|
| 1 | +# `x_k8s_get` |
| 2 | + |
| 3 | +```yaml |
| 4 | + - description: >- |
| 5 | + 1. Look up some details about a Deployment object with 'x_k8s_get(...)', and store them in a binding. |
| 6 | + 2. Make use of the binding in a `script` block through environment variables. |
| 7 | + 3. Refer to the same bound Deployment object in an `assert` block. |
| 8 | + bindings: |
| 9 | + - name: xpNS |
| 10 | + value: crossplane-system |
| 11 | + - name: xpDeploy |
| 12 | + # Arguments to 'x_k8s_get(any, string, string, string, string)': |
| 13 | + # |
| 14 | + # 1. any: Supply the '$client' built-in binding here, which is needed to connect to the cluster: |
| 15 | + # https://kyverno.github.io/chainsaw/latest/reference/builtins/ |
| 16 | + # |
| 17 | + # 2. string: 'apiVersion' field on the object. |
| 18 | + # |
| 19 | + # 3. string: 'Kind' field on the object. |
| 20 | + # |
| 21 | + # 4. string: The namespace of the object. If the object type is not namespaced, this field can be an empty |
| 22 | + # string, or any string; it doesn't seem to matter. |
| 23 | + # |
| 24 | + # 5. string: The name of the object. |
| 25 | + value: (x_k8s_get($client, 'apps/v1', 'Deployment', $xpNS, 'crossplane')) |
| 26 | + try: |
| 27 | + - script: |
| 28 | + bindings: |
| 29 | + - # Re-bind the version label from the Deployment to give us a more succinct name to refer to. |
| 30 | + name: deployVersion |
| 31 | + # If the label key has any periods in it, double-quote the whole key. |
| 32 | + value: ($xpDeploy.metadata.labels."app.kubernetes.io/version") |
| 33 | + env: |
| 34 | + - # Refer to the Deployment version label the long way. |
| 35 | + name: DEP_VER_LONG |
| 36 | + value: ($xpDeploy.metadata.labels."app.kubernetes.io/version") |
| 37 | + - # Refer to the Deployment version label the short way, through the additional binding scoped to this |
| 38 | + # 'script' block. |
| 39 | + name: DEP_VER_SHORT |
| 40 | + value: ($deployVersion) |
| 41 | + # The version values printed by the script here will be the same, even though they were derived through |
| 42 | + # slightly different routes. |
| 43 | + content: |- |
| 44 | + echo "DEP_VER_LONG: '$DEP_VER_LONG'" |
| 45 | + echo "DEP_VER_SHORT: '$DEP_VER_SHORT'" |
| 46 | + - assert: |
| 47 | + bindings: |
| 48 | + - name: depVer |
| 49 | + value: ($xpDeploy.metadata.labels."app.kubernetes.io/version") |
| 50 | + resource: |
| 51 | + apiVersion: v1 |
| 52 | + kind: Pod |
| 53 | + metadata: |
| 54 | + # Match the pod(s) with namespace and label selectors. |
| 55 | + namespace: ($xpNS) |
| 56 | + labels: |
| 57 | + app: crossplane |
| 58 | + # Make a binding that holds this Pod's version from its label. |
| 59 | + (metadata.labels."app.kubernetes.io/version")->podVer: |
| 60 | + # Assert that the version labels for the Deployment and this Pod equal each other, using the |
| 61 | + # 'semver_compare()' function described here: |
| 62 | + # https://kyverno.io/docs/writing-policies/jmespath/#semver_compare |
| 63 | + (semver_compare($depVer, $podVer)): true |
| 64 | +``` |
0 commit comments