buildkite / buildkite/agent-stack-k8s
values.schema.json: absolute remote $refs rejected by Helm >=3.18.5 ("invalid file url")
- Dominant language
- Go
- Stars
- 110
- Forks
- 57
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 5
Description
### Summary
With the chart's current `values.schema.json`, `helm upgrade` / `helm template` fails on Helm **3.18.5+**:
```
values don't meet the specifications of the schema(s) ... invalid file url
```
This blocks any tooling that bundles Helm >= 3.18.5 — including the Terraform `hashicorp/helm` provider >= 3.1.2.
### Root cause
`charts/agent-stack-k8s/values.schema.json` contains absolute remote references, e.g.:
```json
"$ref": "https://raw.githubusercontent.com/buildkite/kubernetes-json-schema/master/v1.35.0/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec"
```
Helm **3.18.5** disabled fetching remote `$ref`s as part of security fix **GHSA-9h84-qmv7-982p**, so any schema containing `http(s)` refs is now rejected. Helm 3.18.4 still resolved them, so this is a hard regression at the 3.18.5 boundary.
PR #814 removed `$id` to fix *relative* ref resolution, but the absolute `raw.githubusercontent.com` refs remain and are what now break.
### Reproduction
```sh
helm template oci://ghcr.io/buildkite/helm/agent-stack-k8s --version 0.37.0 -f values.yaml
```
with Helm >= 3.18.5 → `invalid file url`. (Same failure via the Terraform `hashicorp/helm` provider >= 3.1.2.)
### Suggested fix
Make the schema self-contained: inline the referenced Kubernetes type definitions into `values.schema.json`, or vendor `_definitions.json` into the chart and reference it with a relative `$ref`. This removes the network dependency and works under Helm 3.18.5+.
### Workaround
Pin to Helm <= 3.18.4 (Terraform `hashicorp/helm` provider <= 3.1.1), or strip the remote `$ref`s from the schema locally.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.