Migrate to DH-managed config files

Use the Deckhand engine module directly to manage local configuration
files during CLI usage.

Note: not doing document validation as DH currently requires schemas to
be sourced from the database. Simple schema validation in place.

- Layering/substitution
- Schema validation based on DataSchema documents in payload
- Add deckhand to requirements

A few tooling updates

- concatenate test & schema yaml files into a single file to avoid name
  conflicts
- make nginx directory in build-scripts stage

Change-Id: I2d56244f01c58052f14331bc09fd5843d4c95292

examples/basic/Docker.yaml

@@ -6,6 +6,7 @@ metadata:
   layeringDefinition:
     abstract: false
     layer: site
+  storagePolicy: cleartext
 data:
   config:
     insecure-registries:

examples/basic/Kubelet.yaml

@@ -6,6 +6,7 @@ metadata:
   layeringDefinition:
     abstract: false
     layer: site
+  storagePolicy: cleartext
 data:
   arguments:
     - --cni-bin-dir=/opt/cni/bin

examples/basic/KubernetesNetwork.yaml

@@ -6,6 +6,7 @@ metadata:
   layeringDefinition:
     abstract: false
     layer: site
+  storagePolicy: cleartext
 data:
   dns:
     cluster_domain: cluster.local

examples/basic/armada-resources.yaml

@@ -124,23 +124,23 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.ca'
+        path: '.values.secrets.tls.ca'
     -
       src:
         schema: deckhand/Certificate/v1
         name: proxy
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.cert'
+        path: '.values.secrets.tls.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: proxy
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.key'
+        path: '.values.secrets.tls.key'
 data:
   chart_name: proxy
   release: kubernetes-proxy
@@ -180,147 +180,147 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: calico-etcd
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.client.ca'
+        path: '.values.secrets.tls.client.ca'
     -
       src:
         schema: deckhand/CertificateAuthority/v1
         name: calico-etcd-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.peer.ca'
+        path: '.values.secrets.tls.peer.ca'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-anchor
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.anchor.tls.cert'
+        path: '.values.secrets.anchor.tls.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-anchor
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.anchor.tls.key'
+        path: '.values.secrets.anchor.tls.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n0
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.client.cert'
+        path: '.values.nodes[0].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n0
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.client.key'
+        path: '.values.nodes[0].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n0-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.peer.cert'
+        path: '.values.nodes[0].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n0-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.peer.key'
+        path: '.values.nodes[0].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n1
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.client.cert'
+        path: '.values.nodes[1].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n1
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.client.key'
+        path: '.values.nodes[1].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n1-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.peer.cert'
+        path: '.values.nodes[1].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n1-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.peer.key'
+        path: '.values.nodes[1].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n2
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.client.cert'
+        path: '.values.nodes[2].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n2
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.client.key'
+        path: '.values.nodes[2].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n2-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.peer.cert'
+        path: '.values.nodes[2].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n2-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.peer.key'
+        path: '.values.nodes[2].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n3
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.client.cert'
+        path: '.values.nodes[3].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n3
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.client.key'
+        path: '.values.nodes[3].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n3-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.peer.cert'
+        path: '.values.nodes[3].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n3-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.peer.key'
+        path: '.values.nodes[3].tls.peer.key'
 
 data:
   chart_name: etcd
@@ -424,23 +424,23 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: calico-etcd
-        path: $
+        path: .
       dest:
-        path: '$.values.etcd.tls.ca'
+        path: '.values.etcd.tls.ca'
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-node
-        path: $
+        path: .
       dest:
-        path: '$.values.etcd.tls.cert'
+        path: '.values.etcd.tls.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-node
-        path: $
+        path: .
       dest:
-        path: '$.values.etcd.tls.key'
+        path: '.values.etcd.tls.key'
 data:
   chart_name: calico
   release: calico
@@ -487,23 +487,23 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes
-        path: $
+        path: .
       dest:
-        path: '$.values.tls.ca'
+        path: '.values.tls.ca'
     -
       src:
         schema: deckhand/Certificate/v1
         name: coredns
-        path: $
+        path: .
       dest:
-        path: '$.values.tls.cert'
+        path: '.values.tls.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: coredns
-        path: $
+        path: .
       dest:
-        path: '$.values.tls.key'
+        path: '.values.tls.key'
 data:
   chart_name: coredns
   release: coredns
@@ -567,52 +567,52 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.ca
+        path: .values.secrets.tls.ca
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: apiserver
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.cert
+        path: .values.secrets.tls.cert
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: apiserver
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.key
+        path: .values.secrets.tls.key
     -
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes-etcd
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.etcd.tls.ca
+        path: .values.secrets.etcd.tls.ca
     -
       src:
         schema: deckhand/Certificate/v1
         name: apiserver-etcd
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.etcd.tls.cert
+        path: .values.secrets.etcd.tls.cert
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: apiserver-etcd
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.etcd.tls.key
+        path: .values.secrets.etcd.tls.key
     -
       src:
         schema: deckhand/PublicKey/v1
         name: service-account
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.service_account.public_key
+        path: .values.secrets.service_account.public_key
 
