kadet-hub logokadet-hub

kubernetes

Renders Kubernetes workloads with their Services, ConfigMaps, Secrets, RBAC, autoscaling, NetworkPolicies and volumes from one component block, plus Ingress, Gateway API and cluster policy resources.

kubernetes

Latest
1.2.0 ·
License
Apache-2.0
Owners
Moep90
Source
github.com/kadet-hub/generators · 0 repo stars, shared by 35 generators
Thumbs up
👍 0 on GitHub Discussions
Popularity
20 · 872 pulls

Request a feature Report a problem

Badge

Show the latest listed version in your README. shields.io draws the badge from this page's badge.json, which every catalog build updates; once no version is listed, it reads "not listed".

[![kadet-hub](https://img.shields.io/endpoint?url=https://kadet-hub.org/generators/kubernetes/badge.json)](https://kadet-hub.org/generators/kubernetes/)

Kubernetes Generator

Published on kadet-hub (catalog): pin a released version by digest from its catalog page.

Kapitan kadet generator for plain Kubernetes resources. One component block under parameters.components becomes a workload (Deployment, StatefulSet, DaemonSet, Job or CronJob) plus the resources derived from it: Services selecting its pods, ConfigMaps and Secrets mounted into it, a ServiceAccount with Role or ClusterRole bindings, HorizontalPodAutoscaler, PodDisruptionBudget, VerticalPodAutoscaler, NetworkPolicies, PersistentVolumeClaims and admission webhooks. Next to components it renders Ingresses (with GKE ManagedCertificates), Gateway API resources, standalone ConfigMaps, Secrets, ServiceAccounts and volumes, cluster and namespace policy kinds, and any other kind through a passthrough.

Built for Kubernetes 1.37.1, Gateway API 1.6.3, Vertical Pod Autoscaler 1.8.0 and GKE Managed Certificates 1.2.12.

ServiceMonitor, PodMonitor and PrometheusRule belong in the prometheus-operator generator (generators.prometheus_operator); the component keys service_monitors and prometheus_rules and the section generators.kubernetes.pod_monitors are ignored with a warning naming it.

Usage

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/kubernetes@sha256:<digest>
        output_path: lib/kubernetes
    compile:
      - output_path: manifests/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/kubernetes

  namespace: shop

  generators:
    manifest:
      default_config:           # merged into every component; component keys win
        recommended_labels: true
        security_profile: restricted
      resource_defaults:
        deployment:             # merged into components of this type
          revision_history_limit: 5

  components:
    web:
      image: registry.example.com/shop/web:1.4.2
      replicas: 2
      ports:
        http:
          container_port: 8080
          service_port: 80
      healthcheck:
        readiness:
          type: http
          port: http
          path: /ready
      resources:
        requests: {cpu: 100m, memory: 128Mi}
        limits: {memory: 256Mi}
      env:
        LOG_LEVEL: info
        CHECKOUT_URL:
          configMapKeyRef:
            key: checkout_url   # name resolved to the component's ConfigMap
      config_maps:
        config:
          mount: /etc/web
          data:
            checkout_url:
              value: https://shop.example.com/checkout
      service:
        type: ClusterIP
      hpa:
        min_replicas: 2
        max_replicas: 6
      pdb_min_available: 1

This renders shop/web-deploy.yml (Deployment with the ConfigMap volume, mount and env reference wired up, restricted security context), shop/web-cm.yml, shop/web-svc.yml (selector and ports from the container ports with a service_port) and shop/web-scaling.yml (HPA targeting the Deployment, PDB selecting its pods). tests/fixtures/inventory/targets/complete.yml uses every section below.

