replacements documentation

[natasha41575]

No description provided.

[natasha41575]

/cc @monopole
/cc @KnVerey

[natasha41575]

/hold

[max-sixty]

As someone who saw the release notes and would be interested to use this — would it be possible to explain the delimiter more?

If we have something like:

  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: sa-foo
    annotations:
      iam.gke.io/gcp-service-account: sa@$PROJECT.iam.gserviceaccount.com

is it possible to replace that $PROJECT? Would it be written as !PROJECT!, and the delimiter be !, and the index 1?

[natasha41575]

@max-sixty No unfortunately; the replacement transformer would not be able to replace vars in this case. Mentioning @justinsb because he had a similar question.

if you have something like
path: my/path/VALUE

Then the replacement transformer would have something like:

options:
  delimiter: '/'
  index: 2

and it would replace VALUE, e.g. path: my/path/NEW_VALUE - it leaves the delimiters in place.

I'll add some examples to clarify. Unfortunately, we don't have a way to replace arbitrary substrings in the middle of a string yet.

@monopole Any thoughts?

[natasha41575]

@max-sixty We are considering an approach like kubernetes-sigs/kustomize#3914 for cases such as yours. If you would like to take a look and provide feedback there, that would be appreciated.

[monopole]

@max-sixty Suggest for now using replacement, but replace the whole field, i.e. the entire string
sa@$PROJECT.iam.gserviceaccount.com

a "normalization" problem arises if $PROJECT appears in other strings, because then one has to have multiple weird strings which violates don't repeat yourself.

I think the right way to go this is with generators, so we're working on that now.

[monopole]

/retest

[max-sixty]

@max-sixty Suggest for now using replacement, but replace the whole field, i.e. the entire string
sa@$PROJECT.iam.gserviceaccount.com

I think the right way to go this is with generators, so we're working on that now.

Great, thanks! And overall this is in a tolerable place for now — even before replacements.

The sa@$PROJECT.iam.gserviceaccount.com works for that service account, though not when $PROJECT is in other strings; e.g. GoogleCloudPlatform/k8s-config-connector#271

a "normalization" problem arises if $PROJECT appears in other strings, because then one has to have multiple weird strings which violates don't repeat yourself.

FWIW I didn't understand this — isn't the current solution violating DRY, because we need to have a patch / replacement for each string containing $PROJECT?

[monopole]

@max-sixty So ideally one would have a means of replacing just one thing

PROJECT => whatever

instead of two things (where one repeats part of the replacement)

serviceAccount:PROJECT.svc.id.goog[default/workflow-service-account] => serviceAccount:whatever.svc.id.goog[default/workflow-service-account]
sa@PROJECT.iam.gserviceaccount.com => sa@whatever.iam.gserviceaccount.com

We think this can be solved with a generator parameterized by PROJECT (and maybe some per cloud stuff)

[max-sixty]

Yes exactly @monopole !

That may be easier said than done — e.g. if something replaces PROJECT for whatever in a lower kustomization, does a higher kustomization see PROJECT or whatever. Potentially this was both a feature and a problem with vars.

Thanks!

[natasha41575]

/hold cancel

[monopole]

/lgtm

thanks!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: monopole, natasha41575

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [monopole,natasha41575]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment