Adopt KRM for `apko` file format

TL;DR

Given that JSON is valid yaml, there's nothing stopping the use of kyaml transformers prior to apko\config's config\contents or even between apko\config and apko\build. [maintainer mattmoor]: (this got a little rambly, but hopefully it makes sense) I don't see them as mutually exclusive TBH.

When to use

You are seeing this: [maintainer mattmoor]: (this got a little rambly, but hopefully it makes sense) I don't see them as mutually exclusive TBH. Use this skill when you run into "Adopt KRM for apko file format".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

[maintainer mattmoor]: (this got a little rambly, but hopefully it makes sense) I don't see them as mutually exclusive TBH. Given that JSON is valid yaml, there's nothing stopping the use of kyaml transformers prior to apko_config's config_contents or even between apko_config and apko_build. I would say the most interesting manipulation of the config (apko_config) is the production of a "locked" file form which is a task that has a level of semantic depth beyond what something like kustomize or kpt could do, since it requires a fairly deep semantic understanding. apko show-packages can be used to get a similar package list directly from apko FWIW. That said, in my mind the main feature of terraform isn't the templating, it is enabling an orchestrated composition of tools, e.g. describing how we take an apko SBOM and attest it with cosign, or tag the resulting digest based on package versions, ...

Context: Issue chainguard-dev/apko#725 (closed, 10 comments): Once you have your image configs and build scripts setup, the majority of the work involved in operating a secure software factory is config management. Kubernetes ecosystem has great config management tooling and libraries, which comes as no surprise given that the Kubernetes Resource Model (KRM) was designed with that intent. Virtually all manipulation that needs to ta

Source: Issue chainguard-dev/apko#725 (closed, 10 comments): Once you have your image configs and build scripts setup, the majority of the work involved in operating a secure software factory is config management. Kubernetes ecosystem has great config management tooling and libraries, which comes as no surprise given that the Kubernetes Resource Model (KRM) was designed with that intent. Virtually all manipulation that needs to ta

Verified resolution: [maintainer mattmoor]: (this got a little rambly, but hopefully it makes sense) I don't see them as mutually exclusive TBH. Given that JSON is valid yaml, there's nothing stopping the use of kyaml transformers prior to apko_config's config_contents or even between apko_config and apko_build. I would say the most interesting manipulation of the config (apko_config) is the production of a "locked" file form which is a task that has a level of semantic depth beyond what something like kustomize or kpt could do, since it requires a fairly deep semantic understanding. apko show-packages can be used to get a similar package list directly from apko FWIW. That said, in my mind the main feature of terraform isn't the templating, it is enabling an orchestrated composition of tools, e.g. describing how we take an apko SBOM and attest it with cosign, or tag the resulting digest based on package versions, ...

Source URL: https://github.com/chainguard-dev/apko/issues/725