Skip to content

Conversation

@miiyakumo
Copy link

Adds JSON Schema validation for .sops.yaml configuration files, enabling IDE auto-completion, real-time validation, and programmatic config checking.


What's Changed

  • JSON Schema Definition (schema/sops.json): A comprehensive schema defining all available configuration options, types, and constraints.

  • Schema Test Suite (config/config_schema_test.go): Includes 8 test functions and 13 test cases (7 valid configurations and 6 invalid configurations) to ensure schema correctness.

  • Documentation Update: A usage guide has been added to README.rst.

  • Build Target: Introduced a new make test-schema target for conveniently running schema validation tests.


Implementation Notes

I opted for a hand-written JSON Schema (schema/sops.json) to avoid introducing new external dependencies at this time.

While generating the schema from Go structs is technically feasible, it would require extensive custom logic and more complex struct tags to properly address the following challenges in the current configuration structure:

  1. Complex Type Handling: Fields with flexible types, such as Age interface{} (which accepts a string or an array of strings), necessitate custom oneOf logic in the schema.

  2. Validation Constraints: Business-specific rules, such as range constraints (shamir_threshold >= 1) and defined enum values, are not automatically derived from standard Go struct tags.

  3. Mutually Exclusive Fields: Custom validation is required for options that are incompatible with each other (mutually exclusive fields).


Related: #1767

…iguration

Signed-off-by: miiyakumo <miiyakumo@qq.com>
…ration

Signed-off-by: miiyakumo <miiyakumo@qq.com>
@felixfontein
Copy link
Contributor

@miiyakumo thanks for your contribution!

As indicated in #1767 (comment) I think it's better to have a single source of truth. Right now (with this PR) we have three: the Go structures, the documentation (https://github.com/getsops/sops?tab=readme-ov-file#5config-file-format, that's not even complete yet), and the schema (added in this PR).

Maybe we should have a different source of truth, and use that one to generate all three (Go structures, documentation, and JSON schema)? WDYT @getsops/maintainers?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants