Skip to content

cub function vet

cub function vet

Run validating functions on units

Synopsis

Run one or more validating functions on units.

Only functions whose signature has Validating=true are accepted; others are rejected before invocation. Use 'cub function list' to see which functions are validating.

A missing vet- prefix is supplied, so 'cub function vet placeholders' invokes vet-placeholders.

For invoking non-mutating inspection functions (e.g. get-container-image), use 'cub function get'. For mutating functions (e.g. set-container-image), use 'cub function set'. 'cub function do' is the mixed escape hatch.

The same validating functions are what a Trigger runs to attach an ApplyGate; running one here is the ad hoc audit of the same check. See 'cub trigger create'.

cub function vet <function> [<arg1> ...] [flags]

Options

      --change-desc string          change description
      --changeset string            changeset to associate units with
      --clearance stringArray       class of guarded reason this change is cleared for, as KEY, KEY=VALUE[,VALUE...], KEY!=VALUE[,VALUE...], or !KEY to refuse any path carrying KEY (repeatable). A guarded path this does not cover is not written, and the withheld change is reported as a conflict
      --dry-run                     dry run mode: execute functions but skip updating configuration data
      --filter string               Filter entity to apply to the list. Specify as 'space/filter' for cross-space filters or just 'filter' for current space. Supports both slugs and UUIDs. The filter will be combined with any --where clause using AND logic. Examples: "production-filters/security-check", "my-filter-uuid", "validation-rules"
      --guard stringArray           reason to record on the paths this change writes, as KEY=VALUE (repeatable). A later operation must be cleared for it before overwriting those paths. Adds and overwrites only; retiring a guard is cub unit set-guard --remove-guard
  -h, --help                        help for vet
      --invocation strings          execute invocations by UUID, slug, or space/slug (can be repeated or comma-separated)
      --other-data-source string    additional data source to pass to functions (e.g., LastReleasedRevisionNum)
  -o, --output string               Output format. One of: json, yaml, name, wide, mutations, jq=<expr>, yq=<expr>, custom-columns=<spec>
  -O, --output-file string          Write payload to FILE. Accepts {space}, {unit}, {section} placeholders.
      --protect                     record the paths this change writes as protected local overrides, so a later merge from upstream does not overwrite them; by default a change claims nothing and each path keeps the protection it already has
      --quiet                       No default output.
      --resource-type string        resource-type filter
      --revision string             target a specific revision (format: unit-slug/revision-number, e.g. mydeployment/3)
      --show string                 Select which part of the function response to display. One of: output, values, data
      --timeout string              completion timeout as a duration with units, such as 10s or 2m (default "10m0s")
      --toolchain string            Toolchain type for the function invocations (default "Kubernetes/YAML")
      --trigger strings             execute triggers by UUID, slug, or space/slug (can be repeated or comma-separated)
      --unit strings                target specific units by slug or UUID (can be repeated or comma-separated)
      --update-validation-results   update ValidationErrors and ValidationWarnings on units based on trigger results (requires --trigger)
      --verbose                     Detailed output, additive with default output
      --wait                        wait for completion (default true)
      --where string                Filter expression using SQL-inspired syntax. Supports conjunctions with AND. String operators: =, !=, <, >, <=, >=, LIKE, NOT LIKE, ILIKE, ~~, !~~, ~, ~*, !~, !~*. Pattern matching with LIKE/ILIKE uses % and _ wildcards. Regex operators (~, ~*, !~, !~*) support POSIX regular expressions. A related entity is referenced by prefix, as in "UpstreamUnit.Slug = 'base'"; when the reference names a list, a * segment matches any element, as in "FromLink.*.Slug = 'upgrade-app'". Examples: "Slug LIKE 'app-%'", "DisplayName ILIKE '%backend%'", "Slug ~ '^[a-z]+-[0-9]+$'"
      --where-data string           where data filter
      --where-resource string       filter which resources the function operates on
      --worker string               worker to execute the function

Options inherited from parent commands

      --context string          The context to use for this command
      --debug                   Debug output
      --executor-space string   Space ID or slug whose executor to use for builtin functions (org-level only)
      --space string            space to operate in, by slug or UUID. Omitted, a list or bulk operation spans the organization and a single entity is named as <space>/<slug>

SEE ALSO