Kapitan generator releases, 12 to 18 October 2026

Versions published on kadet-hub from 12 to 18 October 2026, each through the gate and signed. The generator page shows each version's output diff against the version before it, its SBOM and the command that verifies it.

argocd

argocd 1.0.3

Built for Argo CD 3.5.5, a bug fix release whose Application, ApplicationSet and AppProject CRDs are unchanged from 3.5.4. Rendered output is unchanged.

argocd 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

argocd 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

calico

calico 1.1.3

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

calico 1.1.2

Namespaced projectcalico.org/v3 resources without their own namespace get the namespace of the target being compiled. Before, they could get the default namespace of another target compiled earlier in the same Kapitan worker, so the output depended on target order.

calico 1.1.0

• Renders the projectcalico.org/v3 NetworkPolicy, GlobalNetworkPolicy, NetworkSet, GlobalNetworkSet, IPPool, BGPPeer and BGPConfiguration from new sections under parameters.generators.calico, with their Calico 3.33.0 schemas. They come from the calico-resources generator, which is no longer listed: move generators.calico_resources to generators.calico and compile lib/calico. Output keys and rendered documents are unchanged; the Installation is rendered in those targets as well.

certmanager

certmanager 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

certmanager 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

cilium

cilium 1.0.3

Built for Cilium 1.20.3. The schemas and CRDs of the four kinds it renders are unchanged from 1.20.2; of the Cilium CRDs only CiliumLocalRedirectPolicy changed, which the generator does not render. Rendered output is unchanged.

cilium 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

cilium 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

cloudnative-pg

cloudnative-pg 1.0.1

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

cloudnative-pg 1.0.0

First release on kadet-hub. Targets CloudNativePG 1.30.1 and the Barman Cloud Plugin 0.15.1 and ships their CRD schemas under schemas/ for QA-7. PodMonitors come from the prometheus-operator generator; the README has the inventory snippet.

crossplane

crossplane 1.0.1

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

crossplane 1.0.0

First release on kadet-hub. Renders Crossplane v2 Providers, Functions, CompositeResourceDefinitions (apiextensions.crossplane.io/v2), Compositions and ProviderConfigs; ships the CRD schemas of Crossplane 2.4.2 and of the aws.m.upbound.io ProviderConfigs of Crossplane Provider AWS 2.9.0 for QA-7. Claims are not rendered, since v2 XRDs do not support them.

docker

docker 1.0.1

apt package lists use a cache mount instead of rm -rf; 1.0.0 was tagged but never listed.

• apt-get installs run with --mount=type=cache,target=/var/cache/apt,sharing=locked and --mount=type=cache,target=/var/lib/apt/lists,sharing=locked (pattern from https://docs.docker.com/build/cache/optimize/#use-cache-mounts) and no longer delete /var/lib/apt/lists. Builds with apt packages now need BuildKit.

external-secrets

external-secrets 1.0.4

Built for External Secrets Operator 2.12.0. The SecretStore and ClusterSecretStore schemas and CRDs gain the Conjur auth.azure, auth.gcp and auth.iam authenticators; nothing was removed or renamed, and the ExternalSecret and ClusterExternalSecret schemas are unchanged. Provider blocks pass through as before, so the new authenticators work without a generator change. Rendered output is unchanged.

external-secrets 1.0.3

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

external-secrets 1.0.2

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

flux

flux 1.0.1

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

flux 1.0.0

First release on kadet-hub. Built for Flux 2.9.6 (source-controller 1.9.6, kustomize-controller 1.9.6, helm-controller 1.6.5); ships the CRD schemas of those releases under schemas/, which the kadet-hub gate validates the compiled output against (QA-7).

grafana

grafana 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

grafana 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

ironcore

ironcore 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

ironcore 1.0.0

First release on kadet-hub, migrated from kapitan-generators.

• Ships the JSON Schemas of all eight kinds from the generated OpenAPI v3 documents of IronCore v0.8.0 (QA-7). IronCore has no CRDs, so the upstream schema tool cannot regenerate them.
• LoadBalancer type, VirtualIP and NATGateway ipFamily and LoadBalancer ipFamilies have no default any more; the schema check fails without them.
• ipFamilies of NetworkInterfaces and LoadBalancers is derived from ips when unset; an ephemeral IP without ipFamily fails the compile.
• A NetworkInterface without ips no longer gets ipFamilies: [IPv4] and ips: [], which the API server rejects.
• Machine power is no longer set to On; the API server defaults it.
• Removed image_pull_secret_ref (Volume), target_ref (VirtualIP) and incoming_peerings (Network): not a v0.8.0 field, a UID reference, and controller-written.
• Reference shorthands pass a dict through unchanged; peerings, LoadBalancer ports and Machine attachments keep keys the generator does not know.
• providerID is accepted in camelCase like the other flat keys.
• The flat-key collision warning reads "Flat key '' overrides spec passthrough '' for resource ''".

k3d

k3d 1.0.0

First release on kadet-hub, migrated from kapitan-generators.

• Removed the compile-time jsonschema validation and the jsonschema import; the gate checks the output against the shipped k3d v5.9.0 schema (QA-7), and krab can now compile the generator.
• Removed an unused yaml import.

keda

keda 1.0.3

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

keda 1.0.2

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

keycloak

keycloak 1.0.3

Built for Keycloak Operator 26.8.1. The CRDs and their JSON Schemas are unchanged from 26.8.0, as is the operator code the generator's defaults rely on. Rendered output is unchanged.

keycloak 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

keycloak 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

kind

kind 1.0.0

First release on kadet-hub, migrated from kapitan-generators.

• Built for kind v0.33.0.
• New kubernetes_version key on clusters and nodes: resolves to the digest-pinned kindest/node image from the kind v0.33.0 release notes.
• New cluster spec passthrough for kind fields without a flat key (kubeadmConfigPatches, networking.dnsSearch). Flat keys override it and log a warning.
• networking.dns_domain removed: kind v0.33.0 has no dnsDomain field and rejects the file. The key is now dropped with a warning.
• The JSON Schema check at compile time is removed. Its schema was hand-written and kind publishes none, so no schema ships and the kadet-hub gate does not validate the output (QA-7).

kmcp

kmcp 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

kmcp 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

kmcp 1.0.0

First release on kadet-hub, migrated from kapitan-generators.

• spec.httpTransport passthrough fields such as tls survive transport_type: http; before, the flat keys replaced the whole block.
• spec.transportType and spec.deployment.port from the passthrough now feed the defaults: http from spec still gets targetPort, and the derived targetPort follows a spec port.
• The collision warning names the overridden field (deployment.image, http_transport.target_path, ...) and no longer fires when deployment and spec.deployment set different fields.
• Ships the upstream kmcp v0.4.0 CRD schema under schemas/ for QA-7.

kserve

kserve 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

kserve 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

kserve 1.0.0

First release on kadet-hub, migrated from kapitan-generators.

• LLMInferenceService and LLMInferenceServiceConfig are emitted as serving.kserve.io/v1alpha2, the storage version of KServe 0.21.0. model.criticality does not exist in v1alpha2 and is dropped with a warning.
• The first ServingRuntime or ClusterServingRuntime container without a name is named kserve-container, the container the controller merges the InferenceService model into.
• Model format names and TrainedModel framework are no longer checked against a fixed list; the CRD takes any string.
• LocalModelNode is no longer rendered; the LocalModelCache controller manages it.
• InferenceGraph steps pass through with all CRD keys (name, dependency, mapPredictionsToInstances); router type Router and node routes, which the CRD does not define, are removed.
• canary_traffic_percent works on transformer and explainer; ClusterStorageContainer takes disabled; scale metric gpu, not in the CRD, is rejected.
• A derived LocalModelNodeGroup PVC gets storageClassName: "" when the PV has no class; model.lora.adapters[].criticality is dropped with a warning like model.criticality.
• Explainer blocks alibi and aix360, which the v0.21.0 ExplainerSpec does not define, are removed; art remains.
• Ships the KServe 0.21.0 CRD schemas under schemas/; the gate validates the compiled output against them (QA-7).

kubernetes

kubernetes 1.2.0

New standalone sections for Namespaces and RBAC without a workload, so they no longer go through manifests with api_version, kind and body:

• namespaces.<name>: a Namespace with labels and annotations.
• rbac.<name>: one role with its bindings. rules make a ClusterRole, or a Role with namespace; cluster_role or role bind an existing one instead. A ClusterRole is bound by a RoleBinding in each of namespaces and by a ClusterRoleBinding with cluster_wide; subjects come from service_accounts (<namespace>/<name>), groups, users and subjects. Contradicting keys fail the compile.

Output file names match what manifests wrote for the same kinds, so moving an entry over keeps its file. Existing output is unchanged.

kubernetes 1.1.1

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

kubernetes 1.1.0

The Gateway services shorthand takes redirect_status_code for the HTTP to HTTPS redirect: 301 (the default, output without the key is unchanged), 302, 303, 307 or 308. Any other value fails the compile.

kubernetes 1.0.2

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

kubernetes 1.0.1

README: ingress-nginx to Gateway API mapping. The rendered output is unchanged.

kubernetes 1.0.0

First release on kadet-hub, migrated from kapitan-generators.

• ServiceMonitor, PodMonitor and PrometheusRule are no longer rendered; service_monitors, prometheus_rules and generators.kubernetes.pod_monitors log a warning pointing to the prometheus-operator generator.
• TCPRoute, UDPRoute and TLSRoute are rendered as gateway.networking.k8s.io/v1, their storage version in Gateway API 1.6; the v1alpha2 and v1alpha3 versions are deprecated and not served by the standard channel.
• A Gateway listener without allowed_routes.namespaces_from now admits only the namespaces of the routes the generator renders for it (Same or a namespace Selector) instead of All. Routes rendered outside this Gateway's inventory need allowed_routes set.

Full changelog

kubevirt

kubevirt 1.1.1

Built for KubeVirt 1.9.1. Its CRD validations are unchanged from 1.9.0, so the shipped schemas and the rendered output stay the same. The fixtures use the cirros-container-disk-demo:v1.9.1 image, the same digest as v1.9.0.

kubevirt 1.1.0

Adds csi, the KubeVirt CSI driver in its split deployment at upstream commit 3a1a099: role: infra renders the controller with its RBAC into the namespace of a tenant cluster's VMs, optionally restricted to allowed_storage_classes with snapshot_classes; role: tenant renders the node plugin, CSIDriver, StorageClasses, VolumeSnapshotClasses, and the ServiceAccount, RBAC and token Secret for the controller's tenant kubeconfig. csi.image is required, because upstream publishes only a moving latest tag; the README names the digest to mirror. The sidecars are pinned by tag and digest, csi-snapshotter at v8.7.0 instead of upstream's v4.2.1, which cannot create snapshots with the external-snapshotter v8 CRDs. The README's CSI defaults list where the output differs from upstream's manifests and why.

Ships the VolumeSnapshotClass CRD and schema of the CSI driver and the Kubernetes 1.37.1 schemas of the built-in kinds it renders.

kubevirt 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

kyverno

kyverno 1.1.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

kyverno 1.1.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

kyverno 1.1.0

• Renders the policies.kyverno.io kinds of Kyverno 1.19.1 at their storage version v1beta1: ValidatingPolicy, MutatingPolicy, GeneratingPolicy and DeletingPolicy with their namespaced variants under validating_policies, namespaced_validating_policies, mutating_policies, namespaced_mutating_policies, generating_policies, namespaced_generating_policies, deleting_policies and namespaced_deleting_policies, and PolicyException under cel_policy_exceptions. Their schemas ship under schemas/policies.kyverno.io/.
• match_kinds on these kinds expands to matchConstraints.resourceRules for the GA built-in kinds of Kubernetes 1.37.1. No Kyverno defaults are added; the README lists them with sources.
• ClusterPolicy and Policy render the deprecated failure_policy and webhook_timeout_seconds as webhookConfiguration.failurePolicy and webhookConfiguration.timeoutSeconds, and validation_failure_action as each validate rule's failureAction, unless a validate rule sets its own failureAction or the policy has validation_failure_action_overrides or a verifyImages rule. Output changes only for inventories that set these keys, with the same effect in Kyverno.
• failure_policy or webhook_timeout_seconds together with the same field in webhook_configuration now stops the compile; Kyverno's admission already rejected such a policy.
• generate_existing_on_policy_update renders as generateExisting in each generate rule that sets none. 1.0.0 emitted spec.generateExistingOnPolicyUpdate, which Kyverno 1.19.1 rejects even when it is false.
• A key that a policies.kyverno.io kind does not take, such as match_kinds on a PolicyException, stops the compile.

linkerd

linkerd 1.0.2

Built for Linkerd edge-26.10.1. The linkerd-crds chart is unchanged since edge-26.6.3, so the shipped schemas and the rendered output stay the same.

linkerd 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

loki

loki 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

multus

multus 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

multus 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

opentelemetry-operator

opentelemetry-operator 1.1.0

Built for OpenTelemetry Operator 0.161.0. The OpenTelemetryCollector and TargetAllocator schemas and CRDs gain imagePullSecrets and revisionHistoryLimit, also in the collector's embedded targetAllocator. New flat keys image_pull_secrets and revision_history_limit on collectors and TargetAllocators set them. Rendered output of existing inventories is unchanged.

opentelemetry-operator 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

opentelemetry-operator 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

prometheus-operator

prometheus-operator 1.1.3

Ships the Kubernetes 1.37.1 ServiceAccount, ClusterRole and ClusterRoleBinding schemas instead of 1.35.0, matching the kube-apiserver v1.37.1 the gate dry-runs against (QA-10). Apart from descriptions, the only schema change is that ClusterRoleBinding roleRef.apiGroup is no longer required; the generator still sets it. Rendered output is unchanged.

prometheus-operator 1.1.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

prometheus-operator 1.1.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

rabbitmq

rabbitmq 1.0.3

Built for RabbitMQ Cluster Operator 2.23.1 and Messaging Topology Operator 1.20.4. The Federation schema and CRD gain the upstream default reconnectDelay: 1; the other rabbitmq.com schemas and CRDs are unchanged. ConfigMaps and Secrets are checked against the Kubernetes 1.37.1 schemas instead of 1.35.0, which differ only in a ConfigMap description. Rendered output is unchanged.

rabbitmq 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

rabbitmq 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

rook-ceph

rook-ceph 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

rook-ceph 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

rook-ceph 1.0.0

First release on kadet-hub, migrated from kapitan-generators.

• Targets Rook 1.21.0 and ships its CRD schemas (deploy/examples/crds.yaml) under schemas/ for QA-7, replacing the CRDs-catalog schemas of the previous repository.
• CephCluster defaults dataDirHostPath to /var/lib/rook, the value of Rook's example cluster, and fails the compile without cephVersion.image unless external.enable is set.
• CephFilesystem defaults metadataServer to one active MDS with an active standby, CephNFS server.active to 1 and CephRBDMirror count to 1; the CRD requires these fields.
• A rados flat key on CephNFS is ignored with a warning; Rook deprecated the field and overwrites it.

strimzi

strimzi 1.0.1

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

strimzi 1.0.0

First release on kadet-hub.

• Built for Strimzi 1.3.0 (kafka.strimzi.io/v1). Ships the Kafka, KafkaNodePool, KafkaTopic and KafkaUser CRD schemas of this release (Apache-2.0) under schemas/; the kadet-hub gate validates the compiled output against them (QA-7).
• Kafka entries fan out into their KafkaNodePools; the replication settings of spec.kafka.config are derived from the broker count.
• Secure defaults: one internal TLS listener with mTLS authentication and simple authorization; no plain or external listener unless the inventory lists it; authorization: none and entity_operator: false opt out.
• Shorthands for storage, authentication, authorization and ACLs, documented with their sources in the README. Precedence, lowest first: generator defaults, spec, flat keys and shorthands; a flat key that overrides spec logs a warning.

talos

talos 1.1.0

Built for Talos 1.14.3.

• The default installer image moves to factory.talos.dev/metal-installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:v1.14.3, the one talosctl gen config 1.14.3 writes. The default Kubernetes images stay at 1.37.1, the default of Talos 1.14.3.
• machine.time.servers that are all PTP devices (/dev/...) become TimeSyncConfig ptp.devices instead of ntp.servers, which Talos 1.14.3 rejects for them. machine.time with both NTP servers and PTP devices stays in the v1alpha1 document with a warning, because TimeSyncConfig takes either ntp or ptp.
• Ships the Talos 1.14.3 schemas and the Kubernetes 1.37.1 Secret schema. Upstream config.schema.json and the Secret schema are unchanged against Talos 1.14.2 and Kubernetes 1.35.0, so validation is unchanged.

talos 1.0.0

First release on kadet-hub, migrated from kapitan-generators.

• Built for Talos 1.14.2. Node outputs are multi-document configs: the v1alpha1 document keeps only the fields Talos 1.14 has not deprecated, and the deprecated ones are written as their replacement kinds (HostnameConfig, LinkConfig, UnattendedInstallConfig, KubeletConfig, KubeAPIServerConfig and others; see the README for the mapping). The inventory keys stay the same. Blocks without a multi-document equivalent (install kernel arguments and extensions, kubelet extraMounts, control plane extraVolumes, machine.disks, interface deviceSelector, files outside /etc/cri/conf.d/*.part, cluster.discovery with the Kubernetes registry, API server authentication and authorization flags) stay in the v1alpha1 document with a warning.
• Changed meaning: certificate and key values for the API server, aggregator and service account CAs and registry TLS are decoded from base64 to PEM; Kapitan refs for them must hold PEM. Interfaces in link documents stop Talos from running DHCP on unconfigured links. persist is ignored.
• The default installer image moves from ghcr.io/siderolabs/installer:v1.13.0 to factory.talos.dev/metal-installer/376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba:v1.14.2, the one talosctl gen config 1.14.2 writes; ghcr.io/siderolabs/installer is no longer published from Talos 1.14.
• A hostname or ip shorthand that overrides a nested value logs Flat key '<key>' overrides spec passthrough '<path>' for resource '<node>'.
• Ships the Talos 1.14.2 schema split per multi-document kind (MPL-2.0, notice in schemas/core/NOTICE) and the Kubernetes 1.35.0 Secret schema; the kadet-hub gate validates the Talos documents and the userdata Secret against them (QA-7). The v1alpha1 base document has no apiVersion/kind and is not schema-checked.
• /etc/cri/conf.d/<name>.part files become CRICustomizationConfig documents named <name>.

terraform-aws

terraform-aws 0.1.2

• Pins hashicorp/aws 6.69.1 instead of 6.68.0 in providers.tf.json and ships its provider schema extract under schemas/terraform/, so the catalog shows "Built for hashicorp/aws 6.69.1". The release notes of 6.69.0 and 6.69.1 change none of the 15 resource types the generator emits; between the two extracts only the provider's endpoints block gains pricingplanmanager. Rendered output differs only in the provider version.

terraform-azurerm

terraform-azurerm 0.1.2

• Pins hashicorp/azurerm 5.10.0 instead of 5.9.0 in providers.tf.json and ships its provider schema extract under schemas/terraform/, so the catalog shows "Built for hashicorp/azurerm 5.10.0". The provider block and the schemas of the seven resource types the generator emits are the same in both versions. Of the 5.10.0 release notes only the azurerm_subnet fix for a plan difference when service_endpoint entries are reordered touches the output, and the generator emits at most one entry. storage_container_resource.go is unchanged, so containers still go through Azure Resource Manager. Rendered output differs only in the provider version.

terraform-google

terraform-google 0.1.2

• Pins hashicorp/google 8.7.0 instead of 8.6.0 in providers.tf.json and ships its provider schema extract under schemas/terraform/, so the catalog shows "Built for hashicorp/google 8.7.0". The 8.7.0 release notes change none of the arguments the generator sets: the google_compute_subnetwork fix forces recreation on changes to ipv6_access_type, ip_collection or external_ipv6_prefix, which the generator does not emit. Between the two extracts the provider block gains gemini_data_analytics_custom_endpoint and three subnetwork IPv6 descriptions change. Rendered output differs only in the provider version.

thanos

thanos 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

thanos 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

velero

velero 1.0.2

Ships the CRDs of the custom resources it renders under schemas/<group>/crds/, so the kadet-hub gate dry-runs them on a kube-apiserver (QA-11). Rendered output is unchanged.

velero 1.0.1

Fails the compile when metadata.name is not a valid label value (over 63 characters), instead of rendering output the API server rejects.

Originally published at kadet-hub.org.