GCP Terraform Kubernetes App validation failure

This looks like an image manifest issue rather than a Terraform problem. I’d try pulling and inspecting the image first with docker manifest inspect or crane manifest. If the manifest is malformed or uses an unsupported format, rebuild and push the image again as a standard OCI or Docker v2 image, then rerun the validation. Also verify that the tag points to the expected image in Artifact Registry.

This appears to fail during Marketplace image processing, before the Terraform plan itself runs.

The useful indicators are:

Failed to process container images from schema file
Docker-PutManifest
MANIFEST_INVALID

The validator appears to be copying or normalizing:

gcr.io/crestdata-public/test-app/test-app:1.0

into the Google-managed validation registry, and Artifact Registry is rejecting the manifest being submitted.

I would inspect the exact tag and digest first:

IMAGE='gcr.io/crestdata-public/test-app/test-app:1.0'

docker buildx imagetools inspect "$IMAGE"
docker buildx imagetools inspect --raw "$IMAGE" | jq .

Check:

schemaVersion
mediaType
config.mediaType
manifests[].mediaType
manifests[].platform
config and layer digests

Artifact Registry supports Docker V2 Schema 2 and OCI manifests/indexes, so the issue is more likely a malformed descriptor, invalid child manifest, legacy manifest format, or nonstandard image generated by the original build/push process rather than Terraform syntax.

As a diagnostic, rebuild and publish a clean single-platform linux/amd64 image using a current Docker/BuildKit version:

DEST='us-docker.pkg.dev/PROJECT/REPOSITORY/test-app:1.0'

docker buildx build \
  --platform linux/amd64 \
  --provenance=false \
  --sbom=false \
  --tag "$DEST" \
  --push \
  .

Then update every reference in the Helm chart, Terraform module and schema metadata to the new Artifact Registry image and rerun validation.

Also verify that the Helm chart and all application images are in the same Artifact Registry project/repository required for Terraform Kubernetes Marketplace apps, and that the images contain the required Cloud Marketplace service-name annotation.

If the rebuilt single-platform image validates, compare the raw old and new manifests to identify the incompatible descriptor.

R.Q whathehack81

Hi ​@whathehack81 ,
Thanks for response,
The error we are getting is for helm chart image already pushed to artifact registry only. Not for the standard deployed docker files.

Manifest for helm chart we have created:

{

"schemaVersion": 2,

"config": {

"mediaType": "application/vnd.cncf.helm.config.v1+json",

"digest": "sha256:0f978258e6c2d2f3d94940c5dbc052cc31f7f8dda6dced86c8fc2192a72ee997",

"size": 514

},

"layers": [

{

"mediaType": "application/vnd.cncf.helm.chart.content.v1.tar+gzip",

"digest": "sha256:5306cc67548c461b4e3c02bbfeb61a86b238a243325503fe0b9b1acf8471ee0b",

"size": 3534

}

],

"annotations": {

"org.opencontainers.image.authors": "Platform Team ( [removed by moderator] )",

"org.opencontainers.image.created": "2026-07-07T10:46:03Z",

"org.opencontainers.image.description": "GCP",

"org.opencontainers.image.source": "https://github.com/your-org/test-app",

"org.opencontainers.image.title": "test-app",

"org.opencontainers.image.url": "https://cloud.google.com/security-command-center",

"org.opencontainers.image.version": "1.0.0"

}

}

Hi Harshal,

Thank you for clarifying. The manifest you provided is a valid OCI Helm chart manifest. The following media types are expected for Helm charts:

application/vnd.cncf.helm.config.v1+json

application/vnd.cncf.helm.chart.content.v1.tar+gzip

Therefore, rebuilding it as a standard linux/amd64 Docker image would not be appropriate.

The important part of the validation error is:

Failed to process container images from schema file

Docker-PutManifest

MANIFEST_INVALID

This indicates that the Marketplace validation workflow is attempting to process the Helm chart through its container-image copy path.

For Terraform Kubernetes applications, the Helm chart should be configured separately in Producer Portal under Specify Helm chart, while only actual workload container images should be referenced as container images.

Please check whether the Helm chart URI is also present in an image-related field in the Terraform schema or deployment metadata. Could you share:

1. The image-related entries from schema.yaml

2. The Helm chart URL configured in Producer Portal

3. The container image paths configured for the release

If the chart is configured only in the dedicated Helm chart field and is not referenced as a container image, this appears to be a Marketplace validation-side incompatibility with the Helm OCI media types rather than a malformed chart.

R.Q

whathehack81

​@whathehack81  Thanks for quick response,

Please find below information you have asked:

schema.yaml

images:

  scc-ticket-creator:

    variables:

      ticket_creator_image_repo:

        type: REPO_WITH_REGISTRY_WITH_NAME

      ticket_creator_image_tag:

        type: TAG

  scc-ticket-sync:

    variables:

      ticket_sync_image_repo:

        type: REPO_WITH_REGISTRY_WITH_NAME

      ticket_sync_image_tag:

        type: TAG
 

Helm chart URL
us-docker.pkg.dev/test-public/test-app/test-app

Container images:
us-docker.pkg.dev/test-public/test-app/test-app:1.0 - helm image
us-docker.pkg.dev/test-public/test-app/scc-ticket-creator:1.0 - GKE deplyoment image
us-docker.pkg.dev/test-public/test-app/scc-ticket-sync:1.0 - GKE cronjob image

Hi Harshal,
Thank you. This information isolates the likely issue.
Your schema.yaml correctly declares only the two runtime container images:
images:
  scc-ticket-creator:
  scc-ticket-sync:
However, the following artifact is also included in the container-image list:
us-docker.pkg.dev/test-public/test-app/test-app:1.0
That artifact is the OCI Helm chart. Its Helm-specific manifest media types are valid, but it must not be processed as a runnable Docker container image.
The Producer Portal configuration should therefore be:
Helm chart:
us-docker.pkg.dev/test-public/test-app/test-app
with release/display tag:
1.0
The container-image configuration should contain only:
us-docker.pkg.dev/test-public/test-app/scc-ticket-creator:1.0
us-docker.pkg.dev/test-public/test-app/scc-ticket-sync:1.0
Please verify that test-app:1.0 has not also been entered or mapped as a container image anywhere in the deployment configuration.
If the Helm chart is present only in Specify Helm chart and the validation service still attempts Docker-PutManifest against it, then the submitted configuration appears correct and the error should be escalated to the Marketplace Partner Engineering team as a validator-side misclassification of the OCI Helm artifact.
R.Q
whathehack81

My helm chart is only present in Specify helm chart URL. Still, it validates as standard container image and throwing manifest invalid error.

I think issue is from marketplace side.