Inputs

Key Renders
components.<name> the component bundle, see below
generators.manifest.default_config, .resource_defaults.<type>, applications.<app>.component_defaults defaults merged into components; default_config.globals.config_maps / .secrets add labels and annotations to every component ConfigMap or Secret
ingresses.<name> Ingress (networking.k8s.io/v1); managed_certificate adds a GKE ManagedCertificate
generators.kubernetes.gateway_classes, gateways, backend_tls_policies, reference_grants Gateway API GatewayClass, Gateway with HTTPRoute, GRPCRoute, TCPRoute, TLSRoute and UDPRoute, BackendTLSPolicy, ReferenceGrant
generators.kubernetes.configs, secrets, service_accounts, persistent_volumes, persistent_volume_claims standalone ConfigMap, Secret, ServiceAccount, PersistentVolume, PersistentVolumeClaim
generators.kubernetes.storage_classes, ingress_classes, runtime_classes, priority_classes, limit_ranges, resource_quotas the matching kind; flat keys are the snake_case spec fields, default: true sets the default-class annotation on StorageClass and IngressClass
generators.kubernetes.namespaces Namespace (labels, annotations)
generators.kubernetes.rbac.<name> one role and its bindings, see below
generators.kubernetes.manifests.<name> any kind: api_version, kind, name, namespace, labels, annotations and the remaining fields under body
generators.kubernetes.namespace, namespace default namespace (Gateway API resources check generators.kubernetes.namespace first), else default

Component keys, by what they produce:

Area Keys
workload type (deployment default, statefulset, daemonset, job), schedule (makes a Job a CronJob), replicas, update_strategy, revision_history_limit, min_ready_seconds, deployment_progress_deadline_seconds, backoff_limit, completions, parallelism, active_deadline_seconds, ttl_seconds_after_finished, concurrency_policy, suspend, starting_deadline_seconds, labels, annotations, pod_labels, pod_annotations, recommended_labels
containers image, pull_policy, command, args, env, env_from, ports, healthcheck (startup, liveness, readiness; type http, tcp, command, grpc), resources, lifecycle, security_context, volume_mounts, additional_containers, init_containers
pod volumes, volume_claims (StatefulSet templates), service_account, automount_service_account_token, enable_service_links, image_pull_secrets, dns_policy, grace_period, restart_policy, node_selector, tolerations, affinity, prefer_pods_in_different_nodes, prefer_pods_in_different_zones, prefer_pods_in_node_with_expression, priority_class_name, resource_claims, host_network, host_pid, host_ipc
security security_profile (baseline, restricted), read_only_root_filesystem, workload_security_context, network_policies
config config_maps, secrets (data, string_data from value, template or file; items, mount, versioned)
services service, additional_services
RBAC service_account.create, role, cluster_role (rules and an optional binding)
scaling hpa, pdb_min_available, auto_pdb, vpa (update mode)
other persistent_volumes, persistent_volume_claims, webhooks (Mutating), validating_webhooks, webhook_annotations, backend_config (GKE BackendConfig)

labels go on the workload and its pod template; pod_labels only on the pod template. Selectors use the name label only. service_account.create renders a ServiceAccount, service_account.enabled only sets serviceAccountName; either sets it, to service_account.name or the component name, and Role and ClusterRole bindings bind that name.

Probes are rendered only for the healthcheck entries that set a type, never on init containers. With hpa set, the workload has no replicas, so applying the manifest does not reset the HPA’s count (HPA docs). A Job’s pod template is immutable: changing the image or a versioned ConfigMap of an existing Job needs the Job deleted first, or ttl_seconds_after_finished. backoff_limit defaults to 1, as documented before the migration.

Secret data values are base64-encoded unless the entry sets b64_encode: false; string_data stays plain. A Kapitan ref (?{...}) passes through unchanged, so a ref used in data must hold a base64 value. With versioned: true the ConfigMap or Secret name gets a content hash, and the volumes, env and env_from references of the component follow it.

A Service needs at least one container port with a service_port, except headless and ExternalName Services. Two resources that map to the same output file fail the compile.

For PersistentVolumes and PersistentVolumeClaims, spec is merged over the generator defaults first, then the flat keys are applied; a flat key that overrides a spec value logs a warning.

The Gateway services shorthand turns hostname, namespace, tls_secret, backend and optional cluster_issuer/issuer into an HTTPS listener, an HTTP to HTTPS redirect route (not for type: grpc) and the backend route. redirect_status_code sets the redirect’s statusCode, default 301. 301 and 302 are Core support; 303, 307 and 308 are Extended and need an implementation that supports them (statusCode). Any other value fails the compile. A listener without allowed_routes.namespaces_from admits the namespaces of the routes the generator renders for it: Same when they all live in the Gateway’s namespace, otherwise a Selector on kubernetes.io/metadata.name listing them. The upstream default is Same (AllowedRoutes); All would let any namespace attach routes to the listener’s hostnames. Routes rendered elsewhere need allowed_routes set explicitly.

