kapitan 0.35.2.dev20__tar.gz → 0.35.2.dev22__tar.gz

kapitan-0.35.2.dev22/.github/workflows/pex-build-upload.yml

@@ -0,0 +1,91 @@
+---
+name: PEX Build and Upload
+
+on:
+  workflow_dispatch:
+  workflow_run:
+    workflows:
+      - Publish Python Package to PyPI
+    types:
+      - completed
+
+jobs:
+  pex_build_publish:
+    runs-on: ubuntu-latest
+    # For workflow_run: only run when the upstream PyPI publish succeeded.
+    # For workflow_dispatch: always run (manual trigger).
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    permissions:
+      # Required for softprops/action-gh-release to upload PEX + checksum
+      # assets to the GitHub release page. Only actually used when the tag
+      # upload condition below evaluates to true (release tags only).
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Determine release tag
+        id: tag
+        run: |
+          # For workflow_run, github.ref is the default branch — derive the tag
+          # from the triggering workflow's head branch instead.
+          # For workflow_dispatch, use GITHUB_REF_NAME directly.
+          if [ "${{ github.event_name }}" = "workflow_run" ]; then
+            TAG="${{ github.event.workflow_run.head_branch }}"
+          else
+            TAG="${GITHUB_REF_NAME}"
+          fi
+          echo "name=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "Release tag: ${TAG}"
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: |
+            3.10
+            3.11
+            3.12
+            3.13
+            3.14
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Install libraries dependencies
+        run: |
+          uv pip compile \
+            --all-extras \
+            --format=requirements.txt \
+            --output-file=requirements.txt \
+            pyproject.toml
+      - name: Set up Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version: 1.17
+      - name: Build Pex
+        run: |-
+          mkdir -p dist
+          uvx pex '.[gojsonnet,omegaconf,reclass-rs]' -r requirements.txt \
+            --python-shebang='#!/usr/bin/env python3' \
+            --python=python3.11 \
+            --python=python3.10 \
+            --python=python3.12 \
+            --python=python3.13 \
+            --python=python3.14 \
+            -m kapitan \
+            -o dist/kapitan.linux-x86_64.pex
+          dist/kapitan.linux-x86_64.pex --help
+
+      - name: Generate PEX checksum
+        run: |
+          (cd dist && sha256sum kapitan.linux-x86_64.pex) > dist/kapitan.linux-x86_64.pex.sha256
+          echo "PEX checksum:"
+          cat dist/kapitan.linux-x86_64.pex.sha256
+          (cd dist && sha256sum -c kapitan.linux-x86_64.pex.sha256)
+
+      - name: Add linux-x86_64 pex to assets
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        if: >-
+          (github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'v')) ||
+          startsWith(github.ref, 'refs/tags/')
+        with:
+          tag_name: ${{ steps.tag.outputs.name }}
+          files: |
+            dist/kapitan.linux-x86_64.pex
+            dist/kapitan.linux-x86_64.pex.sha256

kapitan-0.35.2.dev22/.github/workflows/python-pypi-publish.yml

@@ -0,0 +1,78 @@
+---
+name: Publish Python Package to PyPI
+
+concurrency:
+  group: '${{ github.workflow }} @ ${{ github.event.pull_request.head.label || github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+  release:
+    types: [created]
+
+jobs:
+  pypi-publish:
+    runs-on: ubuntu-latest
+    permissions:
+      # Required for softprops/action-gh-release to upload SBOM + checksum
+      # assets to the GitHub release page. Only actually used when the
+      # "Upload release artifacts" step runs (release events only).
+      contents: write
+      # NOTE:
+      # Remove user/password and uncomment id-token permission once Trusted
+      # Publishing (OIDC) is setup in pypi. See:
+      # https://github.com/pypa/gh-action-pypi-publish
+      # id-token: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          submodules: recursive
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: pyproject.toml
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - name: Build and check
+        run: |
+          uv build
+          uvx twine check dist/*
+      - name: Extract version
+        id: version
+        run: |
+          # On release events, use the tag name (stripping any leading 'v').
+          # On workflow_dispatch, fall back to parsing the built wheel filename
+          # (kapitan is not installed in the runner Python after `uv build`).
+          if [ "${{ github.event_name }}" = "release" ]; then
+            VERSION="${GITHUB_REF_NAME#v}"
+          else
+            VERSION=$(python3 -c "import glob, re, sys; m=re.search(r'kapitan-([^-]+)-', glob.glob('dist/kapitan-*.whl')[0]); print(m.group(1)) if m else sys.exit('no wheel found')")
+          fi
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Detected version: ${VERSION}"
+      - name: Generate SBOM
+        timeout-minutes: 10
+        run: |
+          scripts/generate_sbom.sh "${{ steps.version.outputs.version }}" dist
+      - name: Generate SHA256 checksums
+        timeout-minutes: 5
+        run: |
+          scripts/generate_checksums.sh dist dist/SHA256SUMS
+      - name: Validate checksums
+        timeout-minutes: 5
+        run: |
+          (cd dist && sha256sum -c SHA256SUMS)
+      - name: Upload release artifacts
+        if: github.event_name == 'release'
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        with:
+          files: |
+            dist/kapitan-*.whl
+            dist/kapitan-*.tar.gz
+            dist/kapitan-${{ steps.version.outputs.version }}.python.sbom.cdx.json
+            dist/SHA256SUMS
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        with:
+          user: __token__
+          password: ${{ secrets.PYPI_TOKEN }}

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/.github/workflows/test-build-publish.yml

@@ -161,6 +161,8 @@ jobs:
     name: build ${{ matrix.platform.platform }} image using python ${{ matrix.python-version }}
     needs: [setup, precommit, test, check-changes]
     runs-on: ${{ matrix.platform.runner }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -218,6 +220,9 @@ jobs:
             type=semver,pattern={{major}},suffix=${{ steps.suffix.outputs.python-suffix }}${{ steps.suffix.outputs.platform-suffix }}
           flavor: |
             latest=false
+          labels: |
+            io.kapitan.sbom.format=CycloneDX
+            io.kapitan.sbom.spec-version=1.6
 
       # For default python version, also create tags with -py suffix for compatibility
       - name: Docker meta (py-suffixed tags for default version)
@@ -267,6 +272,54 @@ jobs:
         run: |
           docker run -t --rm local-test --version
 
+      - name: Set up uv
+        if: github.event_name != 'pull_request'
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+
+      - name: Generate Docker SBOM
+        id: docker-sbom
+        if: github.event_name != 'pull_request'
+        timeout-minutes: 10
+        run: |
+          mkdir -p dist
+          PLATFORM_SLUG=$(echo "${{ matrix.platform.platform }}" | tr '/' '-')
+          # On release events use the tag; otherwise fall back to a short SHA so
+          # the artifact filename is still unique and traceable.
+          if [ "${{ github.event_name }}" = "release" ]; then
+            VERSION="${GