kubernetes_template_rendering 0.6.2 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7c71eb502c7b52355ee6d9040a8401a6e7937477b4ffc81b725951187340e325
-  data.tar.gz: 07e31b80f5c7c2e0d95860d10a4a73390dd919eeed86000867e151faad9f7113
+  metadata.gz: 1b1538a338a89bf830d6fa47ab6c1b08b756399fa2e923abc34fef7ba796470d
+  data.tar.gz: 5b8d03d43e2cac5ab1b0b6060006e83885adcf1f682d576a00c9eac155d4e74c
 SHA512:
-  metadata.gz: 3113be1c65d2e3f356e82b0b3388f9a090fab3945dcc9c54720146f12f9f95d8c95e7dd7fae7af0c00687aa6e557cf84c7fc6de5754f16c7e831fe101b283770
-  data.tar.gz: 64b29afd0de7680e0a8c4aa57010268bc3e1e0bb6ec502c11d91e1ac518d633371d8b1b8f7fa368cb71b73f5e89754e42fecc36cbdd56e698077064269316e0a
+  metadata.gz: 5805d53bd6d47c2dfaa86b282d98661fba87de5a7958364c04f8f2e7dda30b396fec6f4db036e81e682dcfc778e53e109c6358f898377c8daab84593400c4425
+  data.tar.gz: e630935cca259aa07afc4929aab4a8cd42e7c90c6168e64bffdcc36d9696c736ce82ba31a301093230620144ba00e31ab609c59c06115cb3972b7b44cbbea9c9

data/CHANGELOG.md

@@ -4,6 +4,19 @@ Inspired by [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 Note: this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.0] - 2026-07-23
+### Added
+- MULTI_FILE_RENDER keys and `MULTI_FILE_RENDER_NAME` values may now contain `/` to render into nested output directories (e.g. key `pr-1/app/foo` writes `<output dir>/pr-1/app/foo.yaml`); intermediate directories are created automatically. Previously such keys crashed with `Errno::ENOENT`. Names that resolve outside the output directory raise `ArgumentError` before any write. See docs/adrs/0003-nested-multi-file-output.md.
+
+## [0.7.0] - 2026-07-23
+### Added
+- `--variable-override` now supports dotted-path keys (`components.webServer.hpa.minReplicas:2`) that deep-merge into nested variables, with JSON value coercion (integers, floats, booleans, `null`, quoted strings; non-JSON values stay raw strings) and `\.` escaping for literal dots. Plain `KEY:VALUE` (no dot) behaves exactly as before: top-level key, raw string value.
+- Added `--variable-override-json '<json object>'` (repeatable), deep-merged with all other override flags in command-line order (later flags win). Use it for values containing commas or whole structures.
+- Overrides are echoed once to stdout at render start (`Variable overrides (deep-merged after definitions.yaml): {...}`). Rendered files still carry no override comment (see 0.3.0).
+
+### Changed
+- `Template#initialize` merges `variable_overrides` with `deep_merge` instead of `merge`. Behavior-identical for all previously-valid inputs (legacy override values are always strings, so no hash-vs-hash merge could occur).
+
 ## [0.6.2] - 2026-07-15
 ### Fixed
 - Fixed the `--reconcile` sweep root for entries whose `subdirectory:` nests more than one level deep (e.g. `subdirectory: exclude-argocd/auth`). The sweep root is now the entry's canonical base — `<region>/<cluster_type>/<color>` for non-SPP entries and `<region>/<cluster_type>/<color>/spp/SPP-PLACEHOLDER` for SPP entries — regardless of `subdirectory:` depth, rather than the immediate parent of the rendered output directory. Previously a nested `subdirectory:` pushed the sweep root one level too deep, so when a `subdirectory:` was renamed or nested deeper the files left at the old shallower path were siblings of the sweep root and were never swept.

data/README.md

@@ -71,6 +71,43 @@ Useful when one `--cluster_type` matches multiple sibling entries (e.g. `staging
 
 If an `--only` value matches no entry across any template directory, the gem raises with the list of valid keys so the caller can self-correct.
 
+### Variable overrides
+
+Pass `--variable-override KEY:VALUE` (repeatable) to override values from `definitions.yaml` after all per-section variables and auto-injected region/cluster vars are resolved. Overrides always win.
+
+**Legacy form (no dot in KEY):** sets a top-level key to the raw string value — exactly the pre-0.7.0 behavior. Values are never type-coerced (`deploySha:12345` stays the string `"12345"`; `enabled:true` stays `"true"`). The value is everything after the first colon (`image:registry:5000/app` → `"registry:5000/app"`). Arguments with no colon are silently ignored.
+
+```bash
+gem exec -g kubernetes_template_rendering render_templates \
+    --rendered-directory path/to/resources \
+    --variable-override deploySha:abc123 \
+    deployment/templates
+```
+
+**Dotted-path form (KEY contains `.`):** the key is split on unescaped dots into a nested path and deep-merged into variables. The value is JSON-coerced when it parses as JSON (`2` → integer, `true`/`false` → booleans, `null` → nil, `"2"` → string); otherwise the raw string is kept (`hello` → `"hello"`, `02` → `"02"`).
+
+```bash
+gem exec -g kubernetes_template_rendering render_templates \
+    --rendered-directory path/to/resources \
+    --variable-override components.webServer.hpa.minReplicas:2 \
+    deployment/templates
+```
+
+Escape literal dots in a segment with `\.` (e.g. `metadata.labels.app\.kubernetes\.io/name:foo`). Only `\.` is an escape sequence; all other backslashes — including trailing ones — are kept literally. Keys that would need a literal backslash immediately before a path-splitting dot must use `--variable-override-json` instead.
+
+**`--variable-override-json` (repeatable):** deep-merges a JSON object. Use this for values containing commas or whole arrays/objects (the legacy Array acceptor comma-splits `KEY:VALUE` arguments).
+
+```bash
+gem exec -g kubernetes_template_rendering render_templates \
+    --rendered-directory path/to/resources \
+    --variable-override-json '{"ephemeral":{"mysql":{"enabled":true}}}' \
+    deployment/templates
+```
+
+**Precedence:** all override flags are folded into one hash in command-line order via deep merge (later flags win on conflict), then deep-merged last over the fully-resolved variables.
+
+Overrides are echoed once to stdout at render start (`Variable overrides (deep-merged after definitions.yaml): {...}`). Rendered files carry no override comment (removed in [0.3.0](CHANGELOG.md#030---2026-06-24) to avoid content-free diffs on every deploy).
+
 ### Staging Partial Platforms
 
 Pass `--spp NAME` (repeatable) to expand any entry whose `definitions.yaml` name contains `SPP-PLACEHOLDER` into a per-SPP sibling output. Substitutes `SPP-PLACEHOLDER` with `NAME` and the `PLACEHOLDER` suffix with the suffix of `NAME` (everything after the last `-`), in both file paths and contents. Source mtimes are preserved.