RBAC

One rbac entry is one role with its bindings; role and binding take the entry’s name.

Keys Renders
rules (and aggregation_rule) without namespace ClusterRole
rules with namespace Role in that namespace
cluster_role or role instead of rules no role; binds that existing ClusterRole or Role
namespaces a RoleBinding to the ClusterRole in each namespace
cluster_wide: true a ClusterRoleBinding
namespace with subjects a RoleBinding to the Role in its namespace

Subjects come from service_accounts (<namespace>/<name>, or <name> in the binding’s namespace), groups, users and subjects (passed through). Without subjects only the role is rendered. Contradictions fail the compile, naming the entry: subjects without namespace, namespaces or cluster_wide, a binding scope without subjects, rules together with role or cluster_role, role and cluster_role together, role without namespace, cluster_role with namespace (bind it with namespaces), a Role with namespaces or cluster_wide, and aggregation_rule on a Role.

Security defaults

The generator sets no privileged, host namespace, hostPath or added capability default, and only sets a Service type that the inventory names, so nothing is exposed through LoadBalancer or NodePort unless configured. security_profile: restricted fills the Pod Security Standards restricted fields that are unset: pod runAsNonRoot: true and seccompProfile.type: RuntimeDefault, and on every container allowPrivilegeEscalation: false and capabilities.drop: [ALL]. A rendered value the chosen profile forbids is kept and logged as a warning naming the field. The profile is opt-in, per component or through default_config, because runAsNonRoot stops images that run as root.

Pods and generated ServiceAccounts get automountServiceAccountToken: false (Opt out of API credential automounting). A component that calls the API sets automount_service_account_token: true; a standalone ServiceAccount takes service_account.automount_service_account_token.

A service webhook with failurePolicy: Fail (the API default) needs clientConfig.caBundle or webhook_annotations with cert-manager.io/inject-ca-from, else the compile fails. Each webhook without a namespaceSelector excludes the namespace of its own Service, so the webhook cannot block its own pods. ClusterRoles, ClusterRoleBindings and webhook configurations are named <namespace>-<component>.

The generator also warns about images without a pinned tag, containers without CPU and memory requests or a memory limit, ports without a readiness probe and PodDisruptionBudgets that allow no eviction.

Output files

Each resource set goes to <namespace>/<name>-<suffix>.yml below the compile output_path; cluster-scoped kinds have no namespace directory. Component bundles without content are not written.

Source Suffix
component workload with its webhooks and BackendConfig deploy, sts, ds, job, cj
component config_maps / secrets cm / secret
component service, additional_services svc
component ServiceAccount, Role, ClusterRole and bindings rbac
component VPA, PDB, HPA scaling
component NetworkPolicies security
component persistent_volumes / persistent_volume_claims vol
ingresses ingress, managed-certificate
gateways gateway; routes gw-routes in the route’s namespace; generated ReferenceGrants refgrant in the target namespace
gateway_classes <name>-gatewayclass
reference_grants, backend_tls_policies refgrant, btlspolicy
standalone secrets, configs, service_accounts, persistent_volume_claims secret, config, sa, pvc
standalone persistent_volumes, PVs from create_pv <name>-pv, no namespace directory
storage_classes, ingress_classes, runtime_classes, priority_classes <name>-sc, -ingressclass, -runtimeclass, -pc
limit_ranges, resource_quotas limits, quota
namespaces <name>-namespace, no namespace directory
rbac <name>-clusterrole, <name>-clusterrolebinding without namespace directory; role, rolebinding in the namespace
manifests <kind lowercased>; no namespace directory without namespace

