Kapitan generator releases, 19 to 25 October 2026

By kadet-hub maintainers · Published 26 October 2026 · 1 min read

New Kapitan generator versions on kadet-hub from 19 to 25 October 2026: cloudnative-pg, external-secrets, keycloak, kubernetes, kubevirt, mutate, rabbitmq,…

Versions published on kadet-hub from 19 to 25 October 2026, each through the gate and signed. The generator page shows each version’s output diff against the version before it, its SBOM and the command that verifies it.

cloudnative-pg

cloudnative-pg 1.1.1

__version__ now reports the release version, which still read 1.0.1. Rendered output is unchanged.

cloudnative-pg 1.1.0

name on any entry names its resource and its output file, which before always took the entry’s key. A recipe that may write only keys of its own name can then keep a resource name, such as the Cluster app-db whose claims and Secrets carry its name. Two entries of a section with the same name in one namespace now fail the compile; before, the later one replaced the earlier output file. Output is unchanged for inventories without name and without such a collision.

external-secrets

external-secrets 1.0.5

Built for External Secrets Operator 2.13.0. The upstream CRDs in config/crds/bases are unchanged against 2.12.0, so the shipped schemas, CRDs and rendered output are unchanged.

keycloak

keycloak 1.1.0

name on an entry of instances, realm_imports, oidc_clients or saml_clients names its resource and its output file, which before always took the entry’s key. The defaults realm.realm and keycloakCRName follow it. A recipe that may write only keys of its own name can then keep a Keycloak name, such as sso, whose StatefulSet, Services and Secrets carry it. Two entries of a section with the same name in one namespace now fail the compile. Output is unchanged for inventories without name and without such a collision.

kubernetes

kubernetes 1.9.1

__version__ now reports the release version, which still read 1.1.1. Rendered output is unchanged.

kubernetes 1.9.0

• webhook_configuration_name and validating_webhook_configuration_name on a component name its MutatingWebhookConfiguration and ValidatingWebhookConfiguration. Without them both stay <namespace>-<component>. The CloudNativePG operator writes its CA only into configurations of fixed names.
• A volume_mounts entry takes volume, the volume it mounts. Its key then names only the mount, so one volume can be mounted at several paths with their own sub_path, as Nextcloud’s chart mounts its claim six times. Without volume the key names the volume, as before.

Output is unchanged for inventories without the two name keys and without volume in volume_mounts.

kubernetes 1.8.0

• generators.kubernetes.routes.<name> renders one route attached to Gateways outside the inventory, named in parent_refs by name and optionally namespace, section_name and port. It takes the route keys of gateways.<gw>.routes and renders no Gateway. Before, a route was rendered only together with its Gateway, so a route to the cluster’s shared Gateway needed a manifests entry. The file is <namespace>/<name>-route.
• A redirect rule takes replace_full_path or replace_prefix_match, which render the redirect’s path as ReplaceFullPath or ReplacePrefixMatch, on the routes of gateways and of routes. Both together fail the compile.
• webhook_ca_injected: true on a component renders its webhooks with failurePolicy: Fail and no caBundle, for a server that writes the CA into its webhook configurations itself, as the CloudNativePG operator does. Without it such a webhook still fails the compile.

Output is unchanged for inventories without routes, without the two redirect keys and without webhook_ca_injected.

kubernetes 1.7.0

• args takes a mapping next to the list. Its values render in the mapping’s order: a string as one argument, a list as several, null as none. A target can override or drop one argument a class sets by its key, which a list did not allow because the backends append or merge lists. A mapping value fails the compile.
• service: {} renders the component’s Service with the API defaults. Before, an empty mapping rendered no Service and type: ClusterIP had to be written. api_service accepts it as well. A StatefulSet with service: null no longer fails the compile.
• README: component labels go on the workload, its Services, HPA and VPA, not on the pod template. Service, PodDisruptionBudget and NetworkPolicy selectors take all pod template labels. The README also states the label-value rule for names, the sorted container ports and namespaceSelector: {} on a webhook.

