如何在3种不同环境中使用CRDs-catalog本地开发、CI/CD和Air-Gapped环境终极指南【免费下载链接】CRDs-catalogPopular Kubernetes CRDs (CustomResourceDefinition) in JSON schema format.项目地址: https://gitcode.com/gh_mirrors/cr/CRDs-catalogCRDs-catalog是一个强大的Kubernetes自定义资源定义CRDJSON模式集合它提供了数百种流行CRD的验证模式。通过在不同环境中正确使用CRDs-catalog您可以实现Kubernetes资源的离线验证、提升开发效率并确保CI/CD管道的可靠性。这个完整的CRD验证解决方案让您能够在没有集群访问权限的情况下进行资源验证实现真正的左移安全策略。 什么是CRDs-catalog及其核心价值CRDs-catalog项目汇集了数百个热门Kubernetes CRD的JSON模式文件这些模式可以直接被Datree、Kubeconform和Kubeval等工具使用。核心价值在于它允许开发者在本地开发、CI/CD流水线甚至隔离环境中验证自定义资源而无需访问实际的Kubernetes集群。主要功能包括离线验证在没有Kubernetes集群连接的情况下验证YAML文件开发工具集成与VS Code的Red Hat YAML插件无缝集成多环境支持适应本地开发、CI/CD和隔离网络环境自动模式提取提供CRD提取工具从现有集群生成模式️ 本地开发环境配置快速安装和基础使用在本地开发环境中使用CRDs-catalog非常简单。首先克隆仓库git clone https://gitcode.com/gh_mirrors/cr/CRDs-catalog.git cd CRDs-catalogVS Code智能感知配置配置VS Code的Red Hat YAML插件以获得完整的智能感知支持。在您的YAML文件中添加schema注释# yaml-language-server: $schemahttps://datreeio.github.io/CRDs-catalog/cilium.io/ciliumnetworkpolicy_v2.json apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: example-policy spec: endpointSelector: matchLabels: app: myapp使用自动化注释工具项目提供了Utilities/annotate-yaml.py脚本可以自动为您的YAML文件添加schema注释python3 Utilities/annotate-yaml.py your-manifest.yaml这个工具会自动检测YAML中的CRD资源类型并添加正确的schema URL大大简化了配置过程。本地验证工作流程安装验证工具# 安装datree brew install datree # 或者安装kubeconform brew install kubeconform使用本地模式进行验证# 使用datree datree test deployment.yaml # 使用kubeconform kubeconform -schema-location default \ -schema-location file:///path/to/CRDs-catalog/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json \ deployment.yaml CI/CD管道集成GitHub Actions自动化验证在CI/CD管道中集成CRDs-catalog可以确保所有部署的Kubernetes资源都符合预期模式。以下是GitHub Actions的完整配置示例name: Validate Kubernetes Manifests on: pull_request: paths: - k8s/** - manifests/** jobs: validate: runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkoutv3 - name: Checkout CRDs-catalog uses: actions/checkoutv3 with: repository: datreeio/CRDs-catalog path: crd-schemas - name: Install kubeconform run: | wget https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz tar xzf kubeconform-linux-amd64.tar.gz sudo mv kubeconform /usr/local/bin/ - name: Validate manifests run: | for file in $(find ./manifests -name *.yaml -o -name *.yml); do echo Validating $file kubeconform -schema-location default \ -schema-location file://./crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json \ $file doneGitLab CI配置对于GitLab用户可以这样配置CI/CD验证validate-k8s: image: alpine:latest stage: validate before_script: - apk add --no-cache curl tar - curl -L https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz -o kubeconform.tar.gz - tar xzf kubeconform.tar.gz - mv kubeconform /usr/local/bin/ script: - git clone --depth 1 https://gitcode.com/gh_mirrors/cr/CRDs-catalog.git crd-schemas - find ./k8s -name *.yaml -o -name *.yml | while read file; do kubeconform -schema-location default \ -schema-location file://./crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json \ $file doneJenkins Pipeline集成在Jenkins中您可以使用以下Pipeline脚本pipeline { agent any stages { stage(Validate Kubernetes Manifests) { steps { script { sh git clone --depth 1 https://gitcode.com/gh_mirrors/cr/CRDs-catalog.git crd-schemas wget https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz tar xzf kubeconform-linux-amd64.tar.gz for file in $(find ./manifests -name *.yaml -o -name *.yml); do echo Validating $file ./kubeconform -schema-location default \ -schema-location file://./crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json \ $file done } } } } } Air-Gapped隔离环境部署离线环境准备工作在隔离网络环境中您需要预先准备所有依赖。