cub invocation invoke set

Execute a mutating stored Invocation

Synopsis

Execute a single stored Invocation whose underlying function is mutating (Mutating=true), supplying values for its declared parameters.

'cub invocation invoke set' accepts only mutating Invocations, so an agent's permissions can be scoped to this operation class via the command.

Supply each declared parameter with a repeated --param flag:

COMPONENT_ID=$(cub component get checkout -o jq=.Component.ComponentID) cub invocation invoke set rbac-add-verb \ --space '*' --where "Space.ComponentID = '$COMPONENT_ID'" \ --param verb=create --param role=app-reader --param namespace=prod

The supplied values are validated against the Invocation's declared Parameters (every required parameter must be present; unknown names are rejected) and become the scope for expanding the Invocation's templated argument values.

cub invocation invoke set <invocation> [--param name=value ...] [flags]

Options

      --change-desc string            change description
      --changeset string              changeset to associate units with
      --clearance stringArray         class of guarded reason this change is cleared for, as KEY, KEY=VALUE[;VALUE...], KEY!=VALUE[;VALUE...], or !KEY to refuse any path carrying KEY (repeatable). A guarded path this does not cover is not written, and the withheld change is reported as a conflict
      --dry-run                       dry run mode: execute functions but skip updating configuration data
      --filter string                 Filter entity to apply to the list. Specify as 'space/filter' for cross-space filters or just 'filter' for current space. Supports both slugs and UUIDs. The filter will be combined with any --where clause using AND logic. Examples: "production-filters/security-check", "my-filter-uuid", "validation-rules"
      --guard stringArray             reason to record on the paths this change writes, as KEY=VALUE (repeatable). A later operation must be cleared for it before overwriting those paths, this one included, so --clearance has to cover it. Adds and overwrites only; retiring a guard is cub unit set-guard --remove-guard
  -h, --help                          help for set
      --include-hidden string[="*"]   Also select hidden entities, to list or to act on: those hidden for the given HiddenReasons, comma-separated, as in --include-hidden=BackingUnit, or for any reason when given no value or "*". ConfigHub/YAML Units, which hold the configuration of other entities, are hidden with the reason BackingUnit. A --where naming entities by Slug or ID selects them whether hidden or not
      --invocation strings            execute invocations by UUID, slug, or space/slug (can be repeated or comma-separated)
      --other-data-source string      additional data source to pass to functions (e.g., LastReleasedRevisionNum); defaults to the sources each function expects
  -o, --output string                 Output format. One of: json, yaml, name, wide, mutations, jq=<expr>, yq=<expr>, custom-columns=<spec>
  -O, --output-file string            Write payload to FILE. Accepts {space}, {unit}, {section} placeholders.
      --param stringArray             value for a declared parameter, as name=value (can be repeated)
      --protect                       record the paths this change writes as protected local overrides, so a later merge from upstream does not overwrite them; by default a change claims nothing and each path keeps the protection it already has
      --quiet                         No default output.
      --resource string               the one resource to operate on, as <kind>/<name> or <kind>/<namespace>/<name>, such as Deployment/backend. The kind is matched in any case and takes kubectl's .group suffix (Ingress.networking.k8s.io) when the kind alone is ambiguous. It has to match exactly one resource among the units --space, --variant and --where select, so a name held in several namespaces needs its namespace
      --resource-type string          resource-type filter
      --revision string               target a specific revision (format: unit-slug/revision-number, e.g. mydeployment/3)
      --show string                   Select which part of the function response to display. One of: output, values, data
      --timeout string                completion timeout as a duration with units, such as 10s or 2m (default "10m0s")
      --toolchain string              Toolchain type for the function invocations (default "Kubernetes/YAML")
      --trigger strings               execute triggers by UUID, slug, or space/slug (can be repeated or comma-separated)
      --unit strings                  target specific units by slug or UUID (can be repeated or comma-separated)
      --update-validation-results     update ValidationErrors and ValidationWarnings on units based on trigger results (requires --trigger)
      --verbose                       Detailed output, additive with default output
      --wait                          wait for completion (default true)
      --where string                  Filter expression using SQL-inspired syntax. Supports conjunctions with AND. String operators: =, !=, <, >, <=, >=, LIKE, NOT LIKE, ILIKE, ~~, !~~, ~, ~*, !~, !~*. Pattern matching with LIKE/ILIKE uses % and _ wildcards. Regex operators (~, ~*, !~, !~*) support POSIX regular expressions. A related entity is referenced by prefix, as in "UpstreamUnit.Slug = 'base'"; when the reference names a list, a * segment matches any element, as in "FromLink.*.Slug = 'upgrade-app'". Examples: "Slug LIKE 'app-%'", "DisplayName ILIKE '%backend%'", "Slug ~ '^[a-z]+-[0-9]+$'"
      --where-data string             where data filter
      --where-resource string         filter which resources the function operates on
      --worker string                 worker to execute the function

Options inherited from parent commands

      --component string   the Component of --variant, when that names the variant alone; --variant <component>/<variant> says the same in one flag
      --context string     The context to use for this command
      --debug              Debug output
      --space string       space to operate in, by slug or UUID. Omitted, a list or bulk operation spans the organization and a single entity is named as <space>/<slug>
      --variant string     variant to operate in, as <component>/<variant>, or as <variant> with --component: the space naming that Component whose Variant label is <variant>. The same scope as --space, named by what it is rather than by the space's slug; the two cannot be combined

cub invocation invoke set