API versions and schemas

Built-in kinds use the GA versions served by Kubernetes 1.37: v1, apps/v1, batch/v1, autoscaling/v2, policy/v1, networking.k8s.io/v1, rbac.authorization.k8s.io/v1, storage.k8s.io/v1, node.k8s.io/v1, scheduling.k8s.io/v1, admissionregistration.k8s.io/v1. Gateway API kinds use their storage versions in the 1.6 standard channel, gateway.networking.k8s.io/v1 for every kind except ReferenceGrant (v1beta1); a route’s api_version overrides it. VerticalPodAutoscaler is autoscaling.k8s.io/v1, ManagedCertificate networking.gke.io/v1, BackendConfig cloud.google.com/v1.

schemas/ holds the JSON Schemas of these kinds: built-in kinds from kubernetes-json-schema v1.37.1-standalone-strict, CRD kinds from the upstream CRDs at the versions above, closed against unknown fields. BackendConfig is not schema-checked, because GKE publishes no BackendConfig CRD file; kinds rendered through manifests are checked only where schemas/ has their schema.

ingress-nginx annotations

For moving an Ingress from ingresses.<name> to generators.kubernetes.gateways, the table maps common ingress-nginx annotations (controller v1.15.1, prefix nginx.ingress.kubernetes.io/) to the Gateway API 1.6.3 standard channel this generator renders, and to the generator keys below generators.kubernetes that render the field. Ingress and Gateway can run side by side during the move: the Ingress keeps its annotations, and the Gateway gets its own address (ingress-nginx migration guide). ingress2gateway v1.2.0 converts most of these annotations and warns about the rest.

Annotation Gateway API 1.6.3 standard Generator
ssl-redirect, force-ssl-redirect RequestRedirect filter with scheme: https on a route attached to the HTTP listener gateways.<gw>.services.<svc> (301 or redirect_status_code, http_redirect: false drops it), or a gateways.<gw>.routes rule with redirect.scheme and redirect.status_code
rewrite-target URLRewrite filter, path.type ReplacePrefixMatch or ReplaceFullPath none
backend-protocol GRPC: GRPCRoute; HTTPS: BackendTLSPolicy; GRPCS: both; FCGI: none type: grpc on a services entry or route; backend_tls_policies
canary, canary-weight two backendRefs with weight in one rule; canary-by-header is a headers match none
enable-cors, cors-* CORS filter none
use-regex path match type: RegularExpression gateways.<gw>.routes.<route>.rules.<rule>.matches.<match>.type: RegularExpression
proxy-body-size none none
whitelist-source-range none none
auth-url none; experimental channel: ExternalAuth filter (GEP-1494) none
affinity, session-cookie-* none; experimental channel: rule sessionPersistence (GEP-1619) none
server-snippet, configuration-snippet none none

A Gateway API field with “none” in the generator column is one the route keys cannot render: a route rule renders one backend, path (or gRPC method) matches and no filter other than redirect. That route goes in generators.kubernetes.manifests as kind: HTTPRoute with its spec under body, as do the implementation policies below. Experimental fields also need the experimental channel CRDs in the cluster.

ingress-nginx redirects to HTTPS with 308 (ssl-redirect). The services shorthand defaults to 301, which does not guarantee that the client keeps the request method; redirect_status_code: 308 on the service or status_code: 308 on a route rule behaves like ingress-nginx (redirects). The redirect route does not depend on TLS on the Gateway, so ssl-redirect and force-ssl-redirect map to the same route, and ssl-redirect: "false" means no redirect route. ingress2gateway adds the 308 redirect only for hosts with TLS on the Ingress and does not convert force-ssl-redirect.

ReplacePrefixMatch with an empty replacePrefixMatch strips the matched prefix: /foo/bar with prefix /foo becomes /bar (API spec). That covers the common path: /something(/|$)(.*) with rewrite-target: /$2 (rewrite example). Other capture group references have no equivalent; ingress2gateway converts rewrite-target to ReplaceFullPath and flags them. Path rewrites are Extended support.

BackendTLSPolicy (standard since v1.4.0) requires validation.hostname and a CA from caCertificateRefs or wellKnownCACertificates, so it always verifies the backend certificate (BackendTLSPolicy). backend-protocol: HTTPS alone does not, because proxy-ssl-verify defaults to off (backend certificate authentication); ingress2gateway emits a BackendTLSPolicy only when proxy-ssl-verify and proxy-ssl-server-name are on and proxy-ssl-secret and proxy-ssl-name name the CA Secret and the hostname (backend_tls.go).