以下是完整的离线部署方案准备离线包# 1. 下载CRDs-catalog仓库 git clone --depth 1 https://gitcode.com/gh_mirrors/cr/CRDs-catalog.git # 2. 下载验证工具 wget https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz # 3. 创建离线包 tar czf offline-crd-validation.tar.gz \ CRDs-catalog/ \ kubeconform-linux-amd64.tar.gz \ README-offline.md从生产集群提取CRD模式使用Utilities/crd-extractor.sh工具从您的生产集群提取CRD模式# 在有网络连接的机器上运行 cd CRDs-catalog/Utilities KUBECTL_CONTEXTproduction-cluster ./crd-extractor.sh这个脚本会连接到指定的Kubernetes集群提取所有CRD定义转换为JSON模式格式按API组组织文件结构离线环境部署流程传输文件到隔离环境# 使用安全传输方式 scp offline-crd-validation.tar.gz airgapped-server:/tmp/在隔离环境中安装# 在隔离服务器上 cd /opt tar xzf /tmp/offline-crd-validation.tar.gz tar xzf kubeconform-linux-amd64.tar.gz mv kubeconform /usr/local/bin/ # 设置环境变量 export CRD_SCHEMA_DIR/opt/CRDs-catalog配置验证脚本 创建/usr/local/bin/validate-k8s.sh#!/bin/bash SCHEMA_DIR/opt/CRDs-catalog for file in $; do echo Validating $file kubeconform -schema-location default \ -schema-location file://$SCHEMA_DIR/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json \ $file done定期更新策略建立定期更新机制确保模式与生产集群保持同步# 更新脚本示例 #!/bin/bash # update-crd-schemas.sh # 1. 在有网络的环境中提取最新CRD cd /tmp git clone --depth 1 https://gitcode.com/gh_mirrors/cr/CRDs-catalog.git new-schemas cd new-schemas/Utilities KUBECTL_CONTEXTproduction-cluster ./crd-extractor.sh # 2. 创建更新包 cd .. tar czf crd-update-$(date %Y%m%d).tar.gz . # 3. 安全传输到隔离环境 # 根据您的安全策略实现传输️ 高级配置和最佳实践性能优化技巧缓存模式文件# 使用本地缓存避免重复下载 export KUBECONFORM_CACHE_DIR$HOME/.kubeconform-cache mkdir -p $KUBECONFORM_CACHE_DIR并行验证# 使用xargs并行处理多个文件 find ./manifests -name *.yaml -o -name *.yml | \ xargs -P 4 -I {} kubeconform -schema-location default \ -schema-location file://./crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json {}自定义模式管理对于私有CRD使用CRD提取工具创建自定义模式# 从特定集群上下文提取 cd CRDs-catalog/Utilities KUBECTL_CONTEXTmy-cluster ./crd-extractor.sh # 指定输出目录 OUTPUT_DIR/custom/schemas KUBECTL_CONTEXTmy-cluster ./crd-extractor.sh集成到开发工作流Git预提交钩子 在.git/hooks/pre-commit中添加#!/bin/bash for file in $(git diff --cached --name-only --diff-filterACM | grep -E \.(yaml|yml)$); do kubeconform -schema-location default \ -schema-location file://./crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json \ $file || exit 1 doneIDE配置 配置VS Code的settings.json{ yaml.schemas: { file:///path/to/CRDs-catalog/*.json: [*.yaml, *.yml] }, yaml.format.enable: true, yaml.validate: true } 故障排除和常见问题常见错误及解决方案模式未找到错误# 错误找不到对应的JSON模式 # 解决方案使用CRD提取工具生成缺失的模式 cd CRDs-catalog/Utilities ./crd-extractor.sh网络连接问题# 在隔离环境中使用本地文件路径 kubeconform -schema-location default \ -schema-location file:///absolute/path/to/CRDs-catalog/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json \ manifest.yaml版本兼容性问题# 确保使用的CRD版本与集群版本匹配 # 检查API版本 kubectl api-versions | grep your-crd-group调试技巧启用详细输出以诊断问题# 启用调试模式 kubeconform -verbose -schema-location default \ -schema-location file://./crd-schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json \ manifest.yaml # 检查模式文件是否存在 find ./crd-schemas -name *your-crd*.json 环境配置对比表环境类型配置复杂度网络要求更新频率适用场景本地开发⭐⭐可选按需个人开发、测试CI/CD管道⭐⭐⭐必需自动团队协作、自动化部署Air-Gapped⭐⭐⭐⭐无手动安全敏感环境、合规要求 总结CRDs-catalog为Kubernetes资源验证提供了完整的解决方案无论您是在本地开发、CI/CD流水线还是隔离环境中工作。通过合理配置您可以提升开发效率通过VS Code智能感知快速编写正确的YAML确保代码质量在CI/CD中自动验证所有Kubernetes清单满足安全合规在隔离环境中实现完整的验证流程减少部署错误提前发现资源定义问题记住无论选择哪种环境配置核心原则都是将验证左移在资源部署到集群之前发现问题。CRDs-catalog让这一过程变得简单而高效。开始使用CRDs-catalog让您的Kubernetes部署更加可靠和安全【免费下载链接】CRDs-catalogPopular Kubernetes CRDs (CustomResourceDefinition) in JSON schema format.项目地址: https://gitcode.com/gh_mirrors/cr/CRDs-catalog创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考