Awesome Reviewers

Security-related Helm/config schemas should fail fast on invalid or unintended authentication settings.

Apply:

• Close security-sensitive objects with additionalProperties: false so typos/mistyped fields are rejected at helm template/validation time (instead of silently producing insecure runtime behavior).
• When auth is enabled, model credentials as required structured fields (e.g., require credentials.name and credentials.key when auth is on).
• Reuse shared, closed definitions for repeated security sub-structures (e.g., relabeling blocks) so misspellings like sourceLables don’t slip through.
• Ensure provider-scoped security flags are only accepted for intended providers: don’t let permissive parent schema parts (e.g., base_key) implicitly allow unrelated security flags.

Example pattern (ServiceMonitor-style strict auth):

{
  "authorization": {
    "type": "object",
    "description": "Bearer-token auth for scrape",
    "additionalProperties": false,
    "properties": {
      "type": {"type": "string"},
      "credentials": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "name": {"type": "string"},
          "key": {"type": "string"}
        },
        "required": ["name", "key"]
      }
    },
    "required": ["type", "credentials"]
  }
}

Outcome: invalid auth configs (typos, missing required credential fields, or flags applied to the wrong provider) are rejected early, preventing insecure or broken authentication behavior at runtime.

This site is open source. Improve this page.