefile(1 hunks)packages/apps/virtual-machine/README.md(1 hunks)packages/apps/virtual-machine/values.schema.json(3 hunks)packages/apps/virtual-machine/values.yaml(2 hunks)packages/apps/vm-disk/Makefile(1 hunks)packages/apps/vm-disk/README.md(1 hunks)packages/apps/vm-disk/values.schema.json(1 hunks)packages/apps/vm-disk/values.yaml(2 hunks)packages/apps/vm-instance/Makefile(1 hunks)packages/apps/vm-instance/README.md(1 hunks)packages/apps/vm-instance/values.schema.json(2 hunks)packages/apps/vm-instance/values.yaml(2 hunks)packages/apps/vpn/Makefile(1 hunks)packages/apps/vpn/README.md(1 hunks)packages/apps/vpn/values.schema.json(1 hunks)packages/apps/vpn/values.yaml(1 hunks)packages/extra/monitoring/Makefile(1 hunks)packages/extra/monitoring/README.md(1 hunks)packages/extra/monitoring/values.schema.json(1 hunks)packages/extra/monitoring/values.yaml(4 hunks)
🧰 Additional context used
🧠 Learnings (9)
📓 Common learnings
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/ferretdb/README.md:35-37
Timestamp: 2025-07-02T09:58:11.406Z
Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1196
File: packages/apps/http-cache/Makefile:24-27
Timestamp: 2025-07-14T16:23:12.803Z
Learning: In the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.json files during its operation. Therefore, when using readme-generator in Makefiles, any enum values need to be injected back into the schema using yq commands after readme-generator has run, not before.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/clickhouse/README.md:60-67
Timestamp: 2025-07-03T05:54:51.264Z
Learning: The `cozy-lib.resources.sanitize` function in packages/library/cozy-lib/templates/_resources.tpl supports both standard Kubernetes resource format (with limits:/requests: sections) and flat format (direct resource specifications). The flat format takes priority over nested values. CozyStack apps include cozy-lib as a chart dependency through symlinks in packages/apps/*/charts/cozy-lib directories.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/postgres/values.yaml:55-60
Timestamp: 2025-07-26T17:54:57.273Z
Learning: In the cozystack repository, the cozyvalues-gen tool does not support `@typedef` syntax for defining custom type aliases in documentation comments.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/extra/monitoring/README.md:30-31
Timestamp: 2025-07-26T18:26:01.447Z
Learning: The cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) where it incorrectly places Grafana configuration entries under the wrong documentation sections, specifically placing grafana.resources.requests.* entries in the Metrics storage configuration table instead of the Grafana configuration table.
Learnt from: lllamnyp
PR: cozystack/cozystack#1025
File: packages/apps/kafka/charts/cozy-lib:1-1
Timestamp: 2025-06-04T06:22:17.306Z
Learning: Files in packages/apps/*/charts/cozy-lib that contain the path "../../../library/cozy-lib" are symbolic links, not regular files. Git diffs may display symlinks as regular files with their target path as content, which can be misleading in code review.
📚 Learning: in the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.js...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1196
File: packages/apps/http-cache/Makefile:24-27
Timestamp: 2025-07-14T16:23:12.803Z
Learning: In the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.json files during its operation. Therefore, when using readme-generator in Makefiles, any enum values need to be injected back into the schema using yq commands after readme-generator has run, not before.
Applied to files:
.github/workflows/pre-commit.ymlpackages/apps/ferretdb/Makefilepackages/apps/virtual-machine/Makefilepackages/apps/tcp-balancer/Makefilepackages/apps/vm-disk/Makefilepackages/apps/http-cache/Makefilepackages/apps/rabbitmq/Makefilepackages/apps/nats/Makefilepackages/apps/redis/Makefilepackages/apps/postgres/Makefilepackages/apps/vm-instance/Makefilepackages/apps/vpn/Makefilepackages/apps/kubernetes/Makefilepackages/apps/clickhouse/Makefilepackages/extra/monitoring/Makefilepackages/apps/mysql/Makefilepackages/apps/kafka/values.schema.jsonpackages/apps/kubernetes/values.schema.jsonpackages/apps/nats/values.schema.json
📚 Learning: the cozystack project uses yq v4+ on their ci runner, so yq v4 syntax (-o json --indent 4) is compat...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1117
File: packages/apps/mysql/Makefile:8-8
Timestamp: 2025-06-26T04:29:24.830Z
Learning: The cozystack project uses yq v4+ on their CI runner, so yq v4 syntax (-o json --indent 4) is compatible and version checks are not needed.
Applied to files:
packages/apps/ferretdb/Makefilepackages/apps/rabbitmq/Makefilepackages/apps/nats/Makefilepackages/apps/redis/Makefilepackages/apps/postgres/Makefilepackages/apps/vpn/Makefile
📚 Learning: the cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) wh...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/extra/monitoring/README.md:30-31
Timestamp: 2025-07-26T18:26:01.447Z
Learning: The cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) where it incorrectly places Grafana configuration entries under the wrong documentation sections, specifically placing grafana.resources.requests.* entries in the Metrics storage configuration table instead of the Grafana configuration table.
Applied to files:
packages/apps/virtual-machine/Makefilepackages/apps/vm-disk/Makefilepackages/extra/monitoring/values.yamlpackages/extra/monitoring/Makefilepackages/extra/monitoring/README.mdpackages/extra/monitoring/values.schema.json
📚 Learning: in cozystack's schema generator annotation format, when documenting fields of array items, use the s...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/virtual-machine/values.yaml:31-33
Timestamp: 2025-07-26T18:01:52.557Z
Learning: In cozystack's schema generator annotation format, when documenting fields of array items, use the singular form of the item type rather than array notation. For example, for a parameter `gpus {[]gpu}`, use `@field gpu.name` rather than `@field gpus[].name` to refer to the name field of each GPU object in the array.
Applied to files:
packages/apps/http-cache/values.yamlpackages/extra/monitoring/values.yamlpackages/apps/redis/values.yamlpackages/apps/virtual-machine/values.yamlpackages/apps/vpn/values.yamlpackages/apps/kubernetes/values.yamlpackages/apps/kafka/values.yamlpackages/apps/vm-instance/values.yamlpackages/apps/nats/values.yamlpackages/apps/postgres/values.yamlpackages/apps/mysql/values.yamlpackages/apps/ferretdb/values.yaml
📚 Learning: the `cozy-lib.resources.sanitize` function in packages/library/cozy-lib/templates/_resources.tpl sup...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/clickhouse/README.md:60-67
Timestamp: 2025-07-03T05:54:51.264Z
Learning: The `cozy-lib.resources.sanitize` function in packages/library/cozy-lib/templates/_resources.tpl supports both standard Kubernetes resource format (with limits:/requests: sections) and flat format (direct resource specifications). The flat format takes priority over nested values. CozyStack apps include cozy-lib as a chart dependency through symlinks in packages/apps/*/charts/cozy-lib directories.
Applied to files:
packages/apps/rabbitmq/Makefilepackages/apps/nats/Makefilepackages/apps/redis/Makefilepackages/apps/postgres/Makefilepackages/apps/vpn/Makefilepackages/apps/kubernetes/values.schema.jsonpackages/extra/monitoring/values.schema.json
📚 Learning: the `./charts/robotlb/` directory in the hetzner-robotlb package contains vendored code, and the tea...
Learnt from: lllamnyp
PR: cozystack/cozystack#1233
File: packages/system/hetzner-robotlb/charts/robotlb/templates/deployment.yaml:33-35
Timestamp: 2025-07-23T09:15:09.658Z
Learning: The `./charts/robotlb/` directory in the hetzner-robotlb package contains vendored code, and the team generally avoids modifying vendored code to maintain clean separation from upstream dependencies.
Applied to files:
packages/apps/kubernetes/Makefile
📚 Learning: in the cozystack repository, the cozyvalues-gen tool does not support `@typedef` syntax for defining...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/postgres/values.yaml:55-60
Timestamp: 2025-07-26T17:54:57.273Z
Learning: In the cozystack repository, the cozyvalues-gen tool does not support `@typedef` syntax for defining custom type aliases in documentation comments.
Applied to files:
packages/extra/monitoring/values.yaml
📚 Learning: in the cozystack repository, for the virtual-machine app's resources.sockets parameter, the value is...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/virtual-machine/values.yaml:0-0
Timestamp: 2025-07-26T18:12:05.641Z
Learning: In the cozystack repository, for the virtual-machine app's resources.sockets parameter, the value is intentionally kept as a string in values.yaml despite being documented as {int} type, because the string-to-integer parsing happens elsewhere in the system pipeline rather than at the YAML validation level.
Applied to files:
packages/apps/redis/values.yamlpackages/apps/vm-disk/values.yamlpackages/apps/tcp-balancer/values.yamlpackages/apps/virtual-machine/values.yamlpackages/apps/vpn/values.yamlpackages/apps/vm-instance/values.yamlpackages/apps/clickhouse/values.yamlpackages/apps/vpn/values.schema.jsonpackages/apps/nats/values.yamlpackages/apps/rabbitmq/values.yamlpackages/apps/virtual-machine/README.mdpackages/apps/mysql/values.yamlpackages/apps/virtual-machine/values.schema.jsonpackages/apps/vm-instance/values.schema.json
🪛 LanguageTool
packages/apps/vm-instance/README.md
[style] ~56-~56: To form a complete sentence, be sure to include a subject or ‘there’.
Context: ... of SSH public keys for authentication. Can be a single key or a list of keys. ...
(MISSING_IT_THERE)
packages/apps/kubernetes/README.md
[style] ~127-~127: ‘Taken into account’ might be wordy. Consider a shorter alternative.
Context: ...er should route to this tenant cluster. Taken into account only when exposeMethod is set to `Pro...
(EN_WORDINESS_PREMIUM_TAKEN_INTO_ACCOUNT)
packages/apps/virtual-machine/README.md
[style] ~57-~57: To form a complete sentence, be sure to include a subject or ‘there’.
Context: ... of SSH public keys for authentication. Can be a single key or a list of keys. ...
(MISSING_IT_THERE)
🪛 YAMLlint (1.37.1)
packages/apps/virtual-machine/values.yaml
[error] 25-25: trailing spaces
(trailing-spaces)
🪛 GitHub Actions: Pre-Commit Checks
packages/apps/kafka/values.yaml
[error] 1-1: Make generate failed due to missing metadata keys: kafka.replicas, kafka.resources, kafka.resourcesPreset, kafka.size, kafka.storageClass, zookeeper.replicas, zookeeper.resources, zookeeper.resourcesPreset, zookeeper.size, zookeeper.storageClass. Also metadata provided for non existing keys: kafka, zookeeper.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
🔇 Additional comments (24)
packages/apps/kafka/values.yaml (1)
56-71: Repeat the@field/@paramissue forzookeeperblockThe exact CI error list includes
zookeeper.*for the same reason.
Replace the@fieldtags with@param(or move them to a dedicatedREADMEsection and omit metadata entirely).⛔ Skipped due to learnings
Learnt from: NickVolynkin PR: cozystack/cozystack#1216 File: packages/apps/virtual-machine/values.yaml:31-33 Timestamp: 2025-07-26T18:01:52.557Z Learning: In cozystack's schema generator annotation format, when documenting fields of array items, use the singular form of the item type rather than array notation. For example, for a parameter `gpus {[]gpu}`, use `@field gpu.name` rather than `@field gpus[].name` to refer to the name field of each GPU object in the array.packages/apps/kafka/README.md (1)
25-35: Enum values undocumented in generated schema
resourcesPresetis documented here with allowed values, but that enum vanished fromvalues.schema.json.
After fixing thevalues.yamlannotations (previous comment), ensure the enum survives generation; otherwise consumers lose validation and IDE autocompletion.packages/apps/vm-disk/Makefile (1)
3-5: Double-check enum lists in the generated schemaI wasn’t able to locate
values.schema.jsonunderpackages/apps/vm-disk; it’s produced by thegeneratetarget. After running the updated command, please confirm that all expected enum properties (e.g.resourcesPreset) are still present:• Run the generation step:
make -C packages/apps/vm-disk generate
• Verify enums in the output:jq '.properties |..| objects | select(.enum?)' packages/apps/vm-disk/values.schema.jsonpackages/apps/ferretdb/Makefile (1)
3-5: LGTM – simplified generation flowReplacing the multi-step README/schema generation with a single
cozyvalues-gencall reduces maintenance overhead and removes brittleyqpatches. No further issues spotted.packages/apps/http-cache/Makefile (1)
24-26: Schema enum check recommended after generator switchSimilar to
vm-disk, enum values forhaproxy.resourcesPresetandnginx.resourcesPresetwere previously injected viayq.
Please confirm thatcozyvalues-gennow preserves those enums; otherwise generated schemas will lose validation of preset names.packages/apps/vpn/Makefile (1)
3-5: resourcesPreset.enum preserved after switchVerification confirms that
packages/apps/vpn/values.schema.jsonstill contains the fullresourcesPreset.enumlist under.properties.resourcesPreset.enum. No further action is needed.packages/apps/postgres/Makefile (1)
3-5: Enums intact after cozyvalues-genVerified that
packages/apps/postgres/values.schema.jsonlists the fullresourcesPreset.enumarray:[ "nano", "micro", "small", "medium", "large", "xlarge", "2xlarge" ]No additional
yqpatch is required.packages/apps/tcp-balancer/Makefile (1)
3-5: Confirm schema completeness after replacing manual patchesOur quick check found no empty
enumarrays inpackages/apps/tcp-balancer/values.schema.json, which is a good sign. However, to ensure that all expected enums (for example, thepresetsenum) are still present and fully populated, please manually verify their contents:• Verify the
presetsenum isn’t missing values:jq '.properties.presets.enum' packages/apps/tcp-balancer/values.schema.json• Spot-check other enums for expected entries:
jq '.. | select(has("enum")) | {path: path(.), enum: .enum}' packages/apps/tcp-balancer/values.schema.jsonpackages/apps/kubernetes/Makefile (1)
8-9: Ensure.properties.version.enumis present aftercozyvalues-gen
cozyvalues-gencan restructure the schema, so the subsequentyqinjection may no-op if the path has changed.Please manually verify:
- Run the generation step locally:
cozyvalues-gen -v values.yaml -s values.schema.json -r README.md- Inspect
values.schema.jsonto confirm.properties.version.enumexists.- If the enum property has moved, update the
yqcommand inpackages/apps/kubernetes/Makefile(lines 8–9) to the correct JSON path.packages/apps/rabbitmq/Makefile (1)
3-4: Was the resourcesPreset enum intentionally dropped?Previously the Makefile patched
values.schema.jsonto injectresourcesPreset.enum.