data/docs/adrs/0003-nested-multi-file-output.md

@@ -0,0 +1,165 @@
+# Nested output directories from MULTI_FILE_RENDER keys containing `/`
+
+* Status: accepted
+* Deciders: James Ebentier, Kubernetes platform reviewers
+* Date: 2026-07-23
+
+Technical Story: [OCTO-919](https://invoca.atlassian.net/browse/OCTO-919) — nested multi-file output spike (ST-11)
+
+## Context and Problem Statement
+
+Ephemeral deploy scripts (`deploy_ephemeral.sh` in voice-agent, contact-center-agents, polaris) render a flat file set and then shuffle files into `pr-N/{app,mysql}/` directories before committing to the rendered repo. If `MULTI_FILE_RENDER` keys could contain `/` (e.g. `pr-12/app/polaris-svc`), the service-templates-jsonnet library (ST-05) could emit the final layout directly and ST-09's vendored scripts could drop the file shuffle.
+
+Keys are producer-controlled (they come from the template author's Jsonnet). A `/` in a key **currently crashes the render** because `File.write` does not create intermediate directories.
+
+**Key→filename producer** (`lib/kubernetes_template_rendering/jsonnet_template.rb:60-67`):
+
+```ruby
+def render_json_doc(json_doc, default_file_name, file_name_to_yaml_hash)
+  if multi_file_jsonnet_doc?(json_doc)
+    render_multi_file_jsonnet!(json_doc, file_name_to_yaml_hash)
+  else
+    file_name = file_name_from_object(json_doc, default: default_file_name)
+    file_name_to_yaml_hash["#{file_name}.yaml"] = with_auto_generated_yaml_comment(json_doc.to_yaml)
+  end
+end
+```
+
+Keys (and `MULTI_FILE_RENDER_NAME` values, resolved by `file_name_from_object`) pass through **untouched** into the returned hash — no Jsonnet-side change is needed for nested paths.
+
+**File-writing site** (`lib/kubernetes_template_rendering/resource.rb:34-50`):
+
+```ruby
+def write_template(args)
+  print_status
+
+  # If a Hash is returned, that means this is a multi-file template, meaning we need to iterate over the hash.
+  # Else a String is returned and we can write it directly to the output file.
+  rt = rendered_template(args)
+
+  if args.render_files?
+    if rt.is_a?(Hash)
+      rt.each do |filename, contents|
+        File.write(output_path(filename), contents)
+      end
+    else
+      File.write(output_path(@output_filename), rt)
+    end
+  end
+end
+```
+
+**Path join** (`lib/kubernetes_template_rendering/resource.rb:68-70`):
+
+```ruby
+def output_path(filename)
+  File.join(@output_directory, filename)
+end
+```
+
+`File.write` on the joined path is where `Errno::ENOENT` fires for nested keys. This is the single write path for all multi-file output; the non-hash branch's `@output_filename` derives from the template basename and can never contain `/`.
+
+### Executable ENOENT evidence
+
+Before this change, `spec/kubernetes_template_rendering/resource_spec.rb` drove `Resource#render` with a hash key `pr-1/app/foo.yaml` and observed:
+
+```
+Errno::ENOENT: No such file or directory @ rb_sysopen - .../pr-1/app/foo.yaml
+```
+
+No working template can emit `/`-bearing keys today, so enabling nested keys is not a backward-compatibility break.
+
+## Decision Drivers
+
+* Drop the `pr-N/{app,mysql}` file-shuffle from ephemeral deploy scripts once producers can emit nested keys (ST-05 / ST-09).
+* Keys are producer-controlled; the gem should not rewrite or reject `/` in keys beyond path-safety containment.
+* Crash today implies zero live consumers of nested keys — safe to enable without a migration.
+* Reconcile and prune must remain correct for nested subtrees (marker-based sweep posture from ADR-0001/0002).
+
+## Considered Options
+
+* **Option A — Enable nested keys at the write site with a containment guard.** Add `FileUtils.mkdir_p` before `File.write` and reject `..` escapes in `output_path`.
+* **Option B — Keep flat output and the script shuffle.** Document the blocker; pin ENOENT regression spec; no `lib/` change.
+* **Option C — Gate nested keys behind a new CLI flag.** Rejected: keys already crash today; a flag adds surface for no safety gain.
+
+## Decision Outcome
+
+Chosen option: **Option A (implement nested output)**, because all four "small" bar conditions are satisfied:
+
+1. **Confined change:** Only `Resource#write_template`, `Resource#output_path`, and `require "fileutils"` in `resource.rb`, plus specs/fixtures. No changes to `cli.rb`, `cli_arguments.rb`, `jsonnet_template.rb`, `resource_set.rb`, `template_directory_renderer.rb`, or `reconciler.rb`.
+2. **Suite stability:** Full existing spec suite passes with zero expectation changes to pre-existing examples.
+3. **Containment guard:** Four lines in `output_path`, matching `template_directory_renderer.rb:118-124` posture.
+4. **Interplay:** `--prune`, `--reconcile`, and SPP expansion require documentation only (see Interplay analysis).
+
+### Positive Consequences
+
+* ST-05 may emit `pr-<prId>/{app,mysql}/...` keys after gem release and ST-01's Gemfile pin bump from `0.6.2`.
+* ST-09 scripts can drop the file shuffle once the fleet converges; they are written to tolerate both layouts until then.
