pub enum Guard {
Show 22 variants
Truthy {
path: String,
},
Not {
path: String,
},
Eq {
path: String,
value: GuardValue,
},
NotEq {
path: String,
value: GuardValue,
},
Absent {
path: String,
},
MatchesPattern {
path: String,
pattern: String,
templated: bool,
},
RangeKeyPrefix {
path: String,
prefix: String,
},
RangeKeyEquals {
path: String,
key: String,
},
RangeKeyMatches {
path: String,
pattern: String,
},
Or {
paths: Vec<String>,
},
AnyOf {
alternatives: Vec<Vec<Guard>>,
},
Range {
path: String,
},
With {
path: String,
},
Default {
path: String,
},
TypeIs {
path: String,
schema_type: String,
},
NotTypeIs {
path: String,
schema_type: String,
},
IntGt {
path: String,
bound: i64,
},
IntLt {
path: String,
bound: i64,
},
AtMostOneMember {
path: String,
},
MinMembers {
path: String,
bound: i64,
},
HasKey {
path: String,
key: String,
},
ContainsEquals {
path: String,
value: GuardValue,
},
}Expand description
A guard condition from an if, with, or range block.
Variants§
Truthy
Simple truthy check: if .Values.X
Not
Negated truthy check: if not .Values.X
Eq
Equality check: if eq .Values.X "value" / if eq .Values.X false.
Fields
value: GuardValueLiteral required at the path.
NotEq
Inequality check: if ne .Values.X "value" / if ne .Values.X false.
Fields
value: GuardValueLiteral excluded at the path.
Absent
Path absence check, used for structural rules where missing values are semantically distinct from false values.
MatchesPattern
The path’s string value matches a literal regular expression:
if regexMatch "…" .Values.X. regexMatch type-asserts a string
subject, so the guard holding implies string-ness as well. When
templated is set the subject reached the match through tpl, so
the pattern constrains the rendered OUTPUT: a raw value carrying a
template action is admitted regardless (its render may match).
Fields
RangeKeyPrefix
A destructured range key starts with a literal prefix. The path names the ranged collection; the predicate applies to its matching entries, not to the collection value itself.
Fields
RangeKeyEquals
A destructured range key equals a literal (if eq $key "name"). The
path names the ranged collection; the predicate selects exactly the
entry with that key. Document-level lowering may only use the
POSITIVE form (the key exists in the collection); the negation runs
for every OTHER member and has no key-presence encoding.
Fields
RangeKeyMatches
A destructured range key matches a literal regular expression
(if regexMatch "[A-Z]" $name). The path names the ranged
collection; the predicate applies per key, so lowering targets the
collection’s key domain (traefik’s uppercase ingressRoute gate).
Fields
Or
Disjunction: if or .Values.A .Values.B
AnyOf
Disjunction whose arms may each contain a conjunction of typed guards.
This preserves structural forms such as
or (and .Values.A .Values.B) (eq .Values.mode "prod") without
degrading them into truthiness checks for every mentioned path.
Range
Body of range .Values.X / range .foo block. The referenced path is
being iterated as a collection, not interpreted as a boolean-valued
scalar. This should not contribute a boolean type hint downstream.
With
Body of with .Values.X block. This distinguishes header binding from
if-style truthy checks. The bound path is null-tolerant by
construction because with nil skips the body.
Default
Rendered via a default ... <path> fallback, either in prefix form
(default "x" .Values.X) or pipeline form (.Values.X | default "x").
This is stronger than a plain truthy guard: the template explicitly
substitutes a fallback when the path is empty/nil, so null is an
accepted chart input for that render site even when values.yaml ships
a non-null default.
TypeIs
A typeIs "<json type>" <path> check in template logic.
This is not a truthiness guard. It is a structural type declaration:
helpers such as Bitnami’s common.tplvalues.render explicitly branch on
typeIs "string" .value, so callers may supply that values path as a
string even when another branch renders it as a YAML object fragment.
Fields
NotTypeIs
The complement of Guard::TypeIs: the else arm of a type
dispatch (if typeIs "string" x … else …).
Rows need this as a first-class variant because dropping the
complement collapses a type-switch partition: member reads and
structural placements under the else would otherwise apply to
EVERY type of the dispatched path.
Fields
IntGt
The path’s RAW value is a JSON integer strictly greater than bound.
This deliberately claims less than the Sprig coercion it stands in
for: gt (int64 .Values.x) N also holds for numeric strings and
true, so this guard is a SOUND SUBSET usable only where firing
less often is safe (a fail-arm condition), never as an exact branch
condition whose negation must also hold.
Fields
IntLt
The path’s RAW value is a JSON integer strictly less than bound.
The mirror of Guard::IntGt, with the same sound-subset contract:
lt (int .Values.x) N also holds for coercible non-integers, so
this guard may only strengthen positive-polarity consumers.
Fields
AtMostOneMember
The collection at path has at most one entry.
A sound SUBSET stand-in for loop-carried conditions that provably
hold on a range’s FIRST iteration (an empty-initialized dedup
accumulator cannot shadow anything yet): with at most one member,
every iteration is the first. Like Guard::IntGt, it may only
strengthen positive-polarity consumers.
MinMembers
The value at path is a mapping with at least bound members —
the exact meaning of gt (keys X | len) N (keys aborts on
non-maps, so the render reaches the body only for maps).
Fields
HasKey
The mapping at path contains key as a literal member — Sprig
hasKey/dig observability, where a present nil member IS present
(cilium’s removed-option guards abort on the truthy "<nil>"
rendering of an explicit null). Contrast Guard::Absent, which
counts explicit null as absent for the nil-safe selector lanes.
Fields
ContainsEquals
SOME item of the list at path deep-equals the scalar literal —
Sprig has LITERAL .Values.list, the dual of the literal-list
membership (has .Values.x (list …)). has returns false on a
nil haystack and aborts rendering on non-lists, so the guard holds
exactly for arrays carrying the literal (oauth2-proxy gates its
secret keys on has "cookie-secret" .Values.config.requiredSecretKeys).
Fields
value: GuardValueLiteral that at least one list item must equal.