Weights are proportional, not percentages: canary-weight: "10" with the default canary-weight-total of 100 is weight 90 on the main backend and 10 on the canary (traffic splitting). ingress2gateway converts canary-weight, canary-by-header and canary-by-header-value, and warns on canary-by-cookie and canary-by-header-pattern.

The CORS filter is standard since v1.5.0 with Extended support (CORS) and has none of the ingress-nginx defaults. ingress-nginx allows origin *, allows credentials and caches preflights for 1728000 seconds (CORS); the filter has no default origins, methods or headers, sends Access-Control-Allow-Credentials only with allowCredentials: true and defaults maxAge to 5 seconds. Set allowOrigins, allowMethods, allowHeaders, exposeHeaders, allowCredentials and maxAge explicitly.

RegularExpression path matches have Implementation-specific support, so the regex dialect and case sensitivity are the implementation’s (extension points). ingress-nginx matches case-insensitively, on every path of the host once one of its Ingresses sets use-regex (use-regex); ingress2gateway writes (?i)<path>.* (regex.go).

Body size, IP ranges, external auth, session affinity and snippets need an implementation extension: a policy that targets the Gateway or route, or an ExtensionRef filter in the route (extension points). Examples from Envoy Gateway 1.9 and NGINX Gateway Fabric:

  • proxy-body-size: Envoy Gateway BackendTrafficPolicy requestBuffer.limit (request buffering), which ingress2gateway’s envoy-gateway emitter renders (buffer.go). Above the limit it answers 413 like ingress-nginx, but it buffers the whole request, so streaming gRPC and WebSocket routes can hang.
  • whitelist-source-range, denylist-source-range: Envoy Gateway SecurityPolicy authorization rules with principal.clientCIDRs (IP allowlist), also rendered by the envoy-gateway emitter (iprange.go).
  • auth-url: Envoy Gateway SecurityPolicy extAuth (external authorization). ingress2gateway does not convert it.
  • affinity: cookie: Envoy Gateway implements the experimental sessionPersistence (session persistence); session-cookie-name becomes sessionName. ingress2gateway converts affinity only with its gce emitter (gce.go).
  • server-snippet, configuration-snippet: NGINX Gateway Fabric SnippetsFilter, NGINX syntax referenced through extensionRef (snippets), or Envoy Gateway EnvoyPatchPolicy, JSON patches to the generated Envoy configuration (Envoy patch policy). Both are disabled by default. ingress2gateway does not convert snippets.

Versions

Add a version's inventory entry, then compile with the consumer workflow, which verifies the artifact and runs Kapitan in the sandbox.

Free of charge, as is and on a best-effort basis: use at your own risk, and review the compiled output before you apply it. Terms

This catalog was built from index serial 47. Set index_serial: 47 in .kapitan-sandbox.yaml and the consumer workflow refuses any older index, so a rolled-back index cannot bring back a yanked version.

Checks find known patterns; they do not prove a generator safe. What a listing covers

VersionBuilt for (schema-checked)
1.2.0GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
1.1.1GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
1.1.0GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
1.0.2GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
1.0.1GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
1.0.0GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
1.2.0

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/kubernetes:1.2.0@sha256:52017626e77dd5bf7293ce465ff0c3dc7a61dae1ae8353a56a53ffebe1bfb67c
        output_path: lib/kubernetes

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/kubernetes@sha256:52017626e77dd5bf7293ce465ff0c3dc7a61dae1ae8353a56a53ffebe1bfb67c \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3283465340, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared
>=0.36.3,<0.37
Kapitan checked
0.36.3
Backends checked
reclass-rs, omegaconf
With --cache
passed
krab
compatible
Built for (schema-checked)
GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
Source
kubernetes-v1.2.0 · 7cd44eb86858742a972a61d3b0332477e65ec171 · kubernetes
Binaries
none
Output capabilities
admission-webhook
Digest
sha256:52017626e77dd5bf7293ce465ff0c3dc7a61dae1ae8353a56a53ffebe1bfb67c

Checks

Checked by the release run on , gate at 6dc7f2ff4751.