If that enum is still required by consumers, confirm thatcozyvalues-gennow generates it automatically; otherwise clients will lose validation.packages/apps/redis/Makefile (1)
3-4: Confirm that cozyvalues-gen preserves the lost enum listThe earlier manual patch that set
resourcesPreset.enumis now gone.
Please verify that the generated schema still advertises the expected presets; if not, re-add a minimalyqpost-step.packages/apps/mysql/Makefile (1)
6-8: Add.PHONYforgenerateand confirm enum retention
- In
packages/apps/mysql/Makefile, add a.PHONY: generatedeclaration above thegeneratetarget.- We ran
jq '.properties.resourcesPreset.enum'onpackages/apps/mysql/values.schema.jsonand confirmed the full enum list remains intact.+.PHONY: generate generate: cozyvalues-gen -v values.yaml -s values.schema.json -r README.mdpackages/apps/redis/values.yaml (1)
12-13: Keep enum list in sync with presets helperIf a new preset is introduced in library charts (
cozy-lib) and not appended here, chart users get validation failures. Please confirm the allowed list matchestemplates/_resources.tpl.packages/apps/vpn/values.yaml (1)
24-31: Non-standard map notation may break generator
{map[string]user}is not recognised bycozyvalues-gen; it expects{map[string]User}or{map[User]}depending on version. Verify rendered schema – missing struct fields here will silently accept any value.packages/apps/nats/values.yaml (1)
21-28: Clarify behaviour when a user object omitspasswordExample shows:
user2: {}If
passwordis optional, document that explicitly (*stringcurrently hints but is easy to miss). If it’s required, drop the empty-object example to prevent misconfiguration.No code change required if it is truly optional—just tighten the docstring.
packages/apps/tcp-balancer/values.yaml (1)
13-14: Ensure README/table defaults stay in sync withvalues.yamlValues file keeps:
resourcesPreset: "nano" targetPorts.http: 80 targetPorts.https: 443AI summary claims the README was updated to new defaults (
{}and0/0). Double-check that the generated README reflects the actual defaults or update either the values or the docs to avoid drift.Also applies to: 42-47
packages/apps/vm-instance/values.yaml (1)
37-44: Confirmresources.socketsremains a string intentionallyAnnotation now says
{*quantity}but the earlier project note states this field is intentionally left as a string despite being numeric-like. Verify that the schema generator still allows string values; otherwise consumers parsing it as an int may break.No action if confirmed.
packages/apps/clickhouse/values.yaml (1)
1-65: Documentation changes look consistentNo issues detected with the added type annotations and examples. The realistic-looking S3 credentials follow the repository’s established convention for dummy data.
packages/apps/http-cache/README.md (1)
91-99: Align default fornginx.resourceswith HAProxy sectionIf you adopt the
nulldefault for HAProxy above, mirror it here so both tables behave the same.packages/apps/rabbitmq/values.yaml (1)
3-21: Common section LGTMType annotations, enum list, and examples are consistent with the generated schema.
No issues spotted.packages/apps/rabbitmq/values.schema.json (1)
80-84:rolesstructure is completely open – deliberate?
rolesis typed as a bare object with no schema. If role names / flags have a fixed structure, codifying it here will give operators earlier feedback. If it is intentionally free-form, ignore this.packages/apps/ferretdb/values.schema.json (1)
1-184: Schema looks goodAll defaults match declared patterns, integer fields were corrected, and realistic example credentials comply with the maintainer’s preference.
packages/apps/vm-instance/values.schema.json (1)
5-7:cloudInitmissingtypecauses permissive “any”Unlike the virtual-machine schema (string-only), this one omits
typecompletely, which silently allows any JSON value.
Align with the chosen policy (string or string | object) to keep behaviour consistent across sibling charts.packages/apps/mysql/values.yaml (1)
23-25: Verify field-path notation for maps
## @field user.password/user.maxUserConnectionsuses the singularuseridentifier, while the parent param isusers {map[string]user}. Confirm thatcozyvalues-gencorrectly resolves this pattern for map items; older versions expectedusers.*.password.If tooling mis-parses it, switch to the dotted wildcard form.
| | `resources` | Explicit CPU and memory configuration for each Clickhouse replica. When left empty, the preset defined in `resourcesPreset` is applied. | `*object` | `{}` | | ||
| | `resources.cpu` | CPU | `*string` | `null` | | ||
| | `resources.memory` | Memory | `*string` | `null` | | ||
| | `resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`. | `string` | `{}` | | ||
| | `size` | Persistent Volume Claim size, available for application data | `string` | `10Gi` | |
There was a problem hiding this comment.
🛠️ Refactor suggestion
resourcesPreset row: wrong default literal
Same issue as in VPN: resourcesPreset is documented as string but the default shown is {} (object). The chart’s values.yaml still defaults to "nano", so the README is now inconsistent.
-| `resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`. | `string` | `{}` |
+| `resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`. | `string` | `"nano"`|Updating keeps docs, schema and defaults in sync.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| | `resources` | Explicit CPU and memory configuration for each Clickhouse replica. When left empty, the preset defined in `resourcesPreset` is applied. | `*object` | `{}` | | |
| | `resources.cpu` | CPU | `*string` | `null` | | |
| | `resources.memory` | Memory | `*string` | `null` | | |
| | `resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`. | `string` | `{}` | | |
| | `size` | Persistent Volume Claim size, available for application data | `string` | `10Gi` | | |
| | `resources` | Explicit CPU and memory configuration for each Clickhouse replica. When left empty, the preset defined in `resourcesPreset` is applied. | `*object` | `{}` | | |
| | `resources.cpu` | CPU | `*string` | `null` | | |
| | `resources.memory` | Memory | `*string` | `null` | | |
| | `resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`. | `string` | `"nano"` | | |
| | `size` | Persistent Volume Claim size, available for application data | `string` | `10Gi` | |
🤖 Prompt for AI Agents
In packages/apps/clickhouse/README.md around lines 30 to 34, the default value
for `resourcesPreset` is incorrectly documented as `{}` which is an object,
while it should be a string matching the actual default in values.yaml,
`"nano"`. Update the default value in the README to `"nano"` to keep the
documentation consistent with the schema and chart defaults.
| | `resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`. | `string` | `{}` | | ||
| | `size` | Persistent Volume Claim size, available for application data | `string` | `10Gi` | |
There was a problem hiding this comment.
🛠️ Refactor suggestion
resourcesPreset default value contradicts its declared type
Type is string but default Value is {} (object). Align with the Postgres comment above.
-| `resourcesPreset` | ... | `string` | `{}` |
+| `resourcesPreset` | ... | `string` | `""` |📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| | `resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`. | `string` | `{}` | | |
| | `size` | Persistent Volume Claim size, available for application data | `string` | `10Gi` | | |
| | `resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`. | `string` | `""` | | |
| | `size` | Persistent Volume Claim size, available for application data | `string` | `10Gi` | |
🤖 Prompt for AI Agents
In packages/apps/ferretdb/README.md around lines 17 to 18, the default value for
`resourcesPreset` is set to `{}`, which is an object, but its type is declared
as `string`. Update the default value to be a string that matches one of the
allowed values such as an empty string or a valid preset like `nano` to align
the default value with the declared string type.
| ## @field backup.s3SecretKey {string} Secret key for S3, used for authentication | ||
| backup: | ||
| enabled: false | ||
| schedule: "0 2 * * * *" |
There was a problem hiding this comment.
Kubernetes CronJob schedule uses 5 fields, not 6
"0 2 * * * *" includes seconds; Kubernetes will reject it with illegal cron spec.
If seconds precision is really needed, it must be handled inside the container, not via CronJob.
- schedule: "0 2 * * * *"
+ schedule: "0 2 * * *"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| schedule: "0 2 * * * *" | |
| schedule: "0 2 * * *" |
🤖 Prompt for AI Agents
In packages/apps/ferretdb/values.yaml at line 57, the CronJob schedule uses six
fields including seconds, which is invalid for Kubernetes CronJobs that require
only five fields. Remove the seconds field from the schedule string so it
follows the standard five-field cron format (minute, hour, day of month, month,
day of week). If seconds precision is necessary, implement that logic inside the
container instead of in the CronJob schedule.
| "haproxy": { | ||
| "description": "HAProxy configuration", | ||
| "default": { | ||
| "replicas": 2, | ||
| "resources": {}, | ||
| "resourcesPreset": "nano" | ||
| } | ||
| }, | ||
| "nginx": { | ||
| "description": "Nginx configuration", | ||
| "default": { | ||
| "replicas": 2, | ||
| "resources": {}, | ||
| "resourcesPreset": "nano" | ||
| } | ||
| }, |
There was a problem hiding this comment.
haproxy and nginx properties lack a type – schema now allows any JSON value
Without "type": "object" the validator will accept strings, numbers, etc. Add the explicit type (and, ideally, sub-property definitions or additionalProperties: true) to preserve the original intent.
- "haproxy": {
+ "haproxy": {
"description": "HAProxy configuration",
+ "type": "object",
"default": {
"replicas": 2,
"resources": {},
"resourcesPreset": "nano"
}
},
- "nginx": {
+ "nginx": {
"description": "Nginx configuration",
+ "type": "object",
"default": {
"replicas": 2,
"resources": {},
"resourcesPreset": "nano"
}
},📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "haproxy": { | |
| "description": "HAProxy configuration", | |
| "default": { | |
| "replicas": 2, | |
| "resources": {}, | |
| "resourcesPreset": "nano" | |
| } | |
| }, | |
| "nginx": { | |
| "description": "Nginx configuration", | |
| "default": { | |
| "replicas": 2, | |
| "resources": {}, | |
| "resourcesPreset": "nano" | |
| } | |
| }, | |
| "haproxy": { | |
| "description": "HAProxy configuration", | |
| "type": "object", | |
| "default": { | |
| "replicas": 2, | |
| "resources": {}, | |
| "resourcesPreset": "nano" | |
| } | |
| }, | |
| "nginx": { | |
| "description": "Nginx configuration", | |
| "type": "object", | |
| "default": { | |
| "replicas": 2, | |
| "resources": {}, | |
| "resourcesPreset": "nano" | |
| } | |
| }, |
🤖 Prompt for AI Agents
In packages/apps/http-cache/values.schema.json around lines 18 to 33, the
haproxy and nginx properties are missing the "type" field, causing the schema
validator to accept any JSON value instead of enforcing an object structure. Add
"type": "object" to both haproxy and nginx definitions, and include either
detailed sub-property definitions or "additionalProperties": true to explicitly
define or allow their contents, preserving the intended schema validation.
| "kafka": { | ||
| "description": "Kafka configuration", | ||
| "default": { | ||
| "replicas": 3, | ||
| "resources": {}, | ||
| "resourcesPreset": "small", | ||
| "size": "10Gi", | ||
| "storageClass": "" | ||
| } |
There was a problem hiding this comment.
kafka property lacks an explicit type
Without "type": "object" the schema allows any JSON value for kafka (string, number, etc.).
Add the type to keep validation strict:
- "kafka": {
- "description": "Kafka configuration",
+ "kafka": {
+ "description": "Kafka configuration",
+ "type": "object",Repeat for zookeeper.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "kafka": { | |
| "description": "Kafka configuration", | |
| "default": { | |
| "replicas": 3, | |
| "resources": {}, | |
| "resourcesPreset": "small", | |
| "size": "10Gi", | |
| "storageClass": "" | |
| } | |
| "kafka": { | |
| "description": "Kafka configuration", | |
| "type": "object", | |
| "default": { | |
| "replicas": 3, | |
| "resources": {}, | |
| "resourcesPreset": "small", | |
| "size": "10Gi", | |
| "storageClass": "" | |
| } |
🤖 Prompt for AI Agents
In packages/apps/kafka/values.schema.json around lines 10 to 18, the "kafka"
property is missing an explicit "type": "object" declaration, which causes the
schema to accept any JSON value type for "kafka". Add "type": "object" to the
"kafka" property to enforce that it must be an object. Repeat the same addition
for the "zookeeper" property to ensure strict validation.
| ## @field request.cpu {*quantity} CPU request (minimal available value) | ||
| ## @field request.memory {*quantity} Memory request (minimal available value) | ||
| ## @field limit.cpu {*quantity} CPU limit (maximum available value) | ||
| ## @field limit.memory {*quantity} Memory limit (maximum available value) | ||
| ## @field vmcomponent.minAllowed {*limit} Minimum allowed resources (requests) for each component | ||
| ## @field vmcomponent.maxAllowed {*request} Maximum allowed resources (limits) for each component | ||
| ## @field resources.requests {*request} | ||
| ## @field resources.limits {*limit} |
There was a problem hiding this comment.
Resource-field names are mis-spelled and will break cozyvalues-gen parsing
request. / limit. should be plural (requests. / limits.) and belong under resources.*.
