Kapitan generator releases, 2 to 8 November 2026

By kadet-hub maintainers · Published 9 November 2026 · 1 min read

New Kapitan generator versions on kadet-hub from 2 to 8 November 2026: argocd, calico, certmanager, cloudnative-pg, docker, grafana, ironcore, k3d, keda,…

Versions published on kadet-hub from 2 to 8 November 2026, each through the gate and signed. The generator page shows each version’s output diff against the version before it, its SBOM and the command that verifies it.

argocd

argocd 1.1.0

New install key: renders Argo CD 3.5.6 from its release manifest manifests/install.yaml, one file per object under install/, with the namespace set and every image pinned by digest. install.cmp adds a Kapitan config management plugin to the repo server: a sidecar running Kapitan 0.36.3 by digest, without a service account token, and the ConfigMap kapitan-plugin with its plugin.yaml. The manifest grants Argo CD cluster-wide * rules, so the generator now declares the rbac-admin output capability. Output of inventories without install is unchanged. Spec: docs/specs/argocd.md.

calico

calico 1.1.4

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.1.3 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

certmanager

certmanager 1.1.0

Every entry accepts labels and annotations and adds them to the metadata of the resources it renders; a ca_issuers entry adds them to all three. Up to 1.0.4 both keys were ignored without an error. Output of entries without them is unchanged.

certmanager 1.0.4

Built for trust-manager 0.26.0. Its Bundle CRD changes only in the controller-gen.kubebuilder.io/version annotation, so the shipped schema and rendered output are unchanged. The release removes the compromised eMudhra roots from the default CA package that useDefaultCAs selects. That package comes with the trust-manager installation, which the generator does not render.

cloudnative-pg

cloudnative-pg 1.1.2

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.1.1 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

docker

docker 1.1.0

Docker Compose output from the components of the kubernetes generator.

• generators.docker.compose turns on compose.yml next to the Dockerfiles. Each component of parameters.components becomes a service, after the kubernetes generator’s defaults: image, entrypoint and command, environment with Secret and ConfigMap values by key and refs as tokens, exposed ports, named volumes from volume_claims, the readiness probe of type command as health check, deploy.resources, user, read_only and restart: always. generators.docker.compose is merged over the result.
• A component key or value without a Compose counterpart fails the compile and names it.
• Without generators.docker.compose the output is unchanged.

docker 1.0.2

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefact of 1.0.1 has no LICENSE although it declares Apache-2.0. Rendered output is unchanged.

grafana

grafana 1.0.3

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.0.2 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

ironcore

ironcore 1.0.2

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.0.1 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

k3d

k3d 1.0.1

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefact of 1.0.0 has no LICENSE although it declares Apache-2.0. Rendered output is unchanged.

keda

keda 1.0.4

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.0.3 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

keycloak

keycloak 1.1.1

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.1.0 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

kind

kind 1.0.1

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefact of 1.0.0 has no LICENSE although it declares Apache-2.0. Rendered output is unchanged.

kmcp

kmcp 1.0.3

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.0.2 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

kserve

kserve 1.0.3

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.0.2 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

kubernetes

kubernetes 1.16.0

• pod_management_policy on a StatefulSet component renders as podManagementPolicy, such as the Parallel that the charts qdrant 1.20.0 and matrix-stack 26.11.0 set. The API rejects a change of the field on an existing StatefulSet, so one that runs with the default OrderedReady switches only after it is deleted with --cascade=orphan and applied again.
• topology_spread_constraints renders unchanged as the pod’s topologySpreadConstraints, on every workload type. The generator adds no labelSelector, and a constraint without one spreads nothing.