+* Flat-output consumers (e.g. `cleanup.sh` scanning `pr-*-application.yaml` at the color-folder root) are unaffected until a producer opts in.
+
+### Negative Consequences
+
+* A key `foo` and key `foo/bar` in one template can coexist as `foo.yaml` and `foo/` directory on POSIX — legal, no special handling.
+* Nested keys are unusable by ST-05 until (a) this gem version is published to rubygems.org and (b) ST-01's `Gemfile` pin is deliberately bumped.
+
+## Interplay analysis
+
+### `--prune`
+
+`ResourceSet#prune_directory` (`resource_set.rb:248-257`) runs `FileUtils.rm_rf(directory)` on the whole output directory before rendering. Nested subtrees are removed with the parent directory; **no code change required**.
+
+### `--reconcile`
+
+`Reconciler#collect_stale_files` walks with `Find.find(root)` (recursive — nested files are visited). `remove_empty_dirs` globs `File.join(root, "**", "*/")` deepest-first. Freshly written nested files (mtime > marker) survive; stale nested files from removed keys are deleted; emptied nested directories are removed. **No Reconciler change required.**
+
+### SPP expansion
+
+`PlaceholderExpander` already handles nested directories — fixture `spec/fixtures/placeholder_expander/source/SPP-PLACEHOLDER/nested-SPP-PLACEHOLDER/service.yaml` proves rendered trees may nest. **No change required.**
+
+### DeployGroupedResource
+
+`DeployGroupedResource#filename_for_deploy_group` builds flat `<basename>-<group>-deploy.yaml` output filenames. **Unaffected.**
+
+### print_status cosmetics
+
+`Resource#print_status` prints `File.basename(output_path(@output_filename))` — the template's default name, not per-key names. **Non-issue for hash-key nesting.**
+
+## Path safety
+
+`File.join` + `File.write` would follow `..` out of the output directory without a guard (`File.expand_path("dir/../evil", "/base")` → `/base/evil`). `output_path` applies two layers of containment before any write, then **returns the same lexically expanded path that was validated** (not the raw `File.join` result):
+
+1. **Lexical check** — `File.expand_path` on the joined path must stay under the expanded output directory (catches `..` segments and absolute-looking keys after `File.join` neutralization).
+2. **Filesystem check** — walk each existing path component from the output directory toward the target file's parent directory; reject if any component is a symlink, and verify the resolved parent directory (via `File.realpath` on existing segments) still lies under the real output directory. This closes a bypass where a committed symlink inside a `*-kubernetes` checkout could let a producer-controlled nested key write outside the render sandbox — `File.expand_path` alone never resolves symlinks.
+
+**Return-value alignment:** an earlier implementation validated `expanded` but returned the raw `path` from `File.join`. That reopened an escape when a key contained both `..` and a symlink segment (e.g. `a/../b/foo.yaml` with `a` → outside): lexical expansion folds the key to `<output_dir>/b/foo.yaml` (passing all checks), but `File.write` on the unvalidated raw path resolves the symlink before applying `..`, landing outside the sandbox. The fix is to return `expanded` so the write target exactly matches what was validated. Redundant-but-safe segments (`a/./b`, `a//b`) normalize away via `File.expand_path` without changing the logical destination.
+
+Absolute-looking keys (`/etc/passwd`) are neutralized by `File.join` semantics (`File.join("dir", "/etc/passwd")` → `"dir/etc/passwd"`, not an absolute path) and then subject to the same guards.
+
+**Per-key atomicity:** for multi-file hashes, each key is validated immediately before its own write. A later key that fails containment does not roll back files already written for earlier keys in the same hash.
+
+## Pros and Cons of the Options
+
+### Option A — Enable nested keys at write site
+
+* Good, because change is minimal (~10 lines in one file).
+* Good, because Jsonnet producer already passes keys through unchanged.
+* Good, because reconcile/prune/SPP already handle nested trees.
+* Bad, because gem release + ST-01 pin bump are prerequisites before library adoption.
+
+### Option B — Defer (flat output only)
+
+* Good, because zero gem churn.
+* Bad, because ephemeral scripts keep the file shuffle indefinitely.
+* Bad, because nested keys remain a footgun (ENOENT) for any author who tries them.
+
+### Option C — CLI flag
+
+* Good, because explicit opt-in.
+* Bad, because keys already crash — no producer uses nested keys today.
+* Bad, because adds CLI surface and documentation burden for no safety gain over Option A.
+
+## Links
+
+* Depends on [OCTO-918](https://invoca.atlassian.net/browse/OCTO-918) (ST-10) for same-repo sequencing only.
+* Consumed by ST-05 (library file-key derivation) and ST-09 (scripts quartet) after gem release.
+* Related: [ADR-0001](0001-strict-rendering-paths-for-stale-resource-deletion.md), [ADR-0002](0002-spp-aware-reconcile-scopes-and-only-guard.md)