  • Secrets gitleaks 8.30.1
    No secret matched the marketplace's gitleaks rules.
  • Malware ClamAV 1.5.4
    No file matched a ClamAV signature.
  • Malicious package heuristics GuardDog 3.2.0
    No GuardDog threat rule matched.
  • Dangerous code Semgrep 1.180.0
    No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
  • Python errors Ruff 0.17.0
    No syntax error or undefined name (Ruff, error rules only).
  • File tree tree_check.py
    No symlink, executable or banned file; imports within the allowlist.
  • Sandboxed compile gVisor 20261005, Kapitan 0.36.3
    The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
  • Output capabilities Conftest 0.71.1
    The compiled output uses only the capabilities the manifest declares.
  • CI detection Kapitan 0.36.3
    The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

Fixture output against 1.1.1: 11 files, 11 hunks.

--- a/compiled/complete/manifests/app-deployer-clusterrole.yaml
+++ b/compiled/complete/manifests/app-deployer-clusterrole.yaml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    name: app-deployer
+  name: app-deployer
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
--- a/compiled/complete/manifests/namespace-reader-clusterrole.yaml
+++ b/compiled/complete/manifests/namespace-reader-clusterrole.yaml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    name: namespace-reader
+  name: namespace-reader
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - namespaces
+    verbs:
+      - get
+      - list
--- a/compiled/complete/manifests/namespace-reader-clusterrolebinding.yaml
+++ b/compiled/complete/manifests/namespace-reader-clusterrolebinding.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    name: namespace-reader
+  name: namespace-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: namespace-reader
+subjects:
+  - kind: ServiceAccount
+    name: ci-deployer
+    namespace: shop
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: developers
--- a/compiled/complete/manifests/payments-namespace.yaml
+++ b/compiled/complete/manifests/payments-namespace.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    name: payments
+    pod-security.kubernetes.io/enforce: restricted
+  name: payments
--- a/compiled/complete/manifests/payments/app-deployer-rolebinding.yaml
+++ b/compiled/complete/manifests/payments/app-deployer-rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    name: app-deployer
+  name: app-deployer
+  namespace: payments
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: app-deployer
+subjects:
+  - kind: ServiceAccount
+    name: ci-deployer
+    namespace: shop
--- a/compiled/complete/manifests/payments/config-reader-role.yaml
+++ b/compiled/complete/manifests/payments/config-reader-role.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    name: config-reader
+  name: config-reader
+  namespace: payments
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
--- a/compiled/complete/manifests/payments/config-reader-rolebinding.yaml
+++ b/compiled/complete/manifests/payments/config-reader-rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    name: config-reader
+  name: config-reader
+  namespace: payments
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: config-reader
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: User
+    name: jane@example.com
--- a/compiled/complete/manifests/payments/payments-edit-rolebinding.yaml
+++ b/compiled/complete/manifests/payments/payments-edit-rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    name: payments-edit
+  name: payments-edit
+  namespace: payments
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+  - apiGroup: rbac.authorization.k8s.io
+    kind: Group
+    name: payments-team
--- a/compiled/complete/manifests/payments/payments-secrets-rolebinding.yaml
+++ b/compiled/complete/manifests/payments/payments-secrets-rolebinding.yaml
@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    name: payments-secrets
+  name: payments-secrets
+  namespace: payments
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: secret-reader

Truncated after 150 lines; 40 more in the download.

Output diff

1.1.1

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/kubernetes:1.1.1@sha256:de9bed95a732f7cc12eabad6203990303f973edd4b024b845f99b825a573bdaf
        output_path: lib/kubernetes

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/kubernetes@sha256:de9bed95a732f7cc12eabad6203990303f973edd4b024b845f99b825a573bdaf \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3250301551, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared
>=0.36.3,<0.37
Kapitan checked
0.36.3
Backends checked
not recorded
With --cache
not recorded
krab
compatible
Built for (schema-checked)
GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
Source
kubernetes-v1.1.1 · e4891e8fd85ca0a19ebf361e8b54fd6473fd8a2f · kubernetes
Binaries
none
Output capabilities
admission-webhook
Digest
sha256:de9bed95a732f7cc12eabad6203990303f973edd4b024b845f99b825a573bdaf

Checks

Checked by the release run on , gate at fe9998b5168d.