Output is unchanged for inventories without these keys.

kubernetes 1.15.0

Keys for what a Helm chart renders and the generator could not, found by converting charts into inventories that are applied over the running Helm release:

• statefulset_service_name sets a StatefulSet’s serviceName and renders no Service, for a governing Service rendered elsewhere, such as a chart’s <release>-headless. It takes precedence over service.service_name.
• volume_claim_name_label: false leaves out the name label that the generator adds to each StatefulSet claim template. The API rejects a change of the claim templates of an existing StatefulSet, so a StatefulSet applied over a Helm release has to keep them as the chart rendered them. The label stays by default, because removing it would fail the next apply of every StatefulSet with volume_claims rendered by an earlier release.
• working_dir on a component, its additional_containers and init_containers renders as workingDir.
• share_process_namespace renders as the pod’s shareProcessNamespace.
• A ports entry with unnamed: true renders its container port without name. A Service port from it keeps the key as its name and targets the container port by number.
• ip_family_policy and ip_families on a component’s service, additional_services and generators.kubernetes.services render as ipFamilyPolicy and ipFamilies.

Output is unchanged for inventories without these keys.

kubernetes 1.14.0

• tty and stdin on a component, and on its additional_containers and init_containers, render as the container fields of the same name. A recipe can then render what a chart sets there, such as tty: true on the main container of the Open WebUI chart 17.5.0. null renders neither, so a target can drop a class’s value.

Full changelog

kubevirt

kubevirt 1.4.1

Ships the Kubernetes 1.37.2 schemas of the built-in kinds the CSI driver uses instead of 1.37.1. kubernetes-json-schema has the same files for both releases, so validation and rendered output are unchanged.

linkerd

linkerd 1.0.4

Built for Linkerd edge-26.10.3. The linkerd-crds chart and the policy controller files the README cites are unchanged since edge-26.10.2, so the shipped schemas and the rendered output stay the same. The README links move to edge-26.10.3.

linkerd 1.0.3

Built for Linkerd edge-26.10.2. The linkerd-crds chart and the policy controller files the README cites are unchanged since edge-26.10.1, so the shipped schemas and the rendered output stay the same. The README links move to edge-26.10.2.

loki

loki 1.0.2

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.0.1 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

mutate

mutate 0.2.1

move now resolves symbolic links before it checks to. A to that reaches a compile entry’s output_path or leaves the target’s compile directory through a link fails the compile, as the same path written without the link already did.

mutate 0.2.0

Adds the move action: move: {to: <path>} takes the matched documents out of their files and appends them to a file relative to the target’s compile directory, such as a sibling directory for a chart’s CRDs. Mutations moving to one file append in id order, and a file left without documents becomes the comment line, as after delete. A to at or below any compile entry’s output_path, or naming a file that exists, fails the compile. Output of inventories without move is unchanged.

mutate 0.1.1

Ships the Kubernetes 1.37.2 schemas of the fixture kinds instead of 1.37.1. kubernetes-json-schema has the same files for both releases, so validation and output are unchanged.

ocm

ocm 0.1.1

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefact of 0.1.0 has no LICENSE although it declares Apache-2.0. Rendered output is unchanged.

prometheus-operator

prometheus-operator 1.1.6

Ships the Kubernetes 1.37.2 ServiceAccount, ClusterRole and ClusterRoleBinding schemas instead of 1.37.1. kubernetes-json-schema has the same files for both releases. The three files no longer end in a newline, so they match upstream byte for byte. Rendered output is unchanged.

rabbitmq

rabbitmq 1.1.2

ConfigMaps and Secrets are checked against the Kubernetes 1.37.2 schemas instead of 1.37.1, which are the same files. Rendered output is unchanged.

rabbitmq 1.1.1

Built for RabbitMQ Cluster Operator 2.23.2 and Messaging Topology Operator 1.20.5. The User schema and CRD gain usernameFromMeta, which uses the User’s name as the RabbitMQ username with a generated password. A user.<name> entry sets it through spec. The other rabbitmq.com schemas and CRDs are unchanged. Messaging Topology Operator 1.20.5 no longer generates a password for an importCredentialsSecret that holds only username and fails such a User. The README now says that a Secret named by secret_name needs password or passwordHash. Rendered output is unchanged. The upstream files the README cites are unchanged at the new tags apart from the user controller, which still generates a random username unless usernameFromMeta is set, and their links move to those tags.