data/lib/kubernetes_template_rendering/cli.rb

@@ -1,7 +1,10 @@
 # frozen_string_literal: true
 
+require "json"
+
 require_relative "template_directory_renderer"
 require_relative "cli_arguments"
+require_relative "variable_override_parser"
 
 module KubernetesTemplateRendering
   class CLI
@@ -43,21 +46,30 @@ module KubernetesTemplateRendering
             args.only << name
           end
 
-          op.on("--variable-override=KEY:VALUE", "override a variable value set within definitions.yaml", Array) do |overrides|
+          op.on("--variable-override=KEY:VALUE", "override a variable value set within definitions.yaml (KEY may be a dotted path, e.g. components.webServer.hpa.minReplicas:2; escape literal dots as \\.)", Array) do |overrides|
             args.variable_overrides ||= {} # Initialize as a Hash
             overrides.each do |override|
-              key, value = override.split(":", 2)
-              args.variable_overrides[key] = value if key && value
+              VariableOverrideParser.merge_override!(args.variable_overrides, override)
             end
           end
 
+          op.on("--variable-override-json=JSON", "deep-merge a JSON object of variable overrides (repeatable; later flags win)") do |json|
+            args.variable_overrides ||= {}
+            VariableOverrideParser.merge_json!(args.variable_overrides, json)
+          end
+
           op.on("-h", "--help") do
             puts op
             exit
           end
         end
 
-        parser.parse!(options)
+        begin
+          parser.parse!(options)
+        rescue VariableOverrideParser::ParseError => ex
+          STDERR.puts(ex.message)
+          exit(1)
+        end
         args.template_directory = options.first
         args.spps = (args.spps || []).uniq
         args.only = (args.only || []).uniq
@@ -80,6 +92,10 @@ module KubernetesTemplateRendering
           exit(1)
         end
 
+        if args.variable_overrides&.any?
+          puts "Variable overrides (deep-merged after definitions.yaml): #{JSON.generate(args.variable_overrides)}"
+        end
+
         [renderer_from_args(args), args]
       end
 

data/lib/kubernetes_template_rendering/resource.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "fileutils"
 require "pathname"
 require_relative "color"
 require_relative "erb_template"
@@ -41,7 +42,9 @@ module KubernetesTemplateRendering
       if args.render_files?
         if rt.is_a?(Hash)
           rt.each do |filename, contents|
-            File.write(output_path(filename), contents)
+            path = output_path(filename)
+            FileUtils.mkdir_p(File.dirname(path))
+            File.write(path, contents)
           end
         else
           File.write(output_path(@output_filename), rt)
@@ -66,7 +69,43 @@ module KubernetesTemplateRendering
     end
 
     def output_path(filename)
-      File.join(@output_directory, filename)
+      path = File.join(@output_directory, filename)
+      base = File.expand_path(@output_directory)
+      expanded = File.expand_path(path)
+
+      unless expanded == base || expanded.start_with?(base + File::SEPARATOR)
+        raise ArgumentError, "output filename #{filename.inspect} escapes output directory #{@output_directory}"
+      end
+
+      validate_resolved_containment!(File.dirname(expanded), base, filename)
+      expanded
+    end
+
+    def validate_resolved_containment!(target_dir, base, filename)
+      base_real = realpath_or_expand(base)
+      current = base_real
+      Pathname.new(target_dir).relative_path_from(Pathname.new(base)).each_filename do |part|
+        candidate = File.join(current, part)
+        if File.symlink?(candidate)
+          raise ArgumentError, "output filename #{filename.inspect} escapes output directory #{@output_directory}"
+        end
+
+        if File.exist?(candidate)
+          current = File.realpath(candidate)
+        else
+          break
+        end
+      end
+
+      return if current == base_real || current.start_with?(base_real + File::SEPARATOR)
+
+      raise ArgumentError, "output filename #{filename.inspect} escapes output directory #{@output_directory}"
+    end
+
+    def realpath_or_expand(path)
+      File.realpath(path)
+    rescue Errno::ENOENT
+      File.expand_path(path)
     end
 
     def template_filename(template_path)

data/lib/kubernetes_template_rendering/template.rb

@@ -4,6 +4,7 @@ require "ostruct"
 require "open3"
 require "shellwords"
 require "yaml"
+require "active_support/core_ext/hash/deep_merge"
 