  • Secrets gitleaks 8.30.1
    No secret matched the marketplace's gitleaks rules.
  • Malware ClamAV 1.5.4
    No file matched a ClamAV signature.
  • Malicious package heuristics GuardDog 3.2.0
    No GuardDog threat rule matched.
  • Dangerous code Semgrep 1.180.0
    No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
  • Python errors Ruff 0.17.0
    No syntax error or undefined name (Ruff, error rules only).
  • File tree tree_check.py
    No symlink, executable or banned file; imports within the allowlist.
  • Sandboxed compile gVisor 20261005, Kapitan 0.36.3
    The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
  • Output capabilities Conftest 0.71.1
    The compiled output uses only the capabilities the manifest declares.
  • CI detection Kapitan 0.36.3
    The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.1.0

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/kubernetes:1.1.0@sha256:13c04d48ecba6a665c19d42b111e6f191e7c52714a211f6544fe67466314d30a
        output_path: lib/kubernetes

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/kubernetes@sha256:13c04d48ecba6a665c19d42b111e6f191e7c52714a211f6544fe67466314d30a \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3249252850, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared
>=0.36.3,<0.37
Kapitan checked
0.36.3
Backends checked
not recorded
With --cache
not recorded
krab
compatible
Built for (schema-checked)
GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
Source
kubernetes-v1.1.0 · 082ee81cd1ef3aff999df9805b0e3d3e9f812938 · kubernetes
Binaries
none
Output capabilities
admission-webhook
Digest
sha256:13c04d48ecba6a665c19d42b111e6f191e7c52714a211f6544fe67466314d30a

Checks

Checked by the release run on , gate at 7c407ecfa603.

  • Secrets gitleaks 8.30.1
    No secret matched the marketplace's gitleaks rules.
  • Malware ClamAV 1.5.4
    No file matched a ClamAV signature.
  • Malicious package heuristics GuardDog 3.2.0
    No GuardDog threat rule matched.
  • Dangerous code Semgrep 1.180.0
    No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
  • Python errors Ruff 0.17.0
    No syntax error or undefined name (Ruff, error rules only).
  • File tree tree_check.py
    No symlink, executable or banned file; imports within the allowlist.
  • Sandboxed compile gVisor 20261005, Kapitan 0.36.3
    The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
  • Output capabilities Conftest 0.71.1
    The compiled output uses only the capabilities the manifest declares.
  • CI detection Kapitan 0.36.3
    The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.2

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/kubernetes:1.0.2@sha256:7c5b40968eaab448a66202d4eed7ee1348eda5e3a42fc3fdee342f601b3c3f35
        output_path: lib/kubernetes

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/kubernetes@sha256:7c5b40968eaab448a66202d4eed7ee1348eda5e3a42fc3fdee342f601b3c3f35 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3244275912, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared
>=0.36.3,<0.37
Kapitan checked
0.36.3
Backends checked
not recorded
With --cache
not recorded
krab
compatible
Built for (schema-checked)
GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
Source
kubernetes-v1.0.2 · 9166cb30e0ae4874bc8f229c6a6823eff7451d04 · kubernetes
Binaries
none
Output capabilities
admission-webhook
Digest
sha256:7c5b40968eaab448a66202d4eed7ee1348eda5e3a42fc3fdee342f601b3c3f35

Checks

Checked by the release run on , gate at cb64712208f8.

  • Secrets gitleaks 8.30.1
    No secret matched the marketplace's gitleaks rules.
  • Malware ClamAV 1.5.4
    No file matched a ClamAV signature.
  • Malicious package heuristics GuardDog 3.2.0
    No GuardDog threat rule matched.
  • Dangerous code Semgrep 1.180.0
    No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
  • Python errors Ruff 0.17.0
    No syntax error or undefined name (Ruff, error rules only).
  • File tree tree_check.py
    No symlink, executable or banned file; imports within the allowlist.
  • Sandboxed compile gVisor 20261005, Kapitan 0.36.3
    The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
  • Output capabilities Conftest 0.71.1
    The compiled output uses only the capabilities the manifest declares.
  • CI detection Kapitan 0.36.3
    The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.1