rook-ceph

rook-ceph 1.0.3

Built for Rook 1.21.1. The schemas and CRDs gain CephCluster monitoring.scrapeTimeoutSeconds, CephObjectStore gateway.service.trafficDistribution and CephObjectStoreUser secretTemplate. The spec passthrough and the flat keys monitoring and gateway set them. CephBlockPool, CephFilesystem, CephNFS and CephObjectStore gain a bounded status.message, which the generator does not set. Rendered output of existing inventories is unchanged. The upstream files the README cites are unchanged at v1.21.1, and their links move to that tag. The example Ceph image is still quay.io/ceph/ceph:v20.2.4.

strimzi

strimzi 1.1.1

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.1.0 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

talos

talos 1.3.1

Ships the Kubernetes 1.37.2 Secret schema instead of 1.37.1. kubernetes-json-schema has the same file for both releases, so validation and rendered output are unchanged.

terraform-aws

terraform-aws 0.1.4

Pins hashicorp/aws 6.71.0 instead of 6.69.1 in providers.tf.json and ships its provider schema extract under schemas/terraform/, so the catalog shows “Built for hashicorp/aws 6.71.0”. The release notes of 6.70.0 and 6.71.0 change none of the 15 resource types the generator emits. Between the two extracts only the provider’s endpoints block gains bedrockdataautomation and securityir. schemas/terraform/NOTICE no longer names the extract’s version. Rendered output differs only in the provider version.

terraform-azurerm

terraform-azurerm 0.1.4

Pins hashicorp/azurerm 5.12.0 instead of 5.10.0 in providers.tf.json and ships its provider schema extract under schemas/terraform/, so the catalog shows “Built for hashicorp/azurerm 5.12.0”. The provider block and the schemas of the seven resource types the generator emits are the same in both versions, and the release notes of 5.11.0 and 5.12.0 name none of these types. Their resource sources, storage_container_resource.go included, change only in the copyright year, so containers still go through Azure Resource Manager. schemas/terraform/NOTICE no longer names the extract’s version. Rendered output differs only in the provider version.

terraform-google

terraform-google 0.1.4

Pins hashicorp/google 8.9.0 instead of 8.7.0 in providers.tf.json and ships its provider schema extract under schemas/terraform/, so the catalog shows “Built for hashicorp/google 8.9.0”. Of the release notes of 8.8.0, 8.8.1 and 8.9.0, two entries touch the emitted types: google_compute_firewall gains the computed firewall_id and google_compute_router the computed router_id, which the generator does not set. Between the two extracts the google_compute_subnetwork descriptions of purpose and role also change, and the generator sets neither. schemas/terraform/NOTICE no longer names the extract’s version. Rendered output differs only in the provider version.

terraform-opentelekomcloud

terraform-opentelekomcloud 0.1.3

Pins opentelekomcloud/opentelekomcloud 1.37.11 instead of 1.37.10 in providers.tf.json and ships its provider schema extract under schemas/terraform/, so the catalog shows “Built for opentelekomcloud/opentelekomcloud 1.37.11”. The extracts of both versions are the same, and the 1.37.11 release notes name none of the seven resource types the generator emits. schemas/terraform/NOTICE no longer names the extract’s version. Rendered output differs only in the provider version.

tetragon

tetragon 0.2.0

Built for Tetragon 1.8.0. New flat keys node_selector and state set nodeSelector and state, the top-level spec fields Tetragon 1.8.0 adds. nodeSelector selects by label the nodes whose agents load a policy. A hostSelector with matchLabels or matchExpressions now fails the compile and points to node_selector. Tetragon supports only null and {} there. Its agent refuses to load such a policy, and with the 1.8.0 CRDs the API server rejects it. The schemas and CRDs gain the 1.8.0 selectors and actions, such as matchCmdArgs, matchWorkloads and UpdateState, and validation rules the API server checks. They no longer accept the actions FollowFD, UnfollowFD and CopyFD, which Tetragon 1.8.0 removed. Rendered output of other inventories is unchanged.

thanos

thanos 1.0.3

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.0.2 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.

velero

velero 1.0.3

Republished so the artefact carries the repository’s LICENSE, which the kadet-hub registry adds to every artefact it builds since kadet-hub/registry#418. The artefacts of 1.0.2 and earlier have no LICENSE although they declare Apache-2.0. Rendered output is unchanged.