Files
helm-charts/teamspeak-server/values.schema.json
T
jklein e54776e6c1 teamspeak-server: strict values.schema.json and null-safe hardening
No ingress gate: this chart has no Ingress at all (voice/file-transfer
are exposed via NodePort), and ingress.domain appears neither in its
templates nor in its values.

1. values.schema.json (#68): additionalProperties: false on every
   chart-owned object level. Note that this chart keeps replicas,
   resources, probes and securityContext at the TOP level rather than
   under a chart-named key, so the schema mirrors that shape.

2. Null-safety for hardening, probes and resources (#99). The rebuilt
   probes keep the "file-transfer" port name: the voice service is UDP
   and cannot be probed, so that TCP port is the only thing a probe can
   target - a default probe without it would leave the workload with no
   working probe at all.

   The container defaults keep capabilities.add as an empty list, exactly
   as values.yaml has it, so an erased block restores today's rendering
   byte for byte rather than a cleaned-up variant.

storage stays deliberately not null-safe: an erased block yields an
invalid PVC, which is the loud class #99 excludes.

Rendering with normal values is byte-identical to 4.0.0.
2026-08-23 21:23:30 +02:00

166 lines
5.6 KiB
JSON

{
"$schema": "https://json-schema.org/draft-07/schema#",
"title": "teamspeak-server values",
"description": "Strict values schema (issue #68). additionalProperties is false on every chart-owned object level, so a key that the chart does not read is rejected at render time instead of being silently ignored. The only objects that stay open are the ones passed verbatim into the Kubernetes pod spec (probes, security contexts, global) - the chart does not interpret their contents, so it cannot judge which keys are meaningful. The hardening, probe and resources blocks additionally accept null, because an erased block falls back to the chart defaults (issue #99). Note that this chart keeps replicas, resources, probes and securityContext at the TOP level rather than under a chart-named key.",
"type": "object",
"additionalProperties": false,
"properties": {
"global": {
"description": "Helm's conventional cross-chart values. Unused by this chart, kept open so an umbrella install cannot break on it.",
"type": "object"
},
"scaleDown": {
"type": "boolean"
},
"replicas": {
"type": "integer",
"minimum": 0
},
"server": {
"description": "Ports. Each value is used as container port, service port and NodePort, and is passed to the server so it listens on the exposed port - file transfer requires the in-container port to match the externally reachable one.",
"type": "object",
"additionalProperties": false,
"properties": {
"voicePort": {
"type": "integer",
"minimum": 1,
"maximum": 65535
},
"fileTransferPort": {
"type": "integer",
"minimum": 1,
"maximum": 65535
}
}
},
"resources": {
"$ref": "#/definitions/resources"
},
"env": {
"$ref": "#/definitions/env"
},
"livenessProbe": {
"$ref": "#/definitions/probe"
},
"readinessProbe": {
"$ref": "#/definitions/probe"
},
"startupProbe": {
"$ref": "#/definitions/probe"
},
"securityContext": {
"$ref": "#/definitions/securityContext"
},
"storage": {
"description": "The data PVC. Not null-safe on purpose: an erased block yields an invalid PVC rather than a silently degraded workload.",
"type": "object",
"additionalProperties": false,
"properties": {
"size": {
"type": ["string", "null"]
},
"storageClass": {
"type": ["string", "null"]
}
}
}
},
"definitions": {
"resources": {
"description": "May be null / empty: the chart then falls back to its default requests and computed limits (issue #99) instead of rendering a container without resource accounting.",
"type": ["object", "null"],
"additionalProperties": false,
"properties": {
"limitFactor": {
"type": "number",
"exclusiveMinimum": 0
},
"requests": {
"$ref": "#/definitions/resourceList"
},
"limits": {
"$ref": "#/definitions/resourceList"
}
}
},
"resourceList": {
"type": ["object", "null"],
"additionalProperties": false,
"properties": {
"cpu": {
"type": ["string", "number", "null"]
},
"memory": {
"type": ["string", "number", "null"]
},
"ephemeral-storage": {
"type": ["string", "number", "null"]
},
"ephemeralStorage": {
"type": ["string", "number", "null"]
}
}
},
"env": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"required": ["name"],
"properties": {
"name": {
"type": "string"
},
"value": {
"type": "string"
},
"valueFrom": {
"type": "object",
"additionalProperties": false,
"properties": {
"secretKeyRef": {
"$ref": "#/definitions/keyRef"
},
"configMapKeyRef": {
"$ref": "#/definitions/keyRef"
}
}
}
}
}
},
"keyRef": {
"type": "object",
"additionalProperties": false,
"required": ["name", "key"],
"properties": {
"name": {
"type": "string"
},
"key": {
"type": "string"
}
}
},
"securityContext": {
"description": "May be null / empty at any level: the chart then falls back to its hardening defaults (issue #99) instead of rendering an unhardened workload.",
"type": ["object", "null"],
"additionalProperties": false,
"properties": {
"pod": {
"description": "Merged onto the chart's pod hardening defaults and rendered as the pod's securityContext; kept open because the chart does not interpret the individual fields.",
"type": ["object", "null"]
},
"container": {
"description": "Merged onto the chart's container hardening defaults and rendered as the container's securityContext; kept open because the chart does not interpret the individual fields.",
"type": ["object", "null"]
}
}
},
"probe": {
"description": "Merged onto the chart's probe defaults and rendered as a container probe; kept open because the chart does not interpret the individual fields. May be null / empty, which means the defaults apply (issue #99) rather than the probe disappearing.",
"type": ["object", "null"]
}
}
}