Documentation
¶
Overview ¶
Package pinimages implements the manifest.pin_images builtin function: pin service artifact images into their Kubernetes workload manifests by editing a structured document model, never by splicing strings into manifest text.
For each service it finds the workload document whose metadata.name matches the service name, then for each of the service's artifacts sets the image on the container whose current image has the same repository (registry + path, with tag/digest stripped) as the artifact's source image. The pinned value is the artifact's source image joined to its version. Values from the version set are set as literal scalar nodes, so a crafted image string can never alter the manifest's structure. Only workload documents that matched are rewritten; sibling documents in the same file are preserved byte-for-byte.
The shared YAML machinery — document splitting/matching, node navigation, safe mutation, and re-serialization — lives in the manifest package; this package layers pin_images' inputs, validation, and container-match policy on top. The public API — Spec() and Run() — is what step-runner's builtin wrapper consumes.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( // ErrWorkloadNotFound is returned when no workload document has a // metadata.name matching a requested service. Fails loudly so a typo'd // service (or one pointed at a manifest set that doesn't contain it) can't // silently no-op. ErrWorkloadNotFound = errors.New("workload not found") // ErrWorkloadAmbiguous is returned when more than one workload document // matches a service name (within one file or across the file set). Pinning // must target exactly one workload, so an ambiguous match is an error. ErrWorkloadAmbiguous = errors.New("workload matched more than one document") // ErrContainerNotFound is returned when the matched workload has no // container whose current image repository matches an artifact — including // the case where the workload has no spec.template.spec.containers at all // (e.g. a Rollout that defers to a workloadRef). Creating a missing container // is a separate concern; this Function only pins containers that already // exist. ErrContainerNotFound = errors.New("container not found") // ErrContainerAmbiguous is returned when more than one container in the // matched workload shares the artifact's image repository. Pinning must // target exactly one container, so an ambiguous match is an error rather than // a guess. ErrContainerAmbiguous = errors.New("image matched more than one container") )
Functions ¶
func New ¶
func New() runner.BuiltinFunction
New builds the manifest.pin_images builtin. Unlike the gitlab_project.* functions it needs no token, and unlike argo.sync it needs no cluster round-tripper: it is a pure transform over the manifest text it's handed.
Types ¶
This section is empty.
Source Files