Kapitan generator releases, 26 October to 1 November 2026

By kadet-hub maintainers · Published 2 November 2026 · 1 min read

New Kapitan generator versions on kadet-hub from 26 October to 1 November 2026: argocd, certmanager, cilium, crossplane, external-secrets, flux, kubernetes,…

Versions published on kadet-hub from 26 October to 1 November 2026, each through the gate and signed. The generator page shows each version’s output diff against the version before it, its SBOM and the command that verifies it.

argocd

argocd 1.0.4

Built for Argo CD 3.5.6. The Application, ApplicationSet and AppProject CRDs are unchanged from 3.5.5, so the shipped schemas and rendered output are unchanged. The upstream files the README cites are identical at v3.5.6, and their links move to that tag.

certmanager

certmanager 1.0.3

Built for cert-manager 1.21.3. The Certificate schema and CRD gain status.acme.ari.certID, a status field the generator does not set. The Issuer, ClusterIssuer and trust-manager Bundle schemas are unchanged. Rendered output is unchanged.

cilium

cilium 1.0.4

Built for Cilium 1.20.4. The schemas and CRDs of the four kinds it renders are unchanged from 1.20.3. The upstream files the README and code cite are identical at v1.20.4, and their links move to that tag. Rendered output is unchanged.

crossplane

crossplane 1.0.3

Built for Crossplane 2.4.3. The CompositeResourceDefinition, Composition, Provider and Function CRDs are unchanged from 2.4.2, so the shipped schemas, the spec.package CEL rule and rendered output are unchanged. The upstream files the README and code cite are identical at v2.4.3, and their links move to that tag.

external-secrets

external-secrets 1.0.6

Built for External Secrets Operator 2.14.0. The SecretStore and ClusterSecretStore schemas and CRDs rewrite six CEL rules on mutually exclusive provider fields (crd auth, onepasswordSDK, openBao auth and CA) from a filtered list to a sum of has() terms with the same limits. The ExternalSecret and ClusterExternalSecret CRDs change only in their controller-gen annotation. Validation and rendered output are unchanged.

flux

flux 1.1.0

Built for Flux 2.10.0, which pins source-controller 1.10.1, kustomize-controller 1.10.1 and helm-controller 1.7.1.

• OCIRepositories render provider: generic and timeout: 60s, and HelmRelease chart templates of kind HelmChart render chart.spec.version: "*" and chart.spec.reconcileStrategy: ChartVersion, unless the inventory sets them. The CRDs defaulted these fields until source-controller 1.9 and helm-controller 1.6. Now the controllers apply the same values to an unset field, so behaviour is unchanged and the rendered objects state the values as the stored objects did before.
• Ships the source-controller 1.10.1, kustomize-controller 1.10.1 and helm-controller 1.7.1 schemas. OCIRepository requires interval and url through CEL rules instead of required. GitRepository and OCIRepository gain status.sourceVerificationFingerprint. Kustomization and HelmRelease kubeConfig take exactly one of configMapRef and secretRef in one rule instead of two.
• HelmRelease chart gains the kind OCIRepository, a chart template that takes chart.spec.url and the other OCIRepository fields. spec.chart passes it through. The generator has no shorthand for it.

kubernetes

kubernetes 1.12.0

• generators.kubernetes.chainsaw.resources adds Chainsaw status asserts for custom resources, by api_version, kind, name, namespace and the expected status, such as a CephCluster with phase: Ready. The namespace’s Chainsaw Test runs them after the readiness asserts.

Output is unchanged for inventories without chainsaw.resources.

kubernetes 1.11.1

Built for Vertical Pod Autoscaler 1.8.1. Its VerticalPodAutoscaler CRD is unchanged from 1.8.0, so the shipped schema and rendered output are unchanged.

kubernetes 1.11.0

• generators.kubernetes.chainsaw.workloads adds Chainsaw readiness asserts and Test steps for workloads the generator does not render, such as those from a Helm chart, by name, kind and namespace. A Deployment or StatefulSet is ready once rolled out, read from the object’s own spec.replicas.