 data:
   chart_name: apiserver
@@ -668,31 +668,31 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.ca
+        path: .values.secrets.tls.ca
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: controller-manager
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.cert
+        path: .values.secrets.tls.cert
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: controller-manager
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.key
+        path: .values.secrets.tls.key
     -
       src:
         schema: deckhand/PrivateKey/v1
         name: service-account
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.service_account.private_key
+        path: .values.secrets.service_account.private_key
 
 data:
   chart_name: controller_manager
@@ -740,23 +740,23 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.ca
+        path: .values.secrets.tls.ca
     -
       src:
         schema: deckhand/Certificate/v1
         name: scheduler
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.cert
+        path: .values.secrets.tls.cert
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: scheduler
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.key
+        path: .values.secrets.tls.key
 
 data:
   chart_name: scheduler
@@ -802,147 +802,147 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes-etcd
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.client.ca'
+        path: '.values.secrets.tls.client.ca'
     -
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes-etcd-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.peer.ca'
+        path: '.values.secrets.tls.peer.ca'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-anchor
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.anchor.tls.cert'
+        path: '.values.secrets.anchor.tls.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-anchor
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.anchor.tls.key'
+        path: '.values.secrets.anchor.tls.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n0
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.client.cert'
+        path: '.values.nodes[0].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n0
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.client.key'
+        path: '.values.nodes[0].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n0-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.peer.cert'
+        path: '.values.nodes[0].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n0-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.peer.key'
+        path: '.values.nodes[0].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n1
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.client.cert'
+        path: '.values.nodes[1].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n1
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.client.key'
+        path: '.values.nodes[1].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n1-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.peer.cert'
+        path: '.values.nodes[1].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n1-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.peer.key'
+        path: '.values.nodes[1].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n2
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.client.cert'
+        path: '.values.nodes[2].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n2
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.client.key'
+        path: '.values.nodes[2].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n2-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.peer.cert'
+        path: '.values.nodes[2].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n2-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.peer.key'
+        path: '.values.nodes[2].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n3
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.client.cert'
+        path: '.values.nodes[3].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n3
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.client.key'
+        path: '.values.nodes[3].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n3-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.peer.cert'
+        path: '.values.nodes[3].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n3-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.peer.key'
+        path: '.values.nodes[3].tls.peer.key'
 
 data:
   chart_name: etcd

examples/complete/Docker.yaml

@@ -6,7 +6,6 @@ metadata:
   layeringDefinition:
     abstract: false
     layer: site
-  storagePolicy: cleartext
 data:
   config:
     insecure-registries:

examples/complete/Kubelet.yaml

@@ -6,7 +6,6 @@ metadata:
   layeringDefinition:
     abstract: false
     layer: site
-  storagePolicy: cleartext
 data:
   arguments:
     - --cni-bin-dir=/opt/cni/bin

examples/complete/KubernetesNetwork.yaml

@@ -6,7 +6,6 @@ metadata:
   layeringDefinition:
     abstract: false
     layer: site
-  storagePolicy: cleartext
 data:
   dns:
     cluster_domain: cluster.local

examples/complete/armada-resources.yaml

@@ -168,23 +168,23 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.ca'
+        path: '.values.secrets.tls.ca'
     -
       src:
         schema: deckhand/Certificate/v1
         name: proxy
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.cert'
+        path: '.values.secrets.tls.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: proxy
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.key'
+        path: '.values.secrets.tls.key'
 data:
   chart_name: proxy
   release: kubernetes-proxy
@@ -225,147 +225,147 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: calico-etcd
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.client.ca'
+        path: '.values.secrets.tls.client.ca'
     -
       src:
         schema: deckhand/CertificateAuthority/v1
         name: calico-etcd-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.peer.ca'
+        path: '.values.secrets.tls.peer.ca'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-anchor
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.anchor.tls.cert'
+        path: '.values.secrets.anchor.tls.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-anchor
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.anchor.tls.key'
+        path: '.values.secrets.anchor.tls.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n0
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.client.cert'
+        path: '.values.nodes[0].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n0
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.client.key'
+        path: '.values.nodes[0].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n0-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.peer.cert'
+        path: '.values.nodes[0].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n0-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.peer.key'
+        path: '.values.nodes[0].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n1
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.client.cert'
+        path: '.values.nodes[1].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n1
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.client.key'
+        path: '.values.nodes[1].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n1-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.peer.cert'
+        path: '.values.nodes[1].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n1-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.peer.key'
+        path: '.values.nodes[1].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n2
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.client.cert'
+        path: '.values.nodes[2].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n2
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.client.key'
+        path: '.values.nodes[2].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n2-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.peer.cert'
+        path: '.values.nodes[2].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n2-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.peer.key'
+        path: '.values.nodes[2].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n3
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.client.cert'
+        path: '.values.nodes[3].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n3
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.client.key'
+        path: '.values.nodes[3].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-etcd-n3-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.peer.cert'
+        path: '.values.nodes[3].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-etcd-n3-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.peer.key'
+        path: '.values.nodes[3].tls.peer.key'
 