 # This is a base class for all Templates. Derived classes must implement the render method.
 module KubernetesTemplateRendering
@@ -12,7 +13,7 @@ module KubernetesTemplateRendering
 
     def initialize(template_path, variables, source_repo: nil, variable_overrides: {})
       @template_path      = template_path
-      @variables          = variables.merge(variable_overrides)
+      @variables          = variables.deep_merge(variable_overrides)
       @source_repo        = source_repo
       @variable_overrides = variable_overrides
     end

data/lib/kubernetes_template_rendering/variable_override_parser.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "json"
+require "active_support/core_ext/hash/deep_merge"
+
+module KubernetesTemplateRendering
+  # Parses --variable-override / --variable-override-json values into (possibly nested)
+  # override fragments and deep-merges them, in command-line order, into one overrides hash.
+  #
+  # Key forms:
+  #   * Legacy: KEY contains no "." -> top-level key, value kept as the raw string
+  #     (exactly the pre-0.7.0 behavior; never type-coerced).
+  #   * Dotted: KEY contains "." -> split on unescaped dots into a nested path ("\." is a
+  #     literal dot within a segment). The value is JSON-coerced when it parses as JSON
+  #     (2 -> Integer, true/false -> booleans, null -> nil, "2" -> String), else kept raw.
+  class VariableOverrideParser
+    class ParseError < StandardError; end
+
+    UNESCAPED_DOT = /(?<!\\)\./.freeze
+
+    class << self
+      # Deep-merges a KEY:VALUE override fragment into +overrides+.
+      #
+      # @param overrides [Hash] accumulated overrides hash (mutated in place)
+      # @param raw [String] raw KEY:VALUE argument
+      # @return [Hash] +overrides+ after merging
+      def merge_override!(overrides, raw)
+        key, value = raw.split(":", 2)
+        return overrides if key.nil? || value.nil? # preserve legacy silent-skip of colon-less args
+
+        overrides.deep_merge!(fragment_for(key, value))
+      end
+
+      # Deep-merges a JSON object string into +overrides+.
+      #
+      # @param overrides [Hash] accumulated overrides hash (mutated in place)
+      # @param json [String] JSON object string
+      # @return [Hash] +overrides+ after merging
+      # @raise [ParseError] when +json+ is invalid or not a JSON object
+      def merge_json!(overrides, json)
+        fragment =
+          begin
+            JSON.parse(json)
+          rescue JSON::ParserError => ex
+            raise ParseError, "--variable-override-json value is not valid JSON: #{ex.message}"
+          end
+        fragment.is_a?(Hash) or raise ParseError, "--variable-override-json value must be a JSON object, got #{fragment.class}: #{json.inspect}"
+        overrides.deep_merge!(fragment)
+      end
+
+      private
+
+      def fragment_for(key, value)
+        if key.include?(".")
+          nest(path_segments(key), coerce(value))
+        else
+          { key => value } # legacy: literal key, raw string value
+        end
+      end
+
+      def path_segments(key)
+        segments = key.split(UNESCAPED_DOT, -1)
+        segments.none?(&:empty?) or
+          raise ParseError, "--variable-override key #{key.inspect} has an empty path segment (leading, trailing, or doubled '.')"
+        segments.map { |segment| segment.gsub("\\.", ".") }
+      end
+
+      def nest(segments, value)
+        segments.reverse.reduce(value) { |acc, segment| { segment => acc } }
+      end
+
+      def coerce(value)
+        JSON.parse(value)
+      rescue JSON::ParserError
+        value
+      end
+    end
+  end
+end

data/lib/kubernetes_template_rendering/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module KubernetesTemplateRendering
-  VERSION = "0.6.2"
+  VERSION = "0.8.0"
 end

data/mkdocs.yml

@@ -4,6 +4,7 @@ site_description: "A light weight gem used to render Kubernetes manifest templat
 nav:
 - Introduction: README.md
 - Change Log: CHANGELOG.md
+- Nested Output Decision: adrs/0003-nested-multi-file-output.md
 
 plugins:
   - techdocs-core

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kubernetes_template_rendering
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.8.0
 platform: ruby
 authors:
 - Octothorpe
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-15 00:00:00.000000000 Z
+date: 2026-07-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -87,6 +87,7 @@ files:
 - docs/adrs/0000-template.md
 - docs/adrs/0001-strict-rendering-paths-for-stale-resource-deletion.md
 - docs/adrs/0002-spp-aware-reconcile-scopes-and-only-guard.md
+- docs/adrs/0003-nested-multi-file-output.md
 - exe/render_templates
 - lib/kubernetes_template_rendering.rb
 - lib/kubernetes_template_rendering/cli.rb
@@ -101,6 +102,7 @@ files:
 - lib/kubernetes_template_rendering/resource_set.rb
 - lib/kubernetes_template_rendering/template.rb
 - lib/kubernetes_template_rendering/template_directory_renderer.rb
+- lib/kubernetes_template_rendering/variable_override_parser.rb
 - lib/kubernetes_template_rendering/version.rb
 - mkdocs.yml
 - sig/kubernetes_template_rendering.rbs