Output is unchanged for inventories without chainsaw.workloads.

kubernetes 1.10.0

• The compile entry with function: generate_chainsaw_asserts also writes <namespace>/chainsaw-test, a Chainsaw Test per namespace that uses the namespace’s StepTemplates. A project no longer keeps the list of templates in a hand-written test.
• Ships the schema of the Chainsaw 0.2.15 Test, with its CRD.

The manifests compiled with generate_manifests are unchanged.

kubevirt

kubevirt 1.4.0

Renders the CSI sidecars at current kubernetes-csi releases instead of the tags upstream pins at csi-driver e13603a, for their vulnerability fixes: csi-provisioner v6.4.0, csi-attacher v4.13.0, csi-resizer v2.3.0, livenessprobe v2.20.0 and csi-node-driver-registrar v2.18.0, each by digest. Their RBAC and the flags the generator passes are unchanged. csi-snapshotter and snapshot-controller stay at v8.7.0, the latest release.

kyverno

kyverno 1.1.4

Built for Kyverno 1.19.2. The ClusterPolicy and Policy schemas and CRDs gain an optional filter on imageExtractors entries, in rules and in the autogen status; image_extractors passes it through. The policies.kyverno.io schemas are unchanged. Rendered output is unchanged. The upstream lines the README cites are unchanged at v1.19.2, and their links move to that tag.

multus

multus 1.0.3

Ships the upstream NOTICE of the schemas and CRDs it vendors in their group directory (Apache-2.0 section 4(d)). Rendered output is unchanged.

ocm

ocm 0.1.0

First release. Writes an OCM component constructor (new CLI generation, multi-component form) for a target. Every image in the YAML files images.scan matches below the compile root, plus images.refs, becomes an ociImage resource, deduplicated by parsed reference with a tag-only reference folded into a pinned one of the same tag, named after the repository and versioned by its tag, with an access template for mirrors and pull-through caches, an optional label holding the upstream reference, optional required digests and images.names for name clashes. Resources that are not images come from the inventory as a map keyed by name. The compile entry needs output_path: . and output_type: plain.

opentelemetry-operator

opentelemetry-operator 1.2.0

Built for OpenTelemetry Operator 0.162.0. The Instrumentation schema and CRD gain php and ruby auto-instrumentation. New flat keys php and ruby on instrumentations set them. The OpenTelemetryCollector schema and CRD bound volumeClaimTemplates[].status.healthStatus.healthConditions, a status field the generator does not set. Rendered output of existing inventories is unchanged. The upstream lines the README cites are unchanged at v0.162.0, and their links move to that tag.

prometheus-operator

prometheus-operator 1.1.5

Built for Prometheus Operator 0.94.2. Its CRDs change only in the operator.prometheus.io/version annotation, so the shipped schemas and rendered output are unchanged. The upstream files the README cites are unchanged at v0.94.2 apart from version labels in the RBAC guide, and their links move to that tag.

talos

talos 1.3.0

Built for Talos 1.14.5.

• The default images are pinned by digest. The five Kubernetes component images move from 1.37.1 to 1.37.2, the newest patch of the Kubernetes version Talos 1.14.5 defaults to, for its vulnerability fixes. The installer moves to factory.talos.dev/metal-installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:v1.14.5, which drops a high Go stdlib advisory of v1.14.3. Images the generator derives from a tag the inventory sets (1.2.0) carry no digest.
• Ships the Talos 1.14.5 schemas. Against 1.14.3 only the description of KernelModuleConfig changed.
• A component image set without a tag, such as registry.k8s.io/kube-apiserver@sha256:..., fails the compile. Since 1.2.0 it rendered the other component images with an empty tag (ghcr.io/siderolabs/kubelet:).

talos 1.2.0

• One Kubernetes version for all component images of a node. Once the inventory sets the image of kubelet, kube-apiserver, kube-controller-manager, kube-scheduler or kube-proxy, every component image that is not set takes its tag, including components without a block, which now get one. Before, a missing image came from the generator’s default (Kubernetes 1.37.1) and a missing block from Talos’ runtime default, so a config pinned to 1.36.4 could carry kube-proxy 1.37.1. Set images with different tags fail the compile, naming the node and the components. Nodes that set no component image render as before.

tetragon

tetragon 0.1.0

First release. Renders TracingPolicy and TracingPolicyNamespaced from parameters.generators.tetragon, with the Tetragon 1.7.1 CRD schemas under schemas/.