Use digest produced by container_image() in jsonnet_to_json() rule

[0xd3e]

Hi,

I'm having a hard time to get the [name].digest file produced by container_image() as input to the data attribute of the jsonnet_to_json() rule.

I found this issue

• Have container_push return more information in the rule struct #271

and this PR

• Image digest output for container_image rule #445

that suggests, that this should be possible, but the Jsonnet compiler complains that it cannot find the file.

In my WORKSPACE:

container_pull(
    name = "cert_manager_controller_base",
    # v1.10.0 amd64
    digest = "sha256:a9d029d778ce321f3b1f05877184d99009cf8e278dfc468d0bb32dc8c13ca7b6",
    registry = "quay.io",
    repository = "jetstack/cert-manager-controller",
)

container_pull(
    name = "cert_manager_webhook_base",
    # v1.10.0 amd64
    digest = "sha256:5e98f57f904800258b95d16d4a901fbe92ec0a90f33c9c317edd26babc744b21",
    registry = "quay.io",
    repository = "jetstack/cert-manager-webhook",
)

container_pull(
    name = "cert_manager_cainjector_base",
    # v1.10.0 amd64
    digest = "sha256:87efa76aac2acbac26651bd58ed408e03818294b706cdd4b2e141a1a8682a2b2",
    registry = "quay.io",
    repository = "jetstack/cert-manager-cainjector",
)

My BUILD file

CONTAINERS = [
    "controller",
    "webhook",
    "cainjector",
]

[container_image(
    name = "{}_image".format(name),
    base = "@cert_manager_{}_base//image".format(name),
) for name in CONTAINERS]

[container_push(
    name = "{}_image.push".format(name),
    image = ":{}_image".format(name),
    format = "OCI",
    registry = "registry.gitlab.com",
    repository = "raeumlich/yog-sothoth/cert-manager-{}".format(name),
) for name in CONTAINERS]

jsonnet_to_json(
    name = "prod_pre_manifest",
    src = "prod.jsonnet",
    outs = [
        "prod_pre_manifest.yaml",
    ],
    data = [
        "@cert_manager_manifest//file",
        ":controller_image.digest",
        ":webhook_image.digest",
        ":cainjector_image.digest",
    ],
    deps = [
        "//pkg/jsonnet/k8s",
        "//pkg/jsonnet/k8std",
    ],
    yaml_stream = True,
)

The goal is to have the digest in the resulting Kubernetes manifest file.
The data element @cert_manager_manifest//file works fine.

Here is the error message I get:

RUNTIME ERROR: couldn't open import "cainjector_image.push.digest": no match locally or in the Jsonnet library paths
	platform/cert_manager/prod.jsonnet:32:22-62	object <anonymous>
	<std>:1395:6-10	thunk from <function <anonymous>>
	Array element 0	
	During manifestation

Is there any way to make it work?

[0xd3e]

I've managed to make it work using the [name].digest files produced by container_push().
One mistake I've made was to not use the path from the repo root. It didn't work with the digest files produced by container_image().

For anyone who stumbles over this... this is what my files look like now.

BUILD

CONTAINERS = [
    "controller",
    "webhook",
    "cainjector",
]

[container_image(
    name = "{}_image".format(name),
    base = "@cert_manager_{}_base//image".format(name),
) for name in CONTAINERS]

[container_push(
    name = "{}_image.push".format(name),
    image = ":{}_image".format(name),
    format = "OCI",
    registry = "registry.gitlab.com",
    repository = "raeumlich/yog-sothoth/cert-manager-{}".format(name),
) for name in CONTAINERS]

jsonnet_to_json(
    name = "prod_manifest",
    src = "prod.jsonnet",
    outs = [
        "prod_manifest.yaml",
    ],
    data = [
        "@cert_manager_manifest//file",
        ":controller_image.push.digest",
        ":webhook_image.push.digest",
        ":cainjector_image.push.digest",
    ],
    deps = [
        "//pkg/jsonnet/k8s",
        "//pkg/jsonnet/k8std",
    ],
    yaml_stream = True,
)

Jsonnet

local controller_digest = importstr 'platform/cert_manager/controller_image.push.digest';
local webhook_digest = importstr 'platform/cert_manager/webhook_image.push.digest';
local cainjector_digest = importstr 'platform/cert_manager/cainjector_image.push.digest';

...