With the current singular names the generator will not resolve the path, the produced schema will miss CPU/Memory validation, and downstream docs will be wrong.
-## @field request.cpu {*quantity} CPU request (minimal available value)
-## @field request.memory {*quantity} Memory request (minimal available value)
-## @field limit.cpu {*quantity} CPU limit (maximum available value)
-## @field limit.memory {*quantity} Memory limit (maximum available value)
+## @field resources.requests.cpu {*quantity} CPU request (minimal available value)
+## @field resources.requests.memory {*quantity} Memory request (minimal available value)
+## @field resources.limits.cpu {*quantity} CPU limit (maximum available value)
+## @field resources.limits.memory {*quantity} Memory limit (maximum available value)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ## @field request.cpu {*quantity} CPU request (minimal available value) | |
| ## @field request.memory {*quantity} Memory request (minimal available value) | |
| ## @field limit.cpu {*quantity} CPU limit (maximum available value) | |
| ## @field limit.memory {*quantity} Memory limit (maximum available value) | |
| ## @field vmcomponent.minAllowed {*limit} Minimum allowed resources (requests) for each component | |
| ## @field vmcomponent.maxAllowed {*request} Maximum allowed resources (limits) for each component | |
| ## @field resources.requests {*request} | |
| ## @field resources.limits {*limit} | |
| ## @field resources.requests.cpu {*quantity} CPU request (minimal available value) | |
| ## @field resources.requests.memory {*quantity} Memory request (minimal available value) | |
| ## @field resources.limits.cpu {*quantity} CPU limit (maximum available value) | |
| ## @field resources.limits.memory {*quantity} Memory limit (maximum available value) | |
| ## @field vmcomponent.minAllowed {*limit} Minimum allowed resources (requests) for each component | |
| ## @field vmcomponent.maxAllowed {*request} Maximum allowed resources (limits) for each component | |
| ## @field resources.requests {*request} | |
| ## @field resources.limits {*limit} |
🤖 Prompt for AI Agents
In packages/extra/monitoring/values.yaml around lines 18 to 25, the resource
field names use singular forms 'request.' and 'limit.' which should be plural as
'requests.' and 'limits.' and must be nested under 'resources.*'. Update these
field names to their correct plural forms and ensure they are properly placed
under the 'resources' section to fix the cozyvalues-gen parsing, enable correct
CPU/Memory validation, and generate accurate downstream documentation.
| ## @field resources.requests {*request} | ||
| ## @field resources.limits {*limit} | ||
| ## @field minmax.minAllowed {*request} | ||
| ## @field minmax.Allowed {*request} |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Duplicate/typo-ridden aliases pollute the namespace
The four aliases resources.*, minmax.* are sufficient.
minmax.Allowed (capital “A”) is a typo, and the pair minmax.minAllowed / minmax.Allowed duplicates the earlier definition. Recommend deleting these two lines entirely.
🤖 Prompt for AI Agents
In packages/extra/monitoring/values.yaml around lines 24 to 27, remove the two
lines defining minmax.minAllowed and minmax.Allowed because minmax.Allowed has a
typo with a capital "A" and both lines duplicate existing definitions. Keep only
the correct aliases resources.* and minmax.* to avoid namespace pollution.
5e6aac5 to
b9d6f59
Compare
Nick Volynkin (NickVolynkin)
changed the title
Nick Volynkin (NickVolynkin)
changed the title
Nick Volynkin (NickVolynkin)
changed the title
There was a problem hiding this comment.
Actionable comments posted: 8
♻️ Duplicate comments (8)
packages/apps/clickhouse/values.schema.json (1)
8-27: Entire-object default + all fields required: repeated usability concernDefining a full-object
"default"(Lines 8-17) while simultaneously marking every property as"required"(Lines 18-27) forces users who wish to override a single backup field (e.g.backup.enabled) to specify the whole object, reducing flexibility and increasing the risk of configuration errors.
This exact issue was raised in an earlier review and remains unresolved.packages/apps/mysql/values.schema.json (1)
13-15: Wrong backup bucket path still references PostgresBoth the top-level
backup.default.s3Bucket(Line 13) and the property-level default (Line 52) point topostgres-backups.
Update these defaults to a MySQL-specific bucket to avoid operator confusion.- "s3Bucket": "s3.example.org/postgres-backups", + "s3Bucket": "s3.example.org/mysql-backups",Also applies to: 49-53
packages/apps/rabbitmq/values.schema.json (1)
73-85:vhosttop-level property still present (duplicate feedback)A singular
vhostalongside thevhostsmap is confusing and was previously flagged as a generator artefact.
Please remove it unless there is a concrete use-case distinct fromvhosts.packages/apps/vm-instance/README.md (2)
42-42:externalMethoddefault literal conflicts with declared typeThe row declares
externalMethodasstringbut sets its default to{}(object). Use an empty string ("") instead of an object to match the declared type.
57-57: The cloud-init examples link is brokenThe link points to the format documentation instead of the examples page. The URL should point to the examples page.
packages/apps/kubernetes/README.md (2)
118-129: Strip the strayvalue}artefacts from all*.valuesOverriderowsThe typo reported in the previous review is still present (
value}prefix in descriptions forcertManager,cilium,ingressNginx, etc.).
Please edit the source comments invalues.yamlso the generated README is clean.
168-169: Add the missing.serversegment to Konnectivity resource pathsRows for CPU / memory still read
controlPlane.konnectivity.resources.*instead of
controlPlane.konnectivity.server.resources.*, breaking field linking consistency.packages/apps/kubernetes/values.schema.json (1)
160-167:nodeGroups.*.resourcesstill missing quantity validation for CPU / memoryPrevious suggestion to add pattern +
x-kubernetes-int-or-stringguards was not
applied, leaving room for invalid values like"foo".
🧹 Nitpick comments (7)
packages/apps/clickhouse/values.schema.json (1)
10-17: Real-looking credentials ship as chart defaults – verify & consider placeholders
resticPassword,s3AccessKey, ands3SecretKeycontain realistic-looking secrets that triggered gitleaks. Even if they are dummy values, shipping them as defaults in the schema means a user who forgets to override them will deploy the chart with those credentials in plain text.Recommended options:
- Replace with clearly fake placeholders (e.g.
"CHANGEME").- Keep the realistic style the maintainer prefers only in README examples, not in executable defaults.
Please confirm these strings are non-secret and reconsider whether defaulting secrets in a schema is desirable.
Also applies to: 40-48, 60-62
packages/apps/mysql/values.schema.json (1)
112-114: Duplicated sentence inresourcesdescriptionThe phrase “replica. When left empty, the preset defined in
resourcesPresetis applied.” appears twice.- "description": "Explicit CPU and memory configuration for each MariaDB replica. When left empty, the preset defined in `resourcesPreset` is applied. replica. When left empty, the preset defined in `resourcesPreset` is applied.", + "description": "Explicit CPU and memory configuration for each MariaDB replica. When left empty, the preset defined in `resourcesPreset` is applied.",packages/apps/ferretdb/values.schema.json (3)
42-46: Add pattern validation for duration & cron expressions
retentionPolicyandscheduleaccept free-form strings. A simple regex prevents obvious typos and gives editors proper intellisense."retentionPolicy": { "description": "Retention policy", "type": "string", + "pattern": "^[0-9]+[smhdw]$", // e.g. 30d, 12h "default": "30d" ... "schedule": { "description": "Cron schedule for automated backups", "type": "string", + "pattern": "^((\\d+|\\*)\\s+){5}\\S+$", // basic cron (5/6 fields) "default": "0 2 * * * *" }Also applies to: 57-61
169-182: Optional: make per-user object stricterAt the moment any extra keys inside each user object are silently accepted.
If onlypasswordis allowed, tighten the schema:"additionalProperties": { "type": "object", "properties": { "password": { "description": "Password for the user", "type": "string" } }, + "required": ["password"], + "additionalProperties": false }This prevents accidental misspellings (e.g.,
passwrod).
1-4: Consider forbidding unknown top-level keysUnless you intentionally want to allow arbitrary extensions, adding
"additionalProperties": falseto the root object helps catch typos invalues.yaml."type": "object", + "additionalProperties": false, "properties": {packages/apps/vm-instance/README.md (1)
56-56: Minor grammar improvement neededThe sentence fragment could be improved for clarity.
-| `sshKeys` | List of SSH public keys for authentication. Can be a single key or a list of keys. | `[]string` | `[]` | +| `sshKeys` | List of SSH public keys for authentication. This can be a single key or a list of keys. | `[]string` | `[]` |packages/apps/kubernetes/README.md (1)
127-127: Tighten wording in Ingress hosts descriptionReplace “Taken into account only when” with “Used only when” for brevity.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (50)
hack/e2e-apps/virtualmachine.bats(1 hunks)packages/apps/clickhouse/Makefile(1 hunks)packages/apps/clickhouse/README.md(1 hunks)packages/apps/clickhouse/values.schema.json(1 hunks)packages/apps/clickhouse/values.yaml(2 hunks)packages/apps/ferretdb/Makefile(1 hunks)packages/apps/ferretdb/README.md(1 hunks)packages/apps/ferretdb/values.schema.json(1 hunks)packages/apps/ferretdb/values.yaml(2 hunks)packages/apps/http-cache/Makefile(1 hunks)packages/apps/http-cache/README.md(1 hunks)packages/apps/http-cache/values.schema.json(1 hunks)packages/apps/http-cache/values.yaml(2 hunks)packages/apps/kafka/README.md(1 hunks)packages/apps/kafka/values.schema.json(1 hunks)packages/apps/kafka/values.yaml(2 hunks)packages/apps/kubernetes/Makefile(1 hunks)packages/apps/kubernetes/README.md(1 hunks)packages/apps/kubernetes/values.schema.json(1 hunks)packages/apps/kubernetes/values.yaml(2 hunks)packages/apps/mysql/Makefile(1 hunks)packages/apps/mysql/README.md(1 hunks)packages/apps/mysql/values.schema.json(1 hunks)packages/apps/mysql/values.yaml(3 hunks)packages/apps/nats/Makefile(1 hunks)packages/apps/nats/README.md(1 hunks)packages/apps/nats/values.schema.json(1 hunks)packages/apps/nats/values.yaml(2 hunks)packages/apps/rabbitmq/Makefile(1 hunks)packages/apps/rabbitmq/README.md(1 hunks)packages/apps/rabbitmq/values.schema.json(1 hunks)packages/apps/rabbitmq/values.yaml(2 hunks)packages/apps/redis/Makefile(1 hunks)packages/apps/redis/values.yaml(1 hunks)packages/apps/tcp-balancer/Makefile(1 hunks)packages/apps/tcp-balancer/README.md(1 hunks)packages/apps/tcp-balancer/values.schema.json(2 hunks)packages/apps/tcp-balancer/values.yaml(2 hunks)packages/apps/vm-disk/Makefile(1 hunks)packages/apps/vm-disk/README.md(1 hunks)packages/apps/vm-disk/values.schema.json(1 hunks)packages/apps/vm-disk/values.yaml(2 hunks)packages/apps/vm-instance/Makefile(1 hunks)packages/apps/vm-instance/README.md(1 hunks)packages/apps/vm-instance/values.schema.json(2 hunks)packages/apps/vm-instance/values.yaml(2 hunks)packages/apps/vpn/Makefile(1 hunks)packages/apps/vpn/README.md(1 hunks)packages/apps/vpn/values.schema.json(1 hunks)packages/apps/vpn/values.yaml(1 hunks)
✅ Files skipped from review due to trivial changes (14)
- packages/apps/ferretdb/Makefile
- packages/apps/mysql/Makefile
- packages/apps/vm-disk/Makefile
- packages/apps/clickhouse/README.md
- packages/apps/http-cache/Makefile
- packages/apps/http-cache/README.md
- packages/apps/mysql/README.md
- packages/apps/vm-instance/values.yaml
- packages/apps/kafka/values.yaml
- packages/apps/kubernetes/values.yaml
- packages/apps/nats/Makefile
- packages/apps/ferretdb/README.md
- packages/apps/mysql/values.yaml
- packages/apps/nats/README.md
🚧 Files skipped from review as they are similar to previous changes (28)
- packages/apps/kubernetes/Makefile
- packages/apps/vpn/Makefile
- packages/apps/tcp-balancer/Makefile
- packages/apps/tcp-balancer/values.yaml
- packages/apps/clickhouse/Makefile
- packages/apps/redis/Makefile
- packages/apps/vm-disk/README.md
- packages/apps/vm-instance/Makefile
- packages/apps/redis/values.yaml
- packages/apps/vpn/values.yaml
- packages/apps/http-cache/values.yaml
- packages/apps/clickhouse/values.yaml
- packages/apps/nats/values.yaml
- packages/apps/vpn/README.md
- packages/apps/vm-disk/values.schema.json
- packages/apps/rabbitmq/values.yaml
- packages/apps/vm-disk/values.yaml
- packages/apps/vpn/values.schema.json
- packages/apps/kafka/values.schema.json
- packages/apps/kafka/README.md
- packages/apps/tcp-balancer/values.schema.json
- packages/apps/tcp-balancer/README.md
- packages/apps/rabbitmq/README.md
- packages/apps/vm-instance/values.schema.json
- packages/apps/http-cache/values.schema.json
- packages/apps/ferretdb/values.yaml
- packages/apps/rabbitmq/Makefile
- packages/apps/nats/values.schema.json
🧰 Additional context used
🧠 Learnings (9)
📓 Common learnings
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/ferretdb/README.md:35-37
Timestamp: 2025-07-02T09:58:11.406Z
Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1196
File: packages/apps/http-cache/Makefile:24-27
Timestamp: 2025-07-14T16:23:12.803Z
Learning: In the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.json files during its operation. Therefore, when using readme-generator in Makefiles, any enum values need to be injected back into the schema using yq commands after readme-generator has run, not before.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/clickhouse/README.md:60-67
Timestamp: 2025-07-03T05:54:51.264Z
Learning: The `cozy-lib.resources.sanitize` function in packages/library/cozy-lib/templates/_resources.tpl supports both standard Kubernetes resource format (with limits:/requests: sections) and flat format (direct resource specifications). The flat format takes priority over nested values. CozyStack apps include cozy-lib as a chart dependency through symlinks in packages/apps/*/charts/cozy-lib directories.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/postgres/values.yaml:55-60
Timestamp: 2025-07-26T17:54:57.273Z
Learning: In the cozystack repository, the cozyvalues-gen tool does not support `@typedef` syntax for defining custom type aliases in documentation comments.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/extra/monitoring/README.md:30-31
Timestamp: 2025-07-26T18:26:01.447Z
Learning: The cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) where it incorrectly places Grafana configuration entries under the wrong documentation sections, specifically placing grafana.resources.requests.* entries in the Metrics storage configuration table instead of the Grafana configuration table.
