From within an AnalysisTemplate, what's the right way to get the freight name?

[lknite]

Currently, I'm needing the freight name so that I can:

• call the kubeapi to look up the freight, so that I can get the 'repoUrl' & 'version'

I was hoping there'd just be environment variables or a 'kargo func' which would let me get the value.

This seemed like it should work but doesn't seem to:

spec:
  args:
  - name: freight
    value: "{{ ctx.targetFreight.name }}"

I could perhaps look up the most recent freight or the most recent promotion, but neither guarantees I've identified the right freight/promotion associated with the analysistemplate i'm running in.

[krancour]

Exactly what sort of goodies are available in expressions are dependent on the context in which the the expression is evaluated. In the context of a Promotion, "target Freight" is a concept that makes sense. It's the one piece of Freight that the Promotion is actively working to move into the Stage.

By contrast "target Freight" does not contextually make sense in a verification process because verification is not part of the promotion process. Verification is point-in-time assessment of whatever Freight is currently in a Stage. It can run completely independently of any promotion. All this is to say, ctx.targetFreight is undefined in the context you're attempting to use it in.

But what should work in your context are the chartFrom(), commitFrom(), and imageFrom() functions because the are all based only on the current state of the Stage.

Let me know how that goes.

[lknite]

like this? (this isn't working)

apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: promote-dev
  namespace: kargo-addons-external-dns-promote-chart
spec:
  args:
  - name: repoUrl
    value: "{{ chartFrom('oci://registry-1.docker.io/bitnamicharts/external-dns').RepoUrl }}"
  - name: chartName
    value: "{{ chartFrom('oci://registry-1.docker.io/bitnamicharts/external-dns').Name }}"
  - name: chartVersion
    value: "{{ chartFrom('oci://registry-1.docker.io/bitnamicharts/external-dns').Version }}"

and within a container add:

                  env:
                  - name: TEST_REPOURL
                    value: "{{ args.repoUrl }}"
                  - name: TEST_CHARTNAME
                    value: "{{ args.chartName }}"
                  - name: TEST_CHARTVERSION
                    value: "{{ args.chartVersion }}"

url copied from warehouse:

apiVersion: kargo.akuity.io/v1alpha1
kind: Warehouse
metadata:
  name: warehouse
  namespace: kargo-addons-external-dns-promote-chart
spec:
  subscriptions:
  - chart:
      repoURL: oci://registry-1.docker.io/bitnamicharts/external-dns

[krancour]

No. That's not right. You can't use Kargo expressions inside a Rollouts resource kind. You need to parameterize the AnalysisRun, playing by Rollouts rules, and then the verification config in your Stage can use Kargo expressions to provide values for those parameters. I'm sure there's an example of that in the docs. I will try to find when I'm not out of pocket.

[krancour]

@lknite this is what you are looking for: https://docs.kargo.io/user-guide/how-to-guides/verification#arguments-and-metadata

[lknite]

tried this

apiVersion: kargo.akuity.io/v1alpha1
kind: Stage
metadata:
  name: dev
spec:
  requestedFreight:
  - origin:
      kind: Warehouse
      name: warehouse
    sources:
      direct: true

  verification:
    analysisTemplates:
      - name: promote-dev
    args:
      - name: test-a
        value: "${{ ctx.targetFreight.name }}"
      - name: test-b
        value: "${{ freightMetadata(ctx.targetFreight.name)['name'] }}"

and this

apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: promote-dev
  namespace: kargo-addons-external-dns-promote-containers
spec:
  args:
  - name: test-a
    value: "default"
  - name: test-b
    value: "default"
    
                    ...
                    # freight name via arg
                    echo "a: {{ args.test-a }}"
                    echo "b: {{ args.test-b }}"

resulted in:

2026-01-12T18:28:16Z    ERROR   controller/controller.go:421    Reconciler error        {"controller": "stage", "controllerGroup": "kargo.akuity.io", "controllerKind": "Stage", "Stage": {"name":"dev","namespace":"kargo-addons-external-dns-promote-containers"}, "namespace": "kargo-addons-external-dns-promote-containers", "name": "dev", "reconcileID": "729053b2-d7ab-4c84-b7dd-11637d30d38b", "error": "Stage health evaluated to Unknown"}
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem
        sigs.k8s.io/controller-runtime@v0.22.4/pkg/internal/controller/controller.go:421
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func1.1
        sigs.k8s.io/controller-runtime@v0.22.4/pkg/internal/controller/controller.go:296

[lknite]

for communication purposes, here's what i am using at the moment, i'm sure there's a better way to get the freight name

apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: promote-dev
  namespace: kargo-addons-argocd-promote-charts
spec:
  metrics:
  - name: promote-dev
    provider:
      job:
        spec:
          ttlSecondsAfterFinished: 3600
          template:
            spec:
              imagePullSecrets:
                - name: <redacted>
              initContainers:
                - name: init
                  image: prod/docker.io/alpine/curl:8.14.1
                  command: ["/bin/sh", "-c"]
                  args:
                  - |
                    # Point to the internal API server hostname
                    APISERVER=https://kubernetes.default.svc
              
                    # Path to ServiceAccount token
                    SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount
              
                    # Read this Pod's namespace
                    NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace)
              
                    # Read the ServiceAccount bearer token
                    TOKEN=$(cat ${SERVICEACCOUNT}/token)
              
                    # Reference the internal certificate authority (CA)
                    CACERT=${SERVICEACCOUNT}/ca.crt

                    # Install jq for processing freight resource files
                    apk update \
                        && apk add --no-cache jq

                    # Get listing of freight and parse of the most recent one
                    #FREIGHTS=$(curl -s --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/apis/kargo.akuity.io/v1alpha1/namespaces/${NAMESPACE}/freights)
                    #FREIGHT=$(echo ${FREIGHTS} | jq -r '.items | sort_by(.metadata.creationTimestamp) | last')

                    # Get listing of promotions and parse off the most recent one
                    PROMOTIONS=$(curl -s --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/apis/kargo.akuity.io/v1alpha1/namespaces/${NAMESPACE}/promotions)
                    PROMOTION=$(echo ${PROMOTIONS} | jq -r '.items | sort_by(.metadata.creationTimestamp) | last')

                    # Get freight name via the promotion, and look up freight
                    FREIGHT_NAME=$(echo ${PROMOTION} | jq -r '.spec.freight')
                    FREIGHT=$(curl -s --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" -X GET ${APISERVER}/apis/kargo.akuity.io/v1alpha1/namespaces/${NAMESPACE}/freights/${FREIGHT_NAME})

                    # Parse off charts
                    echo ${FREIGHT} | jq '.charts' > /tmp/tmp.json
                    cat /tmp/tmp.json

                    # Create env vars for each freight
                    jq -r '.[] | [.repoURL, .version, .name] | @tsv' /tmp/tmp.json | \
                    while IFS=$'\t' read -r repoURL version name; do
                      # if oci, parse of name
                      if [ "$name" = "" ]; then
                        # parse the name off the repoURL
                        name=$(echo ${repoURL} | sed 's,.*/,,')
                      fi

                      # Create env vars for each freight
                      mkdir -p /shared-data/freight/${name}
                      echo "NAME=${name}" >> /shared-data/freight/${name}/env
                      echo "REPOURL=${repoURL}" >> /shared-data/freight/${name}/env
                      echo "TAG=${version}" >> /shared-data/freight/${name}/env

                      echo /shared-data/freight/${name}/env
                      cat /shared-data/freight/${name}/env
                    done

                  volumeMounts:
                  - name: shared-data
                    mountPath: /shared-data
                - name: helm
                  image: prod/docker.io/alpine/helm:4.0.1
                  command: ["/bin/sh", "-c"]
                  args:
                  - |
                    # pull chart for each freight
                    for dir in /shared-data/freight/*; do
                      echo "next freight: $dir"

                      # change to freight-specifc folder where the chart env vars are
                      cat $dir/env
                      . $dir/env

                      # change to freight-specifc folder where the chart will be pulled
                      cd $dir

                      if echo "${REPOURL}" | grep -q "oci"; then
                        ####
                        # oci
                        echo "pull from oci repo"
  
                        echo helm pull ${REPOURL} --version ${TAG}
                        helm pull ${REPOURL} --version ${TAG}
  
                        # get pulled package filename
                        PACKAGE="$(ls *.tgz)"
                        echo "package: ${PACKAGE}"
  
                        # Export env vars to a shared file
                        echo "PACKAGE=${PACKAGE}" >> env
                      else
                        ####
                        # https
                        echo "pull from https repo"
  
                        echo "helm repo add tmp ${REPOURL}"
                        helm repo add tmp ${REPOURL}
  
                        echo "helm repo update"
                        helm repo update
  
                        echo "helm search repo tmp"
                        helm search repo tmp
  
                        echo "helm pull tmp/${NAME} --version ${TAG}"
                        helm pull tmp/${NAME} --version ${TAG}
  
                        # get pulled package filename
                        PACKAGE="$(ls *.tgz)"
                        echo "package: ${PACKAGE}"
  
                        # Export env vars to a shared file
                        echo "PACKAGE=${PACKAGE}" >> env
                      fi
                    done
                  volumeMounts:
                  - name: shared-data
                    mountPath: /shared-data
              containers:
                - name: jfrog
                  image: prod/releases-docker.jfrog.io/jfrog/jfrog-cli-full-v2-jf
                  command: ["/bin/sh", "-c"]
                  args:
                  - |
                    # pull chart for each freight
                    for dir in /shared-data/freight/*; do
                      echo "next freight: $dir"

                      # change to freight-specifc folder where the chart env vars are
                      cat $dir/env
                      . $dir/env

                      # change to freight-specifc folder where the chart will be pulled
                      cd $dir

                      # remove repo scheme from pull url
                      if echo "${REPOURL}" | grep -q "oci"; then
                        SOURCE=oci
                        echo "pull from oci repo"
                        REPOURL="${REPOURL#oci://}"
                      else
                        SOURCE=https
                        echo "pull from https repo"
                        REPOURL="${REPOURL#https://}"
                      fi

                      # autheticate
                      echo "username: ${USERNAME}"

                      # is there a difference with pushing an https-based package or oci-based package?
                      if [ "${SOURCE}" = "oci" ]; then
                        ####
                        # oci

                        # removed for simplicity
                      else
                        ####
                        # https

                        echo 'jf c add auth --basic-auth-only --url "https://<redacted>.net" --user "${USERNAME}" --password "${PASSWORD}"'
                        jf c add auth --basic-auth-only --url "https://<redacted>.net" --user "${USERNAME}" --password "${PASSWORD}"

                        # chop off '/shared/' from the PACKAGE env
                        echo "package: ${PACKAGE}"
                        echo "name: ${NAME}"

                        # push to dev
                        echo push to dev
                        echo "jf rt u ${PACKAGE} dev/${REPOURL}/${PACKAGE}"
                        jf rt u "${PACKAGE}" "dev/${REPOURL}/${PACKAGE}"

                        # copy to staging
                        echo copy to staging
                        echo "jf rt cp dev${REPOURL}/${PACKAGE} staging"
                        jf rt cp "dev/${REPOURL}/${PACKAGE}" "staging"

                        # copy to production
                        echo copy to production
                        echo "jf rt cp staging/${REPOURL}/${PACKAGE} prod"
                        jf rt cp "staging${REPOURL}/${PACKAGE}" "prod"
                      fi
                    done
                  env:
                  - name: USERNAME
                    valueFrom:
                      secretKeyRef:
                        name: promote
                        key: username
                  - name: PASSWORD
                    valueFrom:
                      secretKeyRef:
                        name: promote
                        key: password
                  volumeMounts:
                  - name: shared-data
                    mountPath: /shared-data
              volumes:
              - name: shared-data
                emptyDir: {}
              restartPolicy: Never
          backoffLimit: 0