Glossary

kadet-hub lists generators for Kapitan. These are the terms the catalog uses.

Kapitan: A configuration management tool that compiles an inventory into Kubernetes manifests, Terraform, documentation and other files. kadet-hub is a community catalog and is not run by the Kapitan project. kapitan.dev
Inventory: The YAML hierarchy of classes and targets that holds a project's parameters; a generator reads its settings from it. Inventory in the Kapitan docs
kadet: Kapitan's Python input type: a Python module that returns objects, which Kapitan writes as files. kadet in the Kapitan docs
Generator: A reusable kadet module that turns a block of inventory parameters into many output files, for example every resource of an operator. Each listed generator ships a manifest, kapitan-generator.yaml, and a fixture project the gate compiles.
Gate: The checks every version passes before review: secret, malware and code scans, Python errors, and a compile of the fixture project in a gVisor sandbox without network, with decoy credentials and a trace of the programs it starts. What the gate checks
Output capability: A risky kind of output a generator declares, such as privileged pods, host paths or Terraform provisioners. Undeclared ones fail the gate, and consumers decide which ones they accept.
Digest: The sha256 of a published artifact. Pinning by digest means the inventory gets exactly the reviewed content, even if a tag moves.
Attestation: A signed statement, stored by GitHub and logged in Sigstore's transparency log, that the marketplace's release workflow built and published an artifact with this digest. It says where the artifact came from, not that it is free of flaws. Verifying by hand
Index and index serial: The attested list of every published version. Its serial grows with each change; a consumer who sets index_serial refuses any older index, so a rolled-back index cannot bring back a yanked version.
Yanked: A version withdrawn by its owners or the maintainers. The catalog shows the reason instead of the inventory entry, and the consumer workflow refuses its digest.
krab: An alternative Kapitan implementation. The gate also compiles each fixture with krab and records whether the output is the same; that is information, not a requirement.