Output is unchanged for inventories without an empty service mapping and without an args mapping.

Full changelog

kubevirt

kubevirt 1.3.2

__version__ now reports the release version, which still read 1.1.1. Rendered output is unchanged.

kubevirt 1.3.1

The KubeVirt CR renders spec: {} when the inventory sets no spec or spec: null. Before, it rendered without spec, which the CRD requires, so the API server rejected it with spec: Required value. Targets that set spec render the same output.

kubevirt 1.3.0

csi.image is optional and defaults to ghcr.io/kadet-hub/mirror/kubevirt-csi-driver:3a1a099330045754011803e3d53cd8276ff21723@sha256:44c98353e6137455d6a393ad13e04f60e10ee49fdcd00cf078f7f7084714f409, kadet-hub’s unmodified copy of the quay.io latest build of 3a1a099. Targets that set image render the same output. The README’s Driver image section links the image’s upstream sources.

kubevirt 1.2.0

Adds csi.snapshot_controller for the tenant role. true renders the snapshot-controller of external-snapshotter v8.7.0 with its RBAC and the VolumeSnapshotClass, VolumeSnapshotContent and VolumeSnapshot CRDs, so a tenant VolumeSnapshotClass works without a separate install. The controller runs in the CSI namespace with a restricted security context. The README’s CSI defaults list where it differs from upstream’s manifest. On the infra role the key fails the compile. Output without the key stays the same.

The snapshot.storage.k8s.io schema group now names external-snapshotter 8.7.0 (client/config/crd) as its source instead of the KubeVirt CSI driver’s copy, and adds the VolumeSnapshotContent and VolumeSnapshot CRDs. All three files are upstream’s byte for byte, and the output renders them from there.

kubevirt 1.1.2

Built for the KubeVirt CSI driver at main@e13603a. Upstream now deploys what csi already rendered. Since kubevirt/csi-driver#392 its controller runs with the restricted security context, with UID and GID 1001 from the plain-kubernetes component, and the node plugin’s csi-driver container as UID 0. Since kubevirt/csi-driver#396 it pins csi-snapshotter v8.7.0. The rendered output stays the same, and the README’s CSI defaults keep only the remaining differences. The VolumeSnapshotClass CRD and schema move to e13603a, whose file is external-snapshotter’s v8.7.0 CRD and differs from the shipped one only in descriptions.

The driver image is still the latest build of 3a1a099. Upstream removed its image workflow (kubevirt/csi-driver#393), so the controller fix of kubevirt/csi-driver#397 is in no published image.

mutate

mutate 0.1.0

First release. Patches the YAML files an earlier compile entry of the same output_path wrote, such as Kapitan’s helm input, in place: mutations keyed by id, applied in id order with deletes last, match objects exactly on apiVersion, kind, name, namespace and labels, and merge (JSON Merge Patch, with merge_lists for keyed list merge), json6902, delete or images. expects fails the compile when a mutation matches no object, or not the given count. Only changed files are written; a file whose objects are all deleted becomes a comment line. The compile entry needs output_type: plain.

rabbitmq

rabbitmq 1.1.0

name on an entry of a custom resource section names its resource, its output file and, for the kinds with spec.name, the default of spec.name, which before always took the entry’s key. A recipe that may write only keys of its own name can then keep a resource name, such as the RabbitmqCluster production whose StatefulSet, claims and Secrets carry its name. Two entries of a section with the same name in one namespace now fail the compile; before, the later one replaced the earlier output file. Output is unchanged for inventories without name on those sections and without such a collision.

strimzi

strimzi 1.1.0

name on a Kafka, node pool, topic or user entry names its resource and its output key, which before always came from the entry’s key. A recipe that may write only keys of its own name can then keep a cluster’s name, such as the Kafka events with the node pool dual whose pods, claims, Services and Secrets carry both names. cluster and strimzi.io/cluster name the Kafka’s resource. A topic or user whose cluster names Kafkas in two namespaces fails the compile unless it sets namespace. Output is unchanged for inventories without name.