cub unit set-protection

Protect paths of a unit from being overwritten by a merge

Synopsis

Set the Protected flags stored on a unit's MutationSources.

A protected path is a local override a merge must not overwrite. An unprotected path holds a value that came from somewhere else -- a clone, an upgrade, a merge -- and is the merge's to update. Merges consult these stored values when no WhereMutation filter is supplied, which is the default: the stored protection is then the only mechanism preserving local overrides. Turning the merge's subtraction step on (via --merge-enable-subtraction or a link's MergeEnableSubtraction) preserves them by a second mechanism, and the stored values are not consulted.

Each --protect and --unprotect takes RESOURCE_TYPE:RESOURCE_NAME:PATH, where RESOURCE_TYPE and RESOURCE_NAME identify the resource (e.g. apps/v1/Deployment and default/myapp) and PATH is a resolved path within that resource. Repeat either flag to set several paths or resources at once, and combine them to protect some paths and re-open others in one revision. A path that is not already present inherits the closest ancestor mutation's provenance. Setting protection creates a new revision only if it changes.

Examples:

  # Protect the downstream replica count from being overwritten by upgrades
  cub unit set-protection my-unit \
    --protect "apps/v1/Deployment:default/myapp:spec.replicas"

  # Re-open a path so a future merge may overwrite it again
  cub unit set-protection my-unit \
    --unprotect "apps/v1/Deployment:default/myapp:spec.replicas"

cub unit set-protection <unit-slug> --protect <spec> [--unprotect <spec> ...] [flags]

Options

  -h, --help                    help for set-protection
  -o, --output string           Output format. One of: json, yaml, name, wide, mutations, jq=<expr>, yq=<expr>, custom-columns=<spec>
      --protect stringArray     path to protect from merges, as RESOURCE_TYPE:RESOURCE_NAME:PATH (repeatable)
      --quiet                   No default output.
      --unprotect stringArray   path to re-open to merges, as RESOURCE_TYPE:RESOURCE_NAME:PATH (repeatable)
      --verbose                 Detailed output, additive with default output

Options inherited from parent commands

      --context string   The context to use for this command
      --debug            Debug output
      --space string     space ID to perform command on

cub unit set-protection