buildkite / buildkite/agent-stack-k8s

values.schema.json: absolute remote $refs rejected by Helm >=3.18.5 ("invalid file url")

Open
#895 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
110
Forks
57
Avg merge
3d 8h
Merged PRs (30d)
5

Description

### Summary

With the chart's current `values.schema.json`, `helm upgrade` / `helm template` fails on Helm **3.18.5+**:

```
values don't meet the specifications of the schema(s) ... invalid file url
```

This blocks any tooling that bundles Helm >= 3.18.5 — including the Terraform `hashicorp/helm` provider >= 3.1.2.

### Root cause

`charts/agent-stack-k8s/values.schema.json` contains absolute remote references, e.g.:

```json
"$ref": "https://raw.githubusercontent.com/buildkite/kubernetes-json-schema/master/v1.35.0/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec"
```

Helm **3.18.5** disabled fetching remote `$ref`s as part of security fix **GHSA-9h84-qmv7-982p**, so any schema containing `http(s)` refs is now rejected. Helm 3.18.4 still resolved them, so this is a hard regression at the 3.18.5 boundary.

PR #814 removed `$id` to fix *relative* ref resolution, but the absolute `raw.githubusercontent.com` refs remain and are what now break.

### Reproduction

```sh
helm template oci://ghcr.io/buildkite/helm/agent-stack-k8s --version 0.37.0 -f values.yaml
```

with Helm >= 3.18.5 → `invalid file url`. (Same failure via the Terraform `hashicorp/helm` provider >= 3.1.2.)

### Suggested fix

Make the schema self-contained: inline the referenced Kubernetes type definitions into `values.schema.json`, or vendor `_definitions.json` into the chart and reference it with a relative `$ref`. This removes the network dependency and works under Helm 3.18.5+.

### Workaround

Pin to Helm <= 3.18.4 (Terraform `hashicorp/helm` provider <= 3.1.1), or strip the remote `$ref`s from the schema locally.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.