📝 Update example with realistic annotation using the '.' character.

examples/aws-auth/input/configmaps/base.yaml

@@ -4,7 +4,7 @@ metadata:
   name: aws-auth-base
   namespace: kube-system
   annotations:
-      aggregate: aws-auth
+      aggregate.auth.annotation: aws-auth
 data:
     mapRoles: |
         - rolearn: arn:aws:iam::111122223333:role/admin-role

examples/aws-auth/input/configmaps/tenant-acme.yaml

@@ -4,7 +4,7 @@ metadata:
   name: aws-auth-tenant-acme
   namespace: kube-system
   annotations:
-      aggregate: aws-auth
+      aggregate.auth.annotation: aws-auth
 data:
     mapRoles: |
         - rolearn: arn:aws:iam::111122223333:role/tenant-acme-role

examples/aws-auth/input/configmaps/tenant-umbrella.yaml

@@ -4,7 +4,7 @@ metadata:
   name: aws-auth-tenant-umbrella
   namespace: kube-system
   annotations:
-      aggregate: aws-auth
+      aggregate.auth.annotation: aws-auth
 data:
     mapRoles: |
         - rolearn: arn:aws:iam::111122223333:role/tenant-umbrella-role

examples/aws-auth/input/templates/aws-auth.yaml

@@ -8,7 +8,7 @@ spec:
     SELECT cm.data AS cm
     FROM "ConfigMap.core" AS cm
     WHERE cm.namespace = 'kube-system' AND
-    json_extract(cm.data, '$.metadata.annotations.aggregate') = 'aws-auth'
+    json_extract(cm.data, '$.metadata.annotations."aggregate.auth.annotation"') = 'aws-auth'
   template:
     language: cue
     batchModeProcessing: true

examples/aws-auth/readme.md

@@ -54,8 +54,8 @@ input `ConfigMap` instances, so each piece of Terraform code can own its own
 resource. Kumquat is the only thing that owns `aws-auth`.
 
 The following template does just that. It also check for the presence of the
-`aggregate` annotation on the inputs, and ensures the value is `aws-auth`.
-This ensure that the template only merges `ConfigMap` instances that belong
+`aggregate.auth.annotation` annotation on the inputs, and ensures the value is `aws-auth`.
+This ensures that the template only merges `ConfigMap` instances that belong
 in `aws-auth`. The choice of aggregation name and value was arbitrary.
 
 ```yaml
@@ -69,7 +69,7 @@ spec:
     SELECT cm.data AS cm
     FROM "ConfigMap.core" AS cm
     WHERE cm.namespace = 'kube-system' AND
-    json_extract(cm.data, '$.metadata.annotations.aggregate') = 'aws-auth'
+    json_extract(cm.data, '$.metadata.annotations."aggregate.auth.annotation"') = 'aws-auth'
   template:
     language: cue
     batchModeProcessing: true

internal/controller/test_resources/delete_scenario/input/configmaps/base.yaml

@@ -4,7 +4,7 @@ metadata:
   name: aws-auth-base
   namespace: kube-system
   annotations:
-      aggregate: aws-auth
+      aggregate.auth.annotation: aws-auth
 data:
     mapRoles: |
         - rolearn: arn:aws:iam::111122223333:role/admin-role

internal/controller/test_resources/delete_scenario/input/configmaps/tenant-acme.yaml

@@ -4,7 +4,7 @@ metadata:
   name: aws-auth-tenant-acme
   namespace: kube-system
   annotations:
-      aggregate: aws-auth
+      aggregate.auth.annotation: aws-auth
 data:
     mapRoles: |
         - rolearn: arn:aws:iam::111122223333:role/tenant-acme-role

internal/controller/test_resources/delete_scenario/input/configmaps/tenant-umbrella.yaml

@@ -4,7 +4,7 @@ metadata:
   name: aws-auth-tenant-umbrella
   namespace: kube-system
   annotations:
-      aggregate: aws-auth
+      aggregate.auth.annotation: aws-auth
 data:
     mapRoles: |
         - rolearn: arn:aws:iam::111122223333:role/tenant-umbrella-role

internal/controller/test_resources/delete_scenario/input/templates/test_template.yaml

@@ -8,7 +8,7 @@ spec:
     SELECT cm.data AS cm
     FROM "ConfigMap.core" AS cm
     WHERE cm.namespace = 'kube-system' AND
-    json_extract(cm.data, '$.metadata.annotations.aggregate') = 'aws-auth'
+    json_extract(cm.data, '$.metadata.annotations."aggregate.auth.annotation"') = 'aws-auth'
   template:
     language: cue
     batchModeProcessing: false