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/kubernetes:1.0.1@sha256:c024d5e82cac3e1690ec3e1e30c2a10a020c3b962ca0f94f458731b994bf261a
        output_path: lib/kubernetes

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/kubernetes@sha256:c024d5e82cac3e1690ec3e1e30c2a10a020c3b962ca0f94f458731b994bf261a \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3241123808, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared
>=0.36.3,<0.37
Kapitan checked
0.36.3
Backends checked
not recorded
With --cache
not recorded
krab
compatible
Built for (schema-checked)
GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
Source
kubernetes-v1.0.1 · 572dda58b592673020f4a8d97142d1cdd2125440 · kubernetes
Binaries
none
Output capabilities
admission-webhook
Digest
sha256:c024d5e82cac3e1690ec3e1e30c2a10a020c3b962ca0f94f458731b994bf261a

Checks

Checked by the release run on , gate at 461ba3b3c507.

  • Secrets gitleaks 8.30.1
    No secret matched the marketplace's gitleaks rules.
  • Malware ClamAV 1.5.4
    No file matched a ClamAV signature.
  • Malicious package heuristics GuardDog 3.2.0
    No GuardDog threat rule matched.
  • Dangerous code Semgrep 1.180.0
    No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
  • Python errors Ruff 0.17.0
    No syntax error or undefined name (Ruff, error rules only).
  • File tree tree_check.py
    No symlink, executable or banned file; imports within the allowlist.
  • Sandboxed compile gVisor 20261005, Kapitan 0.36.3
    The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
  • Output capabilities Conftest 0.71.1
    The compiled output uses only the capabilities the manifest declares.
  • CI detection Kapitan 0.36.3
    The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.

1.0.0

Inventory

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/kubernetes:1.0.0@sha256:247699eb69132b913e29e2e58d4140b79f2790c5ab9543e86569f76ebe341080
        output_path: lib/kubernetes

Verify

gh attestation verify \
  oci://ghcr.io/kadet-hub/kubernetes@sha256:247699eb69132b913e29e2e58d4140b79f2790c5ab9543e86569f76ebe341080 \
  --owner kadet-hub \
  --cert-identity https://github.com/kadet-hub/registry/.github/workflows/release.yml@refs/heads/main

Transparency log: Rekor entry 3230627511, in Sigstore's public, append-only log, so the attestation stays checkable independent of this site.

Kapitan declared
>=0.36.3,<0.37
Kapitan checked
0.36.3
Backends checked
not recorded
With --cache
not recorded
krab
compatible
Built for (schema-checked)
GKE Managed Certificates 1.2.12
Gateway API 1.6.3
Kubernetes 1.37.1
Vertical Pod Autoscaler 1.8.0
Source
kubernetes-v1.0.0 · 52f57bf7b4b4d53e4e6bf72758da8f28611f516b · kubernetes
Binaries
none
Output capabilities
admission-webhook
Digest
sha256:247699eb69132b913e29e2e58d4140b79f2790c5ab9543e86569f76ebe341080

Checks

Checked by the release run on , gate at 01f309911ca4.

  • Secrets gitleaks 8.30.1
    No secret matched the marketplace's gitleaks rules.
  • Malware ClamAV 1.5.4
    No file matched a ClamAV signature.
  • Malicious package heuristics GuardDog 3.2.0
    No GuardDog threat rule matched.
  • Dangerous code Semgrep 1.180.0
    No marketplace Semgrep rule matched, such as eval, subprocess or network calls.
  • Python errors Ruff 0.17.0
    No syntax error or undefined name (Ruff, error rules only).
  • File tree tree_check.py
    No symlink, executable or banned file; imports within the allowlist.
  • Sandboxed compile gVisor 20261005, Kapitan 0.36.3
    The fixture compiled without network, with decoy credentials; no undeclared program ran, no decoy was read.
  • Output capabilities Conftest 0.71.1
    The compiled output uses only the capabilities the manifest declares.
  • CI detection Kapitan 0.36.3
    The output is the same with CI variables set.

SBOM (SPDX 2.3)

Output diff

No output diff recorded: this version was published before the release run recorded one.