 data:
   chart_name: etcd
@@ -470,23 +470,23 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: calico-etcd
-        path: $
+        path: .
       dest:
-        path: '$.values.etcd.tls.ca'
+        path: '.values.etcd.tls.ca'
     -
       src:
         schema: deckhand/Certificate/v1
         name: calico-node
-        path: $
+        path: .
       dest:
-        path: '$.values.etcd.tls.cert'
+        path: '.values.etcd.tls.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: calico-node
-        path: $
+        path: .
       dest:
-        path: '$.values.etcd.tls.key'
+        path: '.values.etcd.tls.key'
 data:
   chart_name: calico
   release: calico
@@ -534,23 +534,23 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes
-        path: $
+        path: .
       dest:
-        path: '$.values.tls.ca'
+        path: '.values.tls.ca'
     -
       src:
         schema: deckhand/Certificate/v1
         name: coredns
-        path: $
+        path: .
       dest:
-        path: '$.values.tls.cert'
+        path: '.values.tls.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: coredns
-        path: $
+        path: .
       dest:
-        path: '$.values.tls.key'
+        path: '.values.tls.key'
 data:
   chart_name: coredns
   release: coredns
@@ -614,52 +614,52 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.ca
+        path: .values.secrets.tls.ca
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: apiserver
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.cert
+        path: .values.secrets.tls.cert
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: apiserver
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.key
+        path: .values.secrets.tls.key
     -
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes-etcd
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.etcd.tls.ca
+        path: .values.secrets.etcd.tls.ca
     -
       src:
         schema: deckhand/Certificate/v1
         name: apiserver-etcd
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.etcd.tls.cert
+        path: .values.secrets.etcd.tls.cert
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: apiserver-etcd
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.etcd.tls.key
+        path: .values.secrets.etcd.tls.key
     -
       src:
         schema: deckhand/PublicKey/v1
         name: service-account
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.service_account.public_key
+        path: .values.secrets.service_account.public_key
 
 data:
   chart_name: apiserver
@@ -715,31 +715,31 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.ca
+        path: .values.secrets.tls.ca
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: controller-manager
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.cert
+        path: .values.secrets.tls.cert
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: controller-manager
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.key
+        path: .values.secrets.tls.key
     -
       src:
         schema: deckhand/PrivateKey/v1
         name: service-account
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.service_account.private_key
+        path: .values.secrets.service_account.private_key
 
 data:
   chart_name: controller_manager
@@ -787,23 +787,23 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.ca
+        path: .values.secrets.tls.ca
     -
       src:
         schema: deckhand/Certificate/v1
         name: scheduler
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.cert
+        path: .values.secrets.tls.cert
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: scheduler
-        path: $
+        path: .
       dest:
-        path: $.values.secrets.tls.key
+        path: .values.secrets.tls.key
 
 data:
   chart_name: scheduler
@@ -849,147 +849,147 @@ metadata:
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes-etcd
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.client.ca'
+        path: '.values.secrets.tls.client.ca'
     -
       src:
         schema: deckhand/CertificateAuthority/v1
         name: kubernetes-etcd-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.tls.peer.ca'
+        path: '.values.secrets.tls.peer.ca'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-anchor
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.anchor.tls.cert'
+        path: '.values.secrets.anchor.tls.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-anchor
-        path: $
+        path: .
       dest:
-        path: '$.values.secrets.anchor.tls.key'
+        path: '.values.secrets.anchor.tls.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n0
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.client.cert'
+        path: '.values.nodes[0].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n0
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.client.key'
+        path: '.values.nodes[0].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n0-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.peer.cert'
+        path: '.values.nodes[0].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n0-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[0].tls.peer.key'
+        path: '.values.nodes[0].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n1
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.client.cert'
+        path: '.values.nodes[1].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n1
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.client.key'
+        path: '.values.nodes[1].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n1-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.peer.cert'
+        path: '.values.nodes[1].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n1-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[1].tls.peer.key'
+        path: '.values.nodes[1].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n2
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.client.cert'
+        path: '.values.nodes[2].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n2
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.client.key'
+        path: '.values.nodes[2].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n2-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.peer.cert'
+        path: '.values.nodes[2].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n2-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[2].tls.peer.key'
+        path: '.values.nodes[2].tls.peer.key'
 
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n3
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.client.cert'
+        path: '.values.nodes[3].tls.client.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n3
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.client.key'
+        path: '.values.nodes[3].tls.client.key'
     -
       src:
         schema: deckhand/Certificate/v1
         name: kubernetes-etcd-n3-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.peer.cert'
+        path: '.values.nodes[3].tls.peer.cert'
     -
       src:
         schema: deckhand/CertificateKey/v1
         name: kubernetes-etcd-n3-peer
-        path: $
+        path: .
       dest:
-        path: '$.values.nodes[3].tls.peer.key'
+        path: '.values.nodes[3].tls.peer.key'
 
 data:
   chart_name: etcd