Documentation
¶
Overview ¶
Command gate runs a Chainsaw test bundle in a polling loop against the cluster reachable from the current KUBECONFIG / in-cluster service account. It exits 0 once every component has passed continuously for the stability window, exits 1 if the max-wait ceiling is hit before that, and exits 2 on configuration errors.
The bundle is loaded from a local directory (typically a ConfigMap mounted into the pod, but any directory of *.yaml chainsaw tests works). Each file becomes a component named after the filename (sans .yaml suffix).
Assertions are evaluated in-process by pkg/chainsaw (assert / error only, enforced by that package's read-only allowlist) against the cluster reachable from the pod's ServiceAccount or the local KUBECONFIG. The gate used to shell out to a `chainsaw` binary baked into the image; #2038 removed it — it was the image's only source of HIGH CVEs, unfixable upstream.
AICR runs this CLI from a readiness-gate Job emitted by the bundler; the Job mounts the chainsaw Test as a ConfigMap and passes the polling parameters as flags. No CRD or controller is involved.
Source Files