rules are not hermetic at all

[ensonic]

The 'run' commands for create/apply/delete shell out to kubectl and gcloud. This should maybe be mentioned at least in a README. Ideally the rules will pull the commands through the WORKSPACE for hermeticity, right?

For background when running them through dazel, one will need to installed them to the dazel docker container.

[mattmoor]

See: #21

We don't include it because they are essentially useless without authentication configured and Bazel's current guidance on credentials is fundamentally non-hermetic.

rules_docker is more self-contained, but still needs to access credentials and binaries (e.g. credential helpers) outside the workspace to work.

[ensonic]

Okay, if I send a PR that at least documents what it commands it requires?

[mattmoor]

Absolutely :)