Genrule with external executable binary

BUILD.bazel

#           _       ______  ____  __ _______ ____  ___   ____________
#          | |     / / __ \/ __ \/ //_/ ___// __ \/   | / ____/ ____/
#          | | /| / / / / / /_/ / ,<  \__ \/ /_/ / /| |/ /   / __/
#          | |/ |/ / /_/ / _, _/ /| |___/ / ____/ ___ / /___/ /___
#          |__/|__/\____/_/ |_/_/ |_/____/_/   /_/  |_\____/_____/
#
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")

http_file(
    name = "kubectl",
    urls = ["https://dl.k8s.io/release/v1.22.1/bin/linux/amd64/kubectl"],
    sha256 = "78178a8337fc6c76780f60541fca7199f0f1a2e9c41806bded280a4a5ef665c9",
    executable = True,
)
#                           ____  __  ________    ____
#                          / __ )/ / / /  _/ /   / __ \
#                         / __  / / / // // /   / / / /
#                        / /_/ / /_/ // // /___/ /_/ /
#                       /_____/\____/___/_____/_____/
#
genrule(
   name = "ns",
   outs = ["ns.yaml"],
   cmd = "$(location @kubectl//file) create ns foo --dry-run=client -oyaml > $@",
   srcs = ["@kubectl//file"],
)