Learnt from: lllamnyp
PR: cozystack/cozystack#1025
File: packages/apps/kafka/charts/cozy-lib:1-1
Timestamp: 2025-06-04T06:22:17.306Z
Learning: Files in packages/apps/*/charts/cozy-lib that contain the path "../../../library/cozy-lib" are symbolic links, not regular files. Git diffs may display symlinks as regular files with their target path as content, which can be misleading in code review.
📚 Learning: in the cozystack repository, for the virtual-machine app's resources.sockets parameter, the value is...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/virtual-machine/values.yaml:0-0
Timestamp: 2025-07-26T18:12:05.641Z
Learning: In the cozystack repository, for the virtual-machine app's resources.sockets parameter, the value is intentionally kept as a string in values.yaml despite being documented as {int} type, because the string-to-integer parsing happens elsewhere in the system pipeline rather than at the YAML validation level.
Applied to files:
hack/e2e-apps/virtualmachine.batspackages/apps/kubernetes/values.schema.jsonpackages/apps/vm-instance/README.md
📚 Learning: in the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.js...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1196
File: packages/apps/http-cache/Makefile:24-27
Timestamp: 2025-07-14T16:23:12.803Z
Learning: In the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.json files during its operation. Therefore, when using readme-generator in Makefiles, any enum values need to be injected back into the schema using yq commands after readme-generator has run, not before.
Applied to files:
packages/apps/rabbitmq/values.schema.jsonpackages/apps/kubernetes/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: in cozystack's schema generator annotation format, when documenting fields of array items, use the s...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/virtual-machine/values.yaml:31-33
Timestamp: 2025-07-26T18:01:52.557Z
Learning: In cozystack's schema generator annotation format, when documenting fields of array items, use the singular form of the item type rather than array notation. For example, for a parameter `gpus {[]gpu}`, use `@field gpu.name` rather than `@field gpus[].name` to refer to the name field of each GPU object in the array.
Applied to files:
packages/apps/rabbitmq/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: the cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) wh...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/extra/monitoring/README.md:30-31
Timestamp: 2025-07-26T18:26:01.447Z
Learning: The cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) where it incorrectly places Grafana configuration entries under the wrong documentation sections, specifically placing grafana.resources.requests.* entries in the Metrics storage configuration table instead of the Grafana configuration table.
Applied to files:
packages/apps/rabbitmq/values.schema.jsonpackages/apps/mysql/values.schema.jsonpackages/apps/kubernetes/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: in the cozystack repository, the cozyvalues-gen tool does not support `@typedef` syntax for defining...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/postgres/values.yaml:55-60
Timestamp: 2025-07-26T17:54:57.273Z
Learning: In the cozystack repository, the cozyvalues-gen tool does not support `@typedef` syntax for defining custom type aliases in documentation comments.
Applied to files:
packages/apps/kubernetes/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: the `cozy-lib.resources.sanitize` function in packages/library/cozy-lib/templates/_resources.tpl sup...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/clickhouse/README.md:60-67
Timestamp: 2025-07-03T05:54:51.264Z
Learning: The `cozy-lib.resources.sanitize` function in packages/library/cozy-lib/templates/_resources.tpl supports both standard Kubernetes resource format (with limits:/requests: sections) and flat format (direct resource specifications). The flat format takes priority over nested values. CozyStack apps include cozy-lib as a chart dependency through symlinks in packages/apps/*/charts/cozy-lib directories.
Applied to files:
packages/apps/kubernetes/values.schema.json
📚 Learning: in cozystack, the plural form for the kubernetes custom resource is `kuberneteses.apps.cozystack.io`...
Learnt from: lllamnyp
PR: cozystack/cozystack#1130
File: hack/e2e-apps/kubernetes.bats:101-101
Timestamp: 2025-07-11T06:11:25.438Z
Learning: In cozystack, the plural form for the Kubernetes custom resource is `kuberneteses.apps.cozystack.io`, not `kubernetes.apps.cozystack.io`. This is defined in the API schema even though it's not grammatically perfect.
Applied to files:
packages/apps/kubernetes/values.schema.json
📚 Learning: in helm templates, the `{{-` directive chomps all leading whitespace including newlines back to the ...
Learnt from: lllamnyp
PR: cozystack/cozystack#1160
File: packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml:6-8
Timestamp: 2025-07-11T06:28:13.696Z
Learning: In Helm templates, the `{{-` directive chomps all leading whitespace including newlines back to the previous content, so `{{- toYaml .Values.something | nindent 2 }}` will render correctly even with apparent indentation issues. However, for better style, it's cleaner to put the template directive on the same line as the parent key (e.g., `rules: {{- toYaml .Values.serviceAccount.permissions | nindent 2 }}`).
Applied to files:
packages/apps/kubernetes/README.md
🪛 Gitleaks (8.27.2)
packages/apps/mysql/values.schema.json
11-11: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
12-12: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
15-15: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
packages/apps/clickhouse/values.schema.json
11-11: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
12-12: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
15-15: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🪛 LanguageTool
packages/apps/kubernetes/README.md
[style] ~127-~127: ‘Taken into account’ might be wordy. Consider a shorter alternative.
Context: ...er should route to this tenant cluster. Taken into account only when exposeMethod is set to `Pro...
(EN_WORDINESS_PREMIUM_TAKEN_INTO_ACCOUNT)
packages/apps/vm-instance/README.md
[style] ~56-~56: To form a complete sentence, be sure to include a subject or ‘there’.
Context: ... of SSH public keys for authentication. Can be a single key or a list of keys. ...
(MISSING_IT_THERE)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
🔇 Additional comments (5)
packages/apps/mysql/values.schema.json (1)
11-15: Gitleaks flags example credentials – confirm intentStatic analysis detects realistic-looking secrets (
resticPassword,s3AccessKey,s3SecretKey).
Long-term learning indicates the maintainer prefers such illustrative values, but please double-check none are real.If these are purely examples, consider adding a comment in README or schema notes stating they are non-functional to silence future secret-scans.
Also applies to: 45-48, 59-63
packages/apps/rabbitmq/values.schema.json (2)
10-14: Addminimum: 1(and optionallymaximum) to thereplicasfieldA replica count of
0produces no StatefulSet pods and will break the chart at runtime.
Explicit numeric bounds make the intent machine-checkable and surface mis-configuration earlier."replicas": { "description": "Number of RabbitMQ replicas", "type": "integer", + "minimum": 1, "default": 3 },
15-33: Consider locking down unknown keys inresourcesRight now any arbitrary attribute under
resourcesis accepted. If the chart only supportscpuandmemory, add"properties": { ... }, + "additionalProperties": falseto fail fast on typos such as
"memroy": "512Mi".
If other keys (e.g.ephemeral-storage) are expected, ignore this.hack/e2e-apps/virtualmachine.bats (1)
23-23: LGTM! Test manifest updated to align with schema changes.The change from empty string resource values to an empty object
{}correctly aligns the test manifest with the updated resource field structure in the virtual-machine app schema.packages/apps/vm-instance/README.md (1)
39-59: Excellent documentation structure improvements!The addition of explicit type annotations and detailed nested field documentation significantly improves the parameter reference. The structured approach with the new Type column makes the documentation much more developer-friendly.
| "quorum": { | ||
| "description": "Configuration for the quorum-based synchronous replication", | ||
| "type": "object", | ||
| "default": { | ||
| "maxSyncReplicas": 0, | ||
| "minSyncReplicas": 0 | ||
| }, | ||
| "required": [ | ||
| "maxSyncReplicas", | ||
| "minSyncReplicas" | ||
| ], | ||
| "properties": { | ||
| "maxSyncReplicas": { | ||
| "description": "Maximum number of synchronous replicas that can acknowledge a transaction (must be lower than the total number of replicas)", | ||
| "type": "integer", | ||
| "default": 0 | ||
| }, | ||
| "minSyncReplicas": { | ||
| "description": "Minimum number of synchronous replicas that must acknowledge a transaction before it is considered committed", | ||
| "type": "integer", | ||
| "default": 0 | ||
| } | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Missing relational constraint between minSyncReplicas, maxSyncReplicas, and replicas
Nothing prevents the user from setting minSyncReplicas > maxSyncReplicas or either value greater than .replicas.
OpenAPI v3 supports allOf + items with if/then to express such dependencies; Helm-lint will surface them.
Consider adding:
"allOf": [
{
"if": { "properties": { "minSyncReplicas": { "type": "integer" },
"maxSyncReplicas": { "type": "integer" } } },
"then": {
"properties": {
"minSyncReplicas": { "maximum": { "$data": "1/maxSyncReplicas" } }
}
}
}
](or equivalent unevaluatedProperties:false with cozyvalues-gen’s x-kubernetes-validations).
🤖 Prompt for AI Agents
In packages/apps/ferretdb/values.schema.json around lines 96 to 118, the schema
lacks constraints to ensure minSyncReplicas is not greater than maxSyncReplicas
and that both are not greater than the total replicas. Add JSON Schema
conditional validation using allOf with if/then clauses to enforce
minSyncReplicas ≤ maxSyncReplicas and both ≤ replicas. This can be done by
referencing maxSyncReplicas and replicas using $data or by using
Kubernetes-specific x-kubernetes-validations to define these relational
constraints.
| | `addons.gatewayAPI.enabled` | Enable the Gateway API | `bool` | `false` | | ||
| | `addons.ingressNginx` | Ingress-NGINX Controller | `object` | `{}` | | ||
| | `addons.ingressNginx.enabled` | Enable the Ingress-NGINX controller (requires nodes labeled with the 'ingress-nginx' role). | `bool` | `false` | | ||
| | `addons.ingressNginx.exposeMethod` | Method to expose the Ingress-NGINX controller. Allowed values: `Proxied`, `LoadBalancer`. | `string` | `{}` | |
There was a problem hiding this comment.
Type / default mismatch for addons.ingressNginx.exposeMethod
The “Type” column says string, yet the “Value” column is {} (object).
Expected default is "Proxied" (or an empty string) matching the schema.
-| `addons.ingressNginx.exposeMethod` | ... | `string` | `{}` |
+| `addons.ingressNginx.exposeMethod` | ... | `string` | `Proxied` |📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| | `addons.ingressNginx.exposeMethod` | Method to expose the Ingress-NGINX controller. Allowed values: `Proxied`, `LoadBalancer`. | `string` | `{}` | | |
| | `addons.ingressNginx.exposeMethod` | Method to expose the Ingress-NGINX controller. Allowed values: `Proxied`, `LoadBalancer`. | `string` | `Proxied` | |
🤖 Prompt for AI Agents
In packages/apps/kubernetes/README.md at line 126, the default value for
`addons.ingressNginx.exposeMethod` is incorrectly shown as `{}` which is an
object, while the type is string. Update the default value in the table to
`"Proxied"` or an empty string to match the expected string type and schema.
| "addons": { | ||
| "properties": { | ||
| "description": "Cluster addons configuration", | ||
| "default": { | ||
| "certManager": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable cert-manager, which automatically creates and manages SSL/TLS certificates.", | ||
| "type": "boolean" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "valuesOverride": {} | ||
| }, | ||
| "cilium": { | ||
| "properties": { | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "valuesOverride": {} | ||
| }, | ||
| "fluxcd": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable FluxCD", | ||
| "type": "boolean" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "valuesOverride": {} | ||
| }, | ||
| "gatewayAPI": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable the Gateway API", | ||
| "type": "boolean" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false | ||
| }, | ||
| "gpuOperator": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable the GPU-operator", | ||
| "type": "boolean" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "valuesOverride": {} | ||
| }, | ||
| "ingressNginx": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable the Ingress-NGINX controller (requires nodes labeled with the 'ingress-nginx' role).", | ||
| "type": "boolean" | ||
| }, | ||
| "exposeMethod": { | ||
| "default": "Proxied", | ||
| "description": "Method to expose the Ingress-NGINX controller. (allowed values: Proxied, LoadBalancer)", | ||
| "type": "string", | ||
| "enum": [ | ||
| "Proxied", | ||
| "LoadBalancer" | ||
| ] | ||
| }, | ||
| "hosts": { | ||
| "default": [], | ||
| "description": "List of domain names that the parent cluster should route to this tenant cluster. Taken into account only when `exposeMethod` is set to `Proxied`.", | ||
| "items": {}, | ||
| "type": "array" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "exposeMethod": "Proxied", | ||
| "hosts": {}, | ||
| "valuesOverride": {} | ||
| }, | ||
| "monitoringAgents": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable monitoring agents (Fluent Bit and VMAgents) to send logs and metrics. If tenant monitoring is enabled, data is sent to tenant storage; otherwise, it goes to root storage.", | ||
| "type": "boolean" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "valuesOverride": {} | ||
| }, | ||
| "velero": { | ||
| "properties": { | ||
| "enabled": { | ||
| "default": false, | ||
| "description": "Enable velero for backup and restore k8s cluster.", | ||
| "type": "boolean" | ||
| }, | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "enabled": false, | ||
| "valuesOverride": {} | ||
| }, | ||
| "verticalPodAutoscaler": { | ||
| "properties": { | ||
| "valuesOverride": { | ||
| "default": {}, | ||
| "description": "Custom values to override", | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "valuesOverride": {} | ||
| } | ||
| }, | ||
| "type": "object" | ||
| } | ||
| }, |
There was a problem hiding this comment.
addons schema lost its validation – re-add type and properties
The object now exposes only a default block; without "type": "object" and a
"properties" map, every key/value passes unchecked. This is a regression from
the previous schema and drops critical validation of nested structures.
Restore the full schema (types, enums, sub-properties).
🤖 Prompt for AI Agents
In packages/apps/kubernetes/values.schema.json between lines 5 and 44, the
"addons" schema is missing the "type": "object" declaration and the detailed
"properties" definitions, causing loss of validation for nested keys. To fix
this, reintroduce the "type": "object" for "addons" and define the "properties"
field with all nested addon configurations, including their types and any enums
or required fields, restoring the full validation structure as in the previous
schema version.
| "exposeMethod": "Proxied", | ||
| "hosts": {}, | ||
| "valuesOverride": {} | ||
| }, |
There was a problem hiding this comment.
Default for addons.ingressNginx.hosts must be an array, not an object
hosts is typed as array, yet the default is {} which violates the type
constraint and will fail validation in strict JSON-schema tooling.
- "hosts": {},
+ "hosts": [],📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "exposeMethod": "Proxied", | |
| "hosts": {}, | |
| "valuesOverride": {} | |
| }, | |
| "exposeMethod": "Proxied", | |
| - "hosts": {}, | |
| + "hosts": [], | |
| "valuesOverride": {} | |
| }, |
🤖 Prompt for AI Agents
In packages/apps/kubernetes/values.schema.json around lines 28 to 31, the
default value for "addons.ingressNginx.hosts" is set as an empty object {}, but
the schema defines "hosts" as an array. Change the default value from {} to an
empty array [] to match the array type and pass strict JSON-schema validation.
| "controlPlane": { | ||
| "properties": { | ||
| "description": "Control Plane Configuration", | ||
| "default": { | ||
| "apiServer": { | ||
| "properties": { | ||
| "resources": { | ||
| "default": {}, | ||
| "description": "Explicit CPU and memory configuration for the API Server. When left empty, the preset defined in `resourcesPreset` is applied.", | ||
| "type": "object" | ||
| }, | ||
| "resourcesPreset": { | ||
| "default": "medium", | ||
| "description": "Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge.", | ||
| "type": "string", | ||
| "enum": [ | ||
| "nano", | ||
| "micro", | ||
| "small", | ||
| "medium", | ||
| "large", | ||
| "xlarge", | ||
| "2xlarge" | ||
| ] | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "resources": {}, | ||
| "resourcesPreset": "medium" | ||
| }, | ||
| "controllerManager": { | ||
| "properties": { | ||
| "resources": { | ||
| "default": {}, | ||
| "description": "Explicit CPU and memory configuration for the Controller Manager. When left empty, the preset defined in `resourcesPreset` is applied.", | ||
| "type": "object" | ||
| }, | ||
| "resourcesPreset": { | ||
| "default": "micro", | ||
| "description": "Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge.", | ||
| "type": "string", | ||
| "enum": [ | ||
| "nano", | ||
| "micro", | ||
| "small", | ||
| "medium", | ||
| "large", | ||
| "xlarge", | ||
| "2xlarge" | ||
| ] | ||
| } | ||
| }, | ||
| "type": "object" | ||
| "resources": {}, | ||
| "resourcesPreset": "micro" | ||
| }, | ||
| "konnectivity": { | ||
| "properties": { | ||
| "server": { | ||
| "properties": { | ||
| "resources": { | ||
| "default": {}, | ||
| "description": "Explicit CPU and memory configuration for Konnectivity. When left empty, the preset defined in `resourcesPreset` is applied.", | ||
| "type": "object" | ||
| }, | ||
| "resourcesPreset": { | ||
| "default": "micro", | ||
| "description": "Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge.", | ||
| "type": "string", | ||
| "enum": [ | ||
| "nano", | ||
| "micro", | ||
| "small", | ||
| "medium", | ||
| "large", | ||
| "xlarge", | ||
| "2xlarge" | ||
| ] | ||
| } | ||
| }, | ||
| "type": "object" | ||
| } | ||
| }, | ||
| "type": "object" | ||
| }, | ||
| "replicas": { | ||
| "default": 2, | ||
| "description": "Number of replicas for Kubernetes control-plane components.", | ||
| "type": "number" | ||
| "server": { | ||
| "resources": {}, | ||
| "resourcesPreset": "micro" | ||
| } | ||
| }, | ||
| "replicas": 2, | ||
| "scheduler": { | ||
| "properties": { | ||
| "resources": {}, | ||
| "resourcesPreset": "micro" | ||
| } | ||
| } | ||
| }, |
There was a problem hiding this comment.
controlPlane schema also lacks type and nested properties definitions
Same problem as above: only defaults remain. Re-introduce the explicit
structure so invalid fields are rejected at chart-install time.
🤖 Prompt for AI Agents
In packages/apps/kubernetes/values.schema.json around lines 45 to 68, the
controlPlane schema is missing the "type" and nested "properties" definitions,
which means invalid fields are not rejected during chart installation. Add the
"type": "object" for controlPlane and define the nested "properties" for
apiServer, controllerManager, konnectivity, replicas, and scheduler, specifying
their expected types and sub-properties to enforce schema validation properly.
| "users": { | ||
| "description": "Users configuration", | ||
| "type": "object", | ||
| "default": {}, | ||
| "additionalProperties": { | ||
| "type": "object", | ||
| "properties": { | ||
| "password": { | ||
| "description": "Password for the user", | ||
| "type": "string" | ||
| }, | ||
| "vhosts": { | ||
| "default": {}, | ||
| "description": "Virtual Hosts configuration", | ||
| "type": "object" | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
password should be declared as a required field for each user
Without a required array a user entry can be created with no password, silently passing schema validation.
"additionalProperties": {
"type": "object",
"properties": {
"password": {
"description": "Password for the user",
"type": "string",
+ "minLength": 1
}
- }
+ },
+ "required": ["password"]
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "users": { | |
| "description": "Users configuration", | |
| "type": "object", | |
| "default": {}, | |
| "additionalProperties": { | |
| "type": "object", | |
| "properties": { | |
| "password": { | |
| "description": "Password for the user", | |
| "type": "string" | |
| }, | |
| "vhosts": { | |
| "default": {}, | |
| "description": "Virtual Hosts configuration", | |
| "type": "object" | |
| } | |
| } | |
| } | |
| "users": { | |
| "description": "Users configuration", | |
| "type": "object", | |
| "default": {}, | |
| "additionalProperties": { | |
| "type": "object", | |
| "properties": { | |
| "password": { | |
| "description": "Password for the user", | |
| "type": "string", | |
| "minLength": 1 | |
| } | |
| }, | |
| "required": ["password"] | |
| } | |
| } |
🤖 Prompt for AI Agents
In packages/apps/rabbitmq/values.schema.json around lines 59 to 71, the password
field inside each user object is not marked as required, allowing user entries
without passwords to pass validation. Add a "required" array inside the user
object schema that includes "password" to enforce that every user must have a
password defined.
b9d6f59 to
7021ce3
Compare
There was a problem hiding this comment.
Actionable comments posted: 4
♻️ Duplicate comments (10)
packages/apps/mysql/values.schema.json (1)
49-52: Backup bucket path still points to Postgres
The default value referencespostgres-backups, which is misleading for the MySQL chart.packages/apps/ferretdb/values.yaml (1)
57-57: Duplicate: CronJob schedule still uses 6-field spec, Kubernetes accepts 5.
"0 2 * * * *"includes seconds; Kubernetes CronJobs reject it withillegal cron spec. Drop the leading ‑seconds field.packages/apps/vm-instance/README.md (2)
42-43:externalMethoddefault literal still contradicts declaredstringtype
The default is shown as{}(object) while the column declaresstring. Prior feedback already highlighted this mismatch; please switch the default to an empty string ("") or a valid enum value such as"PortList"to avoid Helm/YAML type-mismatch errors.
57-57: Broken “examples” link – duplicates the “format” URL
Both links currently point to/explanation/format.html. Update the second one to/reference/examples.htmlso readers reach the actual cloud-init examples page.packages/apps/rabbitmq/values.schema.json (2)
59-71:passwordfield still not enforced – schema allows users without credentialsThe earlier review already pointed out that each user object must declare
passwordas a required, non-empty string.
The current version still lacks the"required": ["password"]array and aminLengthguard, so invalid configurations silently pass validation."properties": { "password": { "description": "Password for the user", "type": "string", + "minLength": 1 } }, + "required": ["password"]
73-85: Redundant top-levelvhostproperty remains
values.yamlonly defines avhostsmap.
Keeping a solitaryvhostobject at the root is a generator artefact that confuses users and tooling; please drop it.packages/apps/clickhouse/values.schema.json (1)
18-27:backupobject marked as fullyrequiredstill blocks partial overrides
Previous feedback pointed this out; nothing changed. Users must now repeat eight fields just to tweak one value.Either drop the
"required"array or leave only the truly mandatory field(s) (e.g.enabled).
The current schema hurts UX without adding real validation value.packages/apps/kubernetes/README.md (3)
118-129: Remove strayvalue}artefacts invaluesOverridedescriptionsThe typo raised in the previous review still exists (
value}prefix). Clean up the description texts forcertManager,cilium, andingressNginxrows to match the style already used for the other addons.
126-126: Default value foraddons.ingressNginx.exposeMethodis still an object
Typeisstringbut theValuecolumn shows{}.
Either use an empty quoted string""or a concrete default such as"Proxied".
167-170: Path and preset inconsistencies for Konnectivity resources
- The rows for CPU and memory lost the
.serversegment, breaking field linking (controlPlane.konnectivity.resources.*→ should becontrolPlane.konnectivity.server.resources.*).resourcesPresetshows{}while the type isstring(same issue as other presets).-| `controlPlane.konnectivity.resources.cpu` -| `controlPlane.konnectivity.resources.memory` +| `controlPlane.konnectivity.server.resources.cpu` +| `controlPlane.konnectivity.server.resources.memory` -| `controlPlane.konnectivity.server.resourcesPreset` | ... | `string` | `{}` | +| `controlPlane.konnectivity.server.resourcesPreset` | ... | `string` | `""` |
🧹 Nitpick comments (6)
packages/apps/mysql/values.schema.json (2)
112-112: Typo: duplicated sentence fragment in descriptionThe phrase “…replica. When left empty, the preset defined in
resourcesPresetis applied.” is repeated. Trim the duplication for clarity.- "description": "Explicit CPU and memory configuration for each MariaDB replica. When left empty, the preset defined in `resourcesPreset` is applied. replica. When left empty, the preset defined in `resourcesPreset` is applied.", + "description": "Explicit CPU and memory configuration for each MariaDB replica. When left empty, the preset defined in `resourcesPreset` is applied.",
106-109: Inconsistent terminology: MariaDB vs MySQLThe schema is under
packages/apps/mysql, yet the description reads “Number of MariaDB replicas”. Unless the chart intentionally deploys MariaDB, replace with “MySQL” to avoid confusion.packages/apps/ferretdb/values.yaml (1)
61-62: Sample S3 keys trigger secret-scanners – add explicit “dummy” markers or allow-list pragma.Static analysis flags these as real credentials. Given the repo’s convention of realistic-looking examples, they’re presumably fake, but CI/security tooling will still complain. Consider:
- s3AccessKey: oobaiRus9pah8PhohL1ThaeTa4UVa7gu - s3SecretKey: ju3eum4dekeich9ahM1te8waeGai0oog + # pragma: allowlist secret + s3AccessKey: DUMMY_ACCESS_KEY + s3SecretKey: DUMMY_SECRET_KEYor keep the realistic values but add a
# pragma: allowlist secretcomment to silence automated scanners.packages/apps/rabbitmq/values.schema.json (1)
15-33: Lock downresourcesobject to known keysAt present, any unexpected key under
resourcesis silently accepted.
Add"additionalProperties": falseto prevent typos likememroy."type": "object", "default": {}, + "additionalProperties": false,packages/apps/clickhouse/values.schema.json (1)
141-152: Consider makingpasswordmandatory for each user definitionA user without a password is rarely desirable and usually a mis-configuration. Add a
requiredarray to enforce it and optionally defaultreadonlytofalse."additionalProperties": { "type": "object", "properties": { "password": { "description": "Password for the user", "type": "string" }, "readonly": { "description": "User is `readonly`, default is `false`.", "type": "boolean", - "default": false + "default": false } + }, + "required": ["password"] } }packages/apps/kubernetes/README.md (1)
127-127: Minor wording nit — “Taken into account”LanguageTool flags the phrase as wordy. Consider “considered” for brevity.
No functional impact; ignore if you prefer current wording.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (49)
packages/apps/clickhouse/Makefile(1 hunks)packages/apps/clickhouse/README.md(1 hunks)packages/apps/clickhouse/values.schema.json(1 hunks)packages/apps/clickhouse/values.yaml(2 hunks)packages/apps/ferretdb/Makefile(1 hunks)packages/apps/ferretdb/README.md(1 hunks)packages/apps/ferretdb/values.schema.json(1 hunks)packages/apps/ferretdb/values.yaml(2 hunks)packages/apps/http-cache/Makefile(1 hunks)packages/apps/http-cache/README.md(1 hunks)packages/apps/http-cache/values.schema.json(1 hunks)packages/apps/http-cache/values.yaml(2 hunks)packages/apps/kafka/README.md(1 hunks)packages/apps/kafka/values.schema.json(1 hunks)packages/apps/kafka/values.yaml(2 hunks)packages/apps/kubernetes/Makefile(1 hunks)packages/apps/kubernetes/README.md(1 hunks)packages/apps/kubernetes/values.schema.json(1 hunks)packages/apps/kubernetes/values.yaml(2 hunks)packages/apps/mysql/Makefile(1 hunks)packages/apps/mysql/README.md(1 hunks)packages/apps/mysql/values.schema.json(1 hunks)packages/apps/mysql/values.yaml(3 hunks)packages/apps/nats/Makefile(1 hunks)packages/apps/nats/README.md(1 hunks)packages/apps/nats/values.schema.json(1 hunks)packages/apps/nats/values.yaml(2 hunks)packages/apps/rabbitmq/Makefile(1 hunks)packages/apps/rabbitmq/README.md(1 hunks)packages/apps/rabbitmq/values.schema.json(1 hunks)packages/apps/rabbitmq/values.yaml(2 hunks)packages/apps/redis/Makefile(1 hunks)packages/apps/redis/values.yaml(1 hunks)packages/apps/tcp-balancer/Makefile(1 hunks)packages/apps/tcp-balancer/README.md(1 hunks)packages/apps/tcp-balancer/values.schema.json(2 hunks)packages/apps/tcp-balancer/values.yaml(2 hunks)packages/apps/vm-disk/Makefile(1 hunks)packages/apps/vm-disk/README.md(1 hunks)packages/apps/vm-disk/values.schema.json(1 hunks)packages/apps/vm-disk/values.yaml(2 hunks)packages/apps/vm-instance/Makefile(1 hunks)packages/apps/vm-instance/README.md(1 hunks)packages/apps/vm-instance/values.schema.json(2 hunks)packages/apps/vm-instance/values.yaml(2 hunks)packages/apps/vpn/Makefile(1 hunks)packages/apps/vpn/README.md(1 hunks)packages/apps/vpn/values.schema.json(1 hunks)packages/apps/vpn/values.yaml(1 hunks)
✅ Files skipped from review due to trivial changes (14)
- packages/apps/vm-disk/Makefile
- packages/apps/ferretdb/Makefile
- packages/apps/tcp-balancer/Makefile
- packages/apps/mysql/Makefile
- packages/apps/ferretdb/README.md
- packages/apps/mysql/README.md
- packages/apps/kubernetes/values.yaml
- packages/apps/tcp-balancer/values.yaml
- packages/apps/nats/README.md
- packages/apps/http-cache/Makefile
- packages/apps/http-cache/README.md
- packages/apps/nats/values.yaml
- packages/apps/mysql/values.yaml
- packages/apps/clickhouse/values.yaml
🚧 Files skipped from review as they are similar to previous changes (29)
- packages/apps/vpn/Makefile
- packages/apps/clickhouse/Makefile
- packages/apps/http-cache/values.yaml
- packages/apps/redis/Makefile
- packages/apps/kubernetes/Makefile
- packages/apps/kafka/values.schema.json
- packages/apps/rabbitmq/Makefile
- packages/apps/clickhouse/README.md
- packages/apps/redis/values.yaml
- packages/apps/tcp-balancer/values.schema.json
- packages/apps/vm-disk/values.yaml
- packages/apps/rabbitmq/values.yaml
- packages/apps/vm-instance/values.yaml
- packages/apps/vm-instance/Makefile
- packages/apps/http-cache/values.schema.json
- packages/apps/kafka/values.yaml
- packages/apps/vpn/values.schema.json
- packages/apps/vpn/README.md
- packages/apps/vpn/values.yaml
- packages/apps/vm-disk/README.md
- packages/apps/nats/Makefile
- packages/apps/vm-disk/values.schema.json
- packages/apps/nats/values.schema.json
- packages/apps/kafka/README.md
- packages/apps/rabbitmq/README.md
- packages/apps/kubernetes/values.schema.json
- packages/apps/tcp-balancer/README.md
- packages/apps/vm-instance/values.schema.json
- packages/apps/ferretdb/values.schema.json
🧰 Additional context used
🧠 Learnings (7)
📓 Common learnings
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/ferretdb/README.md:35-37
Timestamp: 2025-07-02T09:58:11.406Z
Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1196
File: packages/apps/http-cache/Makefile:24-27
Timestamp: 2025-07-14T16:23:12.803Z
Learning: In the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.json files during its operation. Therefore, when using readme-generator in Makefiles, any enum values need to be injected back into the schema using yq commands after readme-generator has run, not before.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/clickhouse/README.md:60-67
Timestamp: 2025-07-03T05:54:51.264Z
Learning: The `cozy-lib.resources.sanitize` function in packages/library/cozy-lib/templates/_resources.tpl supports both standard Kubernetes resource format (with limits:/requests: sections) and flat format (direct resource specifications). The flat format takes priority over nested values. CozyStack apps include cozy-lib as a chart dependency through symlinks in packages/apps/*/charts/cozy-lib directories.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/postgres/values.yaml:55-60
Timestamp: 2025-07-26T17:54:57.273Z
Learning: In the cozystack repository, the cozyvalues-gen tool does not support `typedef` syntax for defining custom type aliases in documentation comments.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/extra/monitoring/README.md:30-31
Timestamp: 2025-07-26T18:26:01.447Z
Learning: The cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) where it incorrectly places Grafana configuration entries under the wrong documentation sections, specifically placing grafana.resources.requests.* entries in the Metrics storage configuration table instead of the Grafana configuration table.
Learnt from: lllamnyp
PR: cozystack/cozystack#1025
File: packages/apps/kafka/charts/cozy-lib:1-1
Timestamp: 2025-06-04T06:22:17.306Z
Learning: Files in packages/apps/*/charts/cozy-lib that contain the path "../../../library/cozy-lib" are symbolic links, not regular files. Git diffs may display symlinks as regular files with their target path as content, which can be misleading in code review.
📚 Learning: in the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.js...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1196
File: packages/apps/http-cache/Makefile:24-27
Timestamp: 2025-07-14T16:23:12.803Z
Learning: In the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.json files during its operation. Therefore, when using readme-generator in Makefiles, any enum values need to be injected back into the schema using yq commands after readme-generator has run, not before.
Applied to files:
packages/apps/rabbitmq/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: in cozystack's schema generator annotation format, when documenting fields of array items, use the s...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/virtual-machine/values.yaml:31-33
Timestamp: 2025-07-26T18:01:52.557Z
Learning: In cozystack's schema generator annotation format, when documenting fields of array items, use the singular form of the item type rather than array notation. For example, for a parameter `gpus {[]gpu}`, use `field gpu.name` rather than `field gpus[].name` to refer to the name field of each GPU object in the array.
Applied to files:
packages/apps/rabbitmq/values.schema.jsonpackages/apps/ferretdb/values.yamlpackages/apps/kubernetes/README.md
📚 Learning: the cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) wh...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/extra/monitoring/README.md:30-31
Timestamp: 2025-07-26T18:26:01.447Z
Learning: The cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) where it incorrectly places Grafana configuration entries under the wrong documentation sections, specifically placing grafana.resources.requests.* entries in the Metrics storage configuration table instead of the Grafana configuration table.
Applied to files:
packages/apps/rabbitmq/values.schema.jsonpackages/apps/mysql/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: in the cozystack repository, the cozyvalues-gen tool does not support `@typedef` syntax for defining...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/postgres/values.yaml:55-60
Timestamp: 2025-07-26T17:54:57.273Z
Learning: In the cozystack repository, the cozyvalues-gen tool does not support `typedef` syntax for defining custom type aliases in documentation comments.
Applied to files:
packages/apps/kubernetes/README.md
📚 Learning: in helm templates, the `{{-` directive chomps all leading whitespace including newlines back to the ...
Learnt from: lllamnyp
PR: cozystack/cozystack#1160
File: packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml:6-8
Timestamp: 2025-07-11T06:28:13.696Z
Learning: In Helm templates, the `{{-` directive chomps all leading whitespace including newlines back to the previous content, so `{{- toYaml .Values.something | nindent 2 }}` will render correctly even with apparent indentation issues. However, for better style, it's cleaner to put the template directive on the same line as the parent key (e.g., `rules: {{- toYaml .Values.serviceAccount.permissions | nindent 2 }}`).
Applied to files:
packages/apps/kubernetes/README.md
📚 Learning: in the cozystack repository, for the virtual-machine app's resources.sockets parameter, the value is...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/virtual-machine/values.yaml:0-0
Timestamp: 2025-07-26T18:12:05.641Z
Learning: In the cozystack repository, for the virtual-machine app's resources.sockets parameter, the value is intentionally kept as a string in values.yaml despite being documented as {int} type, because the string-to-integer parsing happens elsewhere in the system pipeline rather than at the YAML validation level.
Applied to files:
packages/apps/vm-instance/README.md
🪛 Gitleaks (8.27.2)
packages/apps/mysql/values.schema.json
11-11: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
12-12: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
15-15: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
packages/apps/ferretdb/values.yaml
61-61: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
62-62: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🪛 LanguageTool
packages/apps/kubernetes/README.md
[style] ~127-~127: ‘Taken into account’ might be wordy. Consider a shorter alternative.
Context: ...er should route to this tenant cluster. Taken into account only when exposeMethod is set to `Pro...
(EN_WORDINESS_PREMIUM_TAKEN_INTO_ACCOUNT)
packages/apps/vm-instance/README.md
[style] ~56-~56: To form a complete sentence, be sure to include a subject or ‘there’.
Context: ... of SSH public keys for authentication. Can be a single key or a list of keys. ...
(MISSING_IT_THERE)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Build
🔇 Additional comments (2)
packages/apps/mysql/values.schema.json (1)
11-15: Potential leak of realistic-looking credentials – please confirm intent
resticPassword,s3AccessKey, ands3SecretKeycontain values that trigger secret-scanning tools.
Given the long-standing practice of using “plausible” example credentials (see learning from PR #1120), please double-check that these are indeed dummy strings and not production secrets. If they are genuine examples, consider prefixing them with"example-"or adding a doc note to avoid future false positives in automated scans.packages/apps/clickhouse/values.schema.json (1)
75-77: Verify Helm & IDE compatibility withx-kubernetes-int-or-stringThe
x-kubernetes-int-or-stringvendor extension is valid in Kubernetes CRD schemas but may be unrecognized by Helm’s JSON-Schema validator or IDE plugins that expect plain Draft-07 keywords. Please confirm that:
helm lint packages/apps/clickhousepasses without errors or warningshelm template packages/apps/clickhouserenders manifests correctly- Any IDE JSON-Schema validators in your team’s workflows still work
Relevant locations in packages/apps/clickhouse/values.schema.json:
- Lines 75–77
- Lines 96–98
- Lines 102–104
| "resticPassword": "ChaXoveekoh6eigh4siesheeda2quai0", | ||
| "s3AccessKey": "oobaiRus9pah8PhohL1ThaeTa4UVa7gu", | ||
| "s3Bucket": "s3.example.org/clickhouse-backups", | ||
| "s3Region": "us-east-1", | ||
| "s3SecretKey": "ju3eum4dekeich9ahM1te8waeGai0oog", | ||
| "schedule": "0 2 * * *" |
There was a problem hiding this comment.
Remove hard-coded default secrets from schema
Sensible-looking access keys and passwords are shipped as defaults. If users deploy the chart without overriding them, real clusters will run with publicly known credentials.
Strip these defaults (or set them to empty strings) and let users provide their own via values.yaml or secret references.
- "resticPassword": "ChaXoveekoh6eigh4siesheeda2quai0",
- "s3AccessKey": "oobaiRus9pah8PhohL1ThaeTa4UVa7gu",
- "s3Bucket": "s3.example.org/clickhouse-backups",
- "s3Region": "us-east-1",
- "s3SecretKey": "ju3eum4dekeich9ahM1te8waeGai0oog",
+ "resticPassword": "",
+ "s3AccessKey": "",
+ "s3Bucket": "",
+ "s3Region": "",
+ "s3SecretKey": "",Add a short description note that these fields must be overridden in production.
Also applies to: 40-48, 60-63
🤖 Prompt for AI Agents
In packages/apps/clickhouse/values.schema.json around lines 11 to 16, remove the
hard-coded default secrets such as resticPassword, s3AccessKey, s3SecretKey, and
others by setting their default values to empty strings. Add a description note
to these fields indicating that they must be overridden in production
environments. Repeat this change for the similar fields found around lines 40-48
and 60-63 to ensure no sensitive defaults are shipped.
| | `nodeGroups.md0.resources.cpu` | Available CPU | `string` | `""` | | ||
| | `nodeGroups.md0.resources.memory` | Available memory (RAM) | `string` | `""` | |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Inconsistent pointer-vs-value notation for worker node resources
Control-plane CPU/memory fields use the pointer style (*string with null default), but worker-node fields are plain string with empty-string default.
Align the worker-node rows to the same convention for consistency and to indicate optionality unambiguously.
🤖 Prompt for AI Agents
In packages/apps/kubernetes/README.md around lines 106 to 107, the worker node
resource fields for CPU and memory are documented as plain strings with
empty-string defaults, unlike the control-plane fields which use pointer style
with null defaults. Update the worker node resource fields to use pointer
notation (e.g., *string) and set their default values to null to match the
control-plane style, ensuring consistency and clear indication of optionality.
| | `controlPlane.apiServer.resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge. | `string` | `{}` | | ||
| | `controlPlane.controllerManager` | Controller Manager configuration. | `object` | `{}` | | ||
| | `controlPlane.controllerManager.resources` | Explicit CPU and memory configuration for the Controller Manager. When left empty, the preset defined in `resourcesPreset` is applied. | `object` | `{}` | | ||
| | `controlPlane.controllerManager.resources.cpu` | Available CPU | `*string` | `null` | | ||
| | `controlPlane.controllerManager.resources.memory` | Available memory (RAM) | `*string` | `null` | | ||
| | `controlPlane.controllerManager.resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge. | `string` | `{}` | | ||
| | `controlPlane.scheduler` | Scheduler configuration. | `object` | `{}` | | ||
| | `controlPlane.scheduler.resources` | Explicit CPU and memory configuration for the Scheduler. When left empty, the preset defined in `resourcesPreset` is applied. | `object` | `{}` | | ||
| | `controlPlane.scheduler.resources.cpu` | Available CPU | `*string` | `null` | | ||
| | `controlPlane.scheduler.resources.memory` | Available memory (RAM) | `*string` | `null` | | ||
| | `controlPlane.scheduler.resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge. | `string` | `{}` | |
There was a problem hiding this comment.
Preset defaults shown as {} although type is string
resourcesPreset for API Server, Controller Manager and Scheduler list {} as the default, which is an object, not a string. Use "" (empty string) or a concrete preset name.
-| `controlPlane.apiServer.resourcesPreset` | ... | `string` | `{}` |
+| `controlPlane.apiServer.resourcesPreset` | ... | `string` | `""` |Apply the same fix to all preset rows in this section.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| | `controlPlane.apiServer.resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge. | `string` | `{}` | | |
| | `controlPlane.controllerManager` | Controller Manager configuration. | `object` | `{}` | | |
| | `controlPlane.controllerManager.resources` | Explicit CPU and memory configuration for the Controller Manager. When left empty, the preset defined in `resourcesPreset` is applied. | `object` | `{}` | | |
| | `controlPlane.controllerManager.resources.cpu` | Available CPU | `*string` | `null` | | |
| | `controlPlane.controllerManager.resources.memory` | Available memory (RAM) | `*string` | `null` | | |
| | `controlPlane.controllerManager.resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge. | `string` | `{}` | | |
| | `controlPlane.scheduler` | Scheduler configuration. | `object` | `{}` | | |
| | `controlPlane.scheduler.resources` | Explicit CPU and memory configuration for the Scheduler. When left empty, the preset defined in `resourcesPreset` is applied. | `object` | `{}` | | |
| | `controlPlane.scheduler.resources.cpu` | Available CPU | `*string` | `null` | | |
| | `controlPlane.scheduler.resources.memory` | Available memory (RAM) | `*string` | `null` | | |
| | `controlPlane.scheduler.resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge. | `string` | `{}` | | |
| | `controlPlane.apiServer.resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge. | `string` | `""` | | |
| | `controlPlane.controllerManager` | Controller Manager configuration. | `object` | `{}` | | |
| | `controlPlane.controllerManager.resources` | Explicit CPU and memory configuration for the Controller Manager. When left empty, the preset defined in `resourcesPreset` is applied. | `object` | `{}` | | |
| | `controlPlane.controllerManager.resources.cpu` | Available CPU | `*string` | `null` | | |
| | `controlPlane.controllerManager.resources.memory` | Available memory (RAM) | `*string` | `null` | | |
| | `controlPlane.controllerManager.resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge. | `string` | `{}` | | |
| | `controlPlane.scheduler` | Scheduler configuration. | `object` | `{}` | | |
| | `controlPlane.scheduler.resources` | Explicit CPU and memory configuration for the Scheduler. When left empty, the preset defined in `resourcesPreset` is applied. | `object` | `{}` | | |
| | `controlPlane.scheduler.resources.cpu` | Available CPU | `*string` | `null` | | |
| | `controlPlane.scheduler.resources.memory` | Available memory (RAM) | `*string` | `null` | | |
| | `controlPlane.scheduler.resourcesPreset` | Default sizing preset used when `resources` is omitted. Allowed values: nano, micro, small, medium, large, xlarge, 2xlarge. | `string` | `{}` | |
🤖 Prompt for AI Agents
In packages/apps/kubernetes/README.md around lines 155 to 165, the default
values for `resourcesPreset` fields are incorrectly shown as `{}`, which is an
object, while the type is `string`. Change these default values to `""` (empty
string) or a valid preset name string for all `resourcesPreset` entries in this
section to correctly reflect the string type.
| "replicas": { | ||
| "description": "Number of RabbitMQ replicas", | ||
| "type": "integer", | ||
| "default": 3 | ||
| }, |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Prevent accidental scale-to-zero – add a lower bound to replicas
Zero replicas renders the chart non-functional. Add a "minimum": 1 constraint to enforce at least one RabbitMQ pod.
"replicas": {
"description": "Number of RabbitMQ replicas",
"type": "integer",
+ "minimum": 1,
"default": 3
},📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "replicas": { | |
| "description": "Number of RabbitMQ replicas", | |
| "type": "integer", | |
| "default": 3 | |
| }, | |
| "replicas": { | |
| "description": "Number of RabbitMQ replicas", | |
| "type": "integer", | |
| "minimum": 1, | |
| "default": 3 | |
| }, |
🤖 Prompt for AI Agents
In packages/apps/rabbitmq/values.schema.json around lines 10 to 14, the replicas
property lacks a minimum constraint, allowing zero which makes the chart
non-functional. Add a "minimum": 1 field to the replicas schema to enforce at
least one RabbitMQ pod.
798289f to
de84c98
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (17)
packages/apps/vm-instance/README.md (2)
42-42: Default literal type mismatch forexternalMethodpersistsThe field is declared as
stringbut its default literal is{}(object), which will cause a Helm/YAML type-mismatch. Use an empty string ("") or change the declared type toobject.-| `externalMethod` | Specify method to pass through the traffic to the virtual machine. Allowed values: `WholeIP` and `PortList` | `string` | `{}` | +| `externalMethod` | Specify method to pass through the traffic to the virtual machine. Allowed values: `WholeIP` and `PortList` | `string` | `""` |
57-57: Broken “examples” link for cloud-init documentationBoth “format” and “examples” URLs point to the same page. Update the “examples” link to
reference/examples.html.-| `cloudInit` | cloud-init user data config. See cloud-init documentation for more details: [format](https://cloudinit.readthedocs.io/en/latest/explanation/format.html), [examples](https://cloudinit.readthedocs.io/en/latest/explanation/format.html). | `object` | `{}` | +| `cloudInit` | cloud-init user data config. See cloud-init documentation for more details: [format](https://cloudinit.readthedocs.io/en/latest/explanation/format.html), [examples](https://cloudinit.readthedocs.io/en/latest/reference/examples.html). | `object` | `{}` |packages/apps/ferretdb/values.yaml (1)
55-58: Cron schedule still uses 6 fields – Kubernetes will reject it
Thebackup.schedulevalue"0 2 * * * *"includes seconds. Kubernetes CronJobs accept exactly 5 fields (minute hour day-of-month month day-of-week).- schedule: "0 2 * * * *" + schedule: "0 2 * * *"packages/apps/kubernetes/README.md (5)
119-129: Strayvalue}artefacts still present in multiplevaluesOverridedescriptionsLines 119, 121 and 128 retain the
value}token that was flagged in earlier reviews. Please remove the token so the sentences start cleanly (e.g. “Custom values to override”).
126-126: Type / default mismatch foraddons.ingressNginx.exposeMethod
Valuecolumn shows{}(object) while theTypeisstring. Use an empty string or a concrete default such as"Proxied"to stay type-correct.
155-165:resourcesPresetrows show{}despitestringtypeDefaults for
controlPlane.*.resourcesPreset(Lines 155, 160, 165) are{}, an object. Replace with""(empty string) or a valid preset name to avoid misleading documentation.
168-169: Missing.serversegment in Konnectivity resource pathsRows list
controlPlane.konnectivity.resources.*, while the surrounding context usescontrolPlane.konnectivity.server.*. Add the.serversegment for consistency and correct automatic linking.
106-107: Pointer-versus-value notation inconsistent with control-plane resourcesWorker-node CPU / memory are documented as plain
string, whereas control-plane fields use pointer style*string. Align the notation (prefer*stringwithnulldefault) for uniform optionality semantics.packages/apps/kubernetes/values.schema.json (5)
5-43:addonsschema lost type and property validationOnly a
descriptionanddefaultremain; without"type": "object"and apropertiesmap, all keys pass unchecked—a regression that removes critical validation. Re-introduce full schema definitions for each addon.
45-68:controlPlaneschema equally incompleteSame issue as
addons: no"type"or nested"properties". Restore the full structure so invalid fields are rejected at install time.
27-30: Default foringressNginx.hostsmust be an array, not an objectSchema declares
"type": "array"yet default is{}. Change to[]to satisfy JSON-Schema validators.
74-83:gpusdefault should be[]
gpusis typed as an array, but both top-level (Line 80) and md0 default (Line 101) are{}. Replace with an empty array.
160-167:nodeGroups.*.resourceslacks quantity validation
cpuandmemoryfields accept any string. Add the Kubernetes quantity regex and"x-kubernetes-int-or-string": trueto prevent invalid inputs (see ClickHouse/NATS schemas for reference).packages/apps/mysql/values.schema.json (1)
39-43: Wrong backup bucket path – still points to PostgresThe default
s3Bucketvalue is still"s3.example.org/postgres-backups".
For a MySQL chart this is misleading and was already flagged earlier – please update to an unmistakably MySQL-specific path (e.g.mysql-backups) or leave it blank.- "s3Bucket": "s3.example.org/postgres-backups", + "s3Bucket": "s3.example.org/mysql-backups",packages/apps/rabbitmq/values.schema.json (3)
10-14:replicasstill allows scale-to-zero – add a minimum constraintThe schema permits
0replicas, which renders the chart unusable. A lower bound is still missing."replicas": { "description": "Number of RabbitMQ replicas", "type": "integer", + "minimum": 1, "default": 3 },
59-71:passwordfield is optional and length-unrestrictedUser objects can still be declared without a password or with an empty string, silently passing validation.
"additionalProperties": { "type": "object", "properties": { "password": { "description": "Password for the user", "type": "string", + "minLength": 1 } - } + }, + "required": ["password"] }
73-85: Redundant top-levelvhostdefinition
vhostduplicates the item schema of thevhostsmap and is never referenced invalues.yaml. Retaining it confuses consumers and clutters the schema.Recommendation: remove the entire
vhostproperty block.
🧹 Nitpick comments (2)
packages/apps/vm-instance/README.md (1)
56-56: Minor grammar: add subject to sentence“List of SSH public keys for authentication.” is a fragment. Consider prefixing with “A” for a complete sentence.
-| `sshKeys` | List of SSH public keys for authentication. Can be a single key or a list of keys. | `[]string` | `[]` | +| `sshKeys` | A list of SSH public keys for authentication. Can be a single key or a list of keys. | `[]string` | `[]` |packages/apps/mysql/values.schema.json (1)
97-99: Description says “MariaDB” in a MySQL chartLine 97 reads:
Number of MariaDB replicas.
If this chart is intended for vanilla MySQL, rename to avoid confusion; if it really deploys MariaDB under the hood, consider aligning the chart name instead.- "description": "Number of MariaDB replicas", + "description": "Number of MySQL replicas",
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (49)
packages/apps/clickhouse/Makefile(1 hunks)packages/apps/clickhouse/README.md(1 hunks)packages/apps/clickhouse/values.schema.json(1 hunks)packages/apps/clickhouse/values.yaml(2 hunks)packages/apps/ferretdb/Makefile(1 hunks)packages/apps/ferretdb/README.md(1 hunks)packages/apps/ferretdb/values.schema.json(1 hunks)packages/apps/ferretdb/values.yaml(2 hunks)packages/apps/http-cache/Makefile(1 hunks)packages/apps/http-cache/README.md(1 hunks)packages/apps/http-cache/values.schema.json(1 hunks)packages/apps/http-cache/values.yaml(2 hunks)packages/apps/kafka/README.md(1 hunks)packages/apps/kafka/values.schema.json(1 hunks)packages/apps/kafka/values.yaml(2 hunks)packages/apps/kubernetes/Makefile(1 hunks)packages/apps/kubernetes/README.md(1 hunks)packages/apps/kubernetes/values.schema.json(1 hunks)packages/apps/kubernetes/values.yaml(2 hunks)packages/apps/mysql/Makefile(1 hunks)packages/apps/mysql/README.md(1 hunks)packages/apps/mysql/values.schema.json(1 hunks)packages/apps/mysql/values.yaml(3 hunks)packages/apps/nats/Makefile(1 hunks)packages/apps/nats/README.md(1 hunks)packages/apps/nats/values.schema.json(1 hunks)packages/apps/nats/values.yaml(2 hunks)packages/apps/rabbitmq/Makefile(1 hunks)packages/apps/rabbitmq/README.md(1 hunks)packages/apps/rabbitmq/values.schema.json(1 hunks)packages/apps/rabbitmq/values.yaml(2 hunks)packages/apps/redis/Makefile(1 hunks)packages/apps/redis/values.yaml(1 hunks)packages/apps/tcp-balancer/Makefile(1 hunks)packages/apps/tcp-balancer/README.md(1 hunks)packages/apps/tcp-balancer/values.schema.json(2 hunks)packages/apps/tcp-balancer/values.yaml(2 hunks)packages/apps/vm-disk/Makefile(1 hunks)packages/apps/vm-disk/README.md(1 hunks)packages/apps/vm-disk/values.schema.json(1 hunks)packages/apps/vm-disk/values.yaml(2 hunks)packages/apps/vm-instance/Makefile(1 hunks)packages/apps/vm-instance/README.md(1 hunks)packages/apps/vm-instance/values.schema.json(2 hunks)packages/apps/vm-instance/values.yaml(2 hunks)packages/apps/vpn/Makefile(1 hunks)packages/apps/vpn/README.md(1 hunks)packages/apps/vpn/values.schema.json(1 hunks)packages/apps/vpn/values.yaml(1 hunks)
✅ Files skipped from review due to trivial changes (2)
- packages/apps/vm-disk/Makefile
- packages/apps/tcp-balancer/values.yaml
🚧 Files skipped from review as they are similar to previous changes (41)
- packages/apps/tcp-balancer/Makefile
- packages/apps/vpn/Makefile
- packages/apps/rabbitmq/Makefile
- packages/apps/redis/Makefile
- packages/apps/kubernetes/Makefile
- packages/apps/nats/Makefile
- packages/apps/ferretdb/Makefile
- packages/apps/kubernetes/values.yaml
- packages/apps/vpn/values.yaml
- packages/apps/http-cache/Makefile
- packages/apps/vm-disk/README.md
- packages/apps/vm-disk/values.yaml
- packages/apps/vpn/README.md
- packages/apps/kafka/values.yaml
- packages/apps/nats/README.md
- packages/apps/http-cache/README.md
- packages/apps/kafka/README.md
- packages/apps/mysql/README.md
- packages/apps/kafka/values.schema.json
- packages/apps/http-cache/values.yaml
- packages/apps/rabbitmq/values.yaml
- packages/apps/http-cache/values.schema.json
- packages/apps/clickhouse/README.md
- packages/apps/vm-disk/values.schema.json
- packages/apps/tcp-balancer/README.md
- packages/apps/mysql/values.yaml
- packages/apps/rabbitmq/README.md
- packages/apps/clickhouse/Makefile
- packages/apps/nats/values.yaml
- packages/apps/tcp-balancer/values.schema.json
- packages/apps/vm-instance/values.yaml
- packages/apps/clickhouse/values.yaml
- packages/apps/nats/values.schema.json
- packages/apps/ferretdb/README.md
- packages/apps/clickhouse/values.schema.json
- packages/apps/mysql/Makefile
- packages/apps/vm-instance/values.schema.json
- packages/apps/vpn/values.schema.json
- packages/apps/ferretdb/values.schema.json
- packages/apps/vm-instance/Makefile
- packages/apps/redis/values.yaml
🧰 Additional context used
🧠 Learnings (9)
📓 Common learnings
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/ferretdb/README.md:35-37
Timestamp: 2025-07-02T09:58:11.406Z
Learning: In the cozystack repository, the maintainer NickVolynkin prefers to keep realistic-looking example credentials in README documentation rather than using generic placeholders like <ACCESS_KEY>, even though they are just examples and not real secrets.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1196
File: packages/apps/http-cache/Makefile:24-27
Timestamp: 2025-07-14T16:23:12.803Z
Learning: In the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.json files during its operation. Therefore, when using readme-generator in Makefiles, any enum values need to be injected back into the schema using yq commands after readme-generator has run, not before.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/extra/monitoring/README.md:30-31
Timestamp: 2025-07-26T18:26:01.447Z
Learning: The cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) where it incorrectly places Grafana configuration entries under the wrong documentation sections, specifically placing grafana.resources.requests.* entries in the Metrics storage configuration table instead of the Grafana configuration table.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/clickhouse/README.md:60-67
Timestamp: 2025-07-03T05:54:51.264Z
Learning: The `cozy-lib.resources.sanitize` function in packages/library/cozy-lib/templates/_resources.tpl supports both standard Kubernetes resource format (with limits:/requests: sections) and flat format (direct resource specifications). The flat format takes priority over nested values. CozyStack apps include cozy-lib as a chart dependency through symlinks in packages/apps/*/charts/cozy-lib directories.
Learnt from: lllamnyp
PR: cozystack/cozystack#1025
File: packages/apps/kafka/charts/cozy-lib:1-1
Timestamp: 2025-06-04T06:22:17.306Z
Learning: Files in packages/apps/*/charts/cozy-lib that contain the path "../../../library/cozy-lib" are symbolic links, not regular files. Git diffs may display symlinks as regular files with their target path as content, which can be misleading in code review.
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/postgres/values.yaml:55-60
Timestamp: 2025-07-26T17:54:57.273Z
Learning: In the cozystack repository, the cozyvalues-gen tool does not support `typedef` syntax for defining custom type aliases in documentation comments.
📚 Learning: in the cozystack repository, for the virtual-machine app's resources.sockets parameter, the value is...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/virtual-machine/values.yaml:0-0
Timestamp: 2025-07-26T18:12:05.641Z
Learning: In the cozystack repository, for the virtual-machine app's resources.sockets parameter, the value is intentionally kept as a string in values.yaml despite being documented as {int} type, because the string-to-integer parsing happens elsewhere in the system pipeline rather than at the YAML validation level.
Applied to files:
packages/apps/rabbitmq/values.schema.jsonpackages/apps/kubernetes/values.schema.jsonpackages/apps/kubernetes/README.mdpackages/apps/vm-instance/README.md
📚 Learning: in the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.js...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1196
File: packages/apps/http-cache/Makefile:24-27
Timestamp: 2025-07-14T16:23:12.803Z
Learning: In the cozystack repository, the `readme-generator` tool removes enum contents from values.schema.json files during its operation. Therefore, when using readme-generator in Makefiles, any enum values need to be injected back into the schema using yq commands after readme-generator has run, not before.
Applied to files:
packages/apps/rabbitmq/values.schema.jsonpackages/apps/kubernetes/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: in cozystack's schema generator annotation format, when documenting fields of array items, use the s...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/virtual-machine/values.yaml:31-33
Timestamp: 2025-07-26T18:01:52.557Z
Learning: In cozystack's schema generator annotation format, when documenting fields of array items, use the singular form of the item type rather than array notation. For example, for a parameter `gpus {[]gpu}`, use `field gpu.name` rather than `field gpus[].name` to refer to the name field of each GPU object in the array.
Applied to files:
packages/apps/rabbitmq/values.schema.jsonpackages/apps/kubernetes/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: the cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) wh...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/extra/monitoring/README.md:30-31
Timestamp: 2025-07-26T18:26:01.447Z
Learning: The cozyvalues-gen tool has a known issue (https://github.com/cozystack/cozyvalues-gen/issues/10) where it incorrectly places Grafana configuration entries under the wrong documentation sections, specifically placing grafana.resources.requests.* entries in the Metrics storage configuration table instead of the Grafana configuration table.
Applied to files:
packages/apps/rabbitmq/values.schema.jsonpackages/apps/mysql/values.schema.jsonpackages/apps/kubernetes/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: in the cozystack repository, the cozyvalues-gen tool does not support `@typedef` syntax for defining...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1216
File: packages/apps/postgres/values.yaml:55-60
Timestamp: 2025-07-26T17:54:57.273Z
Learning: In the cozystack repository, the cozyvalues-gen tool does not support `typedef` syntax for defining custom type aliases in documentation comments.
Applied to files:
packages/apps/kubernetes/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: the `cozy-lib.resources.sanitize` function in packages/library/cozy-lib/templates/_resources.tpl sup...
Learnt from: NickVolynkin
PR: cozystack/cozystack#1120
File: packages/apps/clickhouse/README.md:60-67
Timestamp: 2025-07-03T05:54:51.264Z
Learning: The `cozy-lib.resources.sanitize` function in packages/library/cozy-lib/templates/_resources.tpl supports both standard Kubernetes resource format (with limits:/requests: sections) and flat format (direct resource specifications). The flat format takes priority over nested values. CozyStack apps include cozy-lib as a chart dependency through symlinks in packages/apps/*/charts/cozy-lib directories.
Applied to files:
packages/apps/kubernetes/values.schema.jsonpackages/apps/kubernetes/README.md
📚 Learning: in cozystack, the plural form for the kubernetes custom resource is `kuberneteses.apps.cozystack.io`...
Learnt from: lllamnyp
PR: cozystack/cozystack#1130
File: hack/e2e-apps/kubernetes.bats:101-101
Timestamp: 2025-07-11T06:11:25.438Z
Learning: In cozystack, the plural form for the Kubernetes custom resource is `kuberneteses.apps.cozystack.io`, not `kubernetes.apps.cozystack.io`. This is defined in the API schema even though it's not grammatically perfect.
Applied to files:
packages/apps/kubernetes/values.schema.json
📚 Learning: in helm templates, the `{{-` directive chomps all leading whitespace including newlines back to the ...
Learnt from: lllamnyp
PR: cozystack/cozystack#1160
File: packages/system/hetzner-robotlb/charts/robotlb/templates/role.yaml:6-8
Timestamp: 2025-07-11T06:28:13.696Z
Learning: In Helm templates, the `{{-` directive chomps all leading whitespace including newlines back to the previous content, so `{{- toYaml .Values.something | nindent 2 }}` will render correctly even with apparent indentation issues. However, for better style, it's cleaner to put the template directive on the same line as the parent key (e.g., `rules: {{- toYaml .Values.serviceAccount.permissions | nindent 2 }}`).
Applied to files:
packages/apps/kubernetes/README.md
🪛 Gitleaks (8.27.2)
packages/apps/mysql/values.schema.json
11-11: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
12-12: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
15-15: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
packages/apps/ferretdb/values.yaml
70-70: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🪛 LanguageTool
packages/apps/kubernetes/README.md
[style] ~127-~127: ‘Taken into account’ might be wordy. Consider a shorter alternative.
Context: ...er should route to this tenant cluster. Taken into account only when exposeMethod is set to `Pro...
(EN_WORDINESS_PREMIUM_TAKEN_INTO_ACCOUNT)
packages/apps/vm-instance/README.md
[style] ~56-~56: To form a complete sentence, be sure to include a subject or ‘there’.
Context: ... of SSH public keys for authentication. Can be a single key or a list of keys. ...
(MISSING_IT_THERE)
🔇 Additional comments (1)
packages/apps/ferretdb/values.yaml (1)
61-62: Example credentials kept intentionally – no action required
Static analysis flags these as generic API keys, but per maintainer preference (see learning #1) realistic-looking sample credentials are expected in docs. No security risk as they are non-production examples.
| "resticPassword": "ChaXoveekoh6eigh4siesheeda2quai0", | ||
| "s3AccessKey": "oobaiRus9pah8PhohL1ThaeTa4UVa7gu", | ||
| "s3Bucket": "s3.example.org/postgres-backups", | ||
| "s3Region": "us-east-1", | ||
| "s3SecretKey": "ju3eum4dekeich9ahM1te8waeGai0oog", | ||
| "schedule": "0 2 * * *" |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Hard-coded sample secrets can leak into production
resticPassword, s3AccessKey, and s3SecretKey all contain realistic-looking values. Even if they’re only examples, Helm users often forget to override defaults, causing weak or shared credentials in live clusters.
Consider one of the following:
- Remove the defaults entirely so that a value must be supplied.
- Replace with clearly invalid placeholders such as
"<change-me>".
- "resticPassword": "ChaXoveekoh6eigh4siesheeda2quai0",
- "s3AccessKey": "oobaiRus9pah8PhohL1ThaeTa4UVa7gu",
+ "resticPassword": "<change-me>",
+ "s3AccessKey": "<change-me>",
...
- "s3SecretKey": "ju3eum4dekeich9ahM1te8waeGai0oog"
+ "s3SecretKey": "<change-me>"Also applies to: 30-38, 49-53
🧰 Tools
🪛 Gitleaks (8.27.2)
11-11: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
12-12: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
15-15: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🤖 Prompt for AI Agents
In packages/apps/mysql/values.schema.json around lines 11 to 16, 30 to 38, and
49 to 53, the fields resticPassword, s3AccessKey, and s3SecretKey contain
hard-coded realistic-looking default secrets which risk leaking into production.
To fix this, remove these default values entirely to require users to supply
their own, or replace them with clearly invalid placeholder strings like
"<change-me>" to prevent accidental use of weak or shared credentials.
| "resourcesPreset": { | ||
| "description": "Default sizing preset used when `resources` is omitted. Allowed values: `nano`, `micro`, `small`, `medium`, `large`, `xlarge`, `2xlarge`.", | ||
| "type": "string", | ||
| "default": "nano", | ||
| "enum": [ | ||
| "nano", | ||
| "micro", | ||
| "small", | ||
| "medium", | ||
| "large", | ||
| "xlarge", | ||
| "2xlarge" | ||
| ] | ||
| }, |
There was a problem hiding this comment.
Docs ↔︎ schema mismatch for resourcesPreset.default
README was updated to show an empty-object default, yet the schema keeps "nano". Consumers relying on generated docs will get conflicting information.
Either revert the README or change the schema default:
- "default": "nano",
+ "default": {},(or vice-versa)
Committable suggestion skipped: line range outside the PR's diff.
🤖 Prompt for AI Agents
In packages/apps/rabbitmq/values.schema.json between lines 34 and 47, the
default value for `resourcesPreset` is set to "nano" in the schema, but the
README indicates an empty-object default. To fix this mismatch, update the
schema's `default` value to match the README by setting it to an empty object or
revert the README to reflect "nano" as the default. Ensure both the schema and
documentation consistently specify the same default value.
96feb1c to
50a62a1
Compare
50a62a1 to
c6bceff
Compare
github-actions
Bot
added
the
do-not-merge/work-in-progress
1 participant
What this PR does
Continues #1216
Release note
Summary by CodeRabbit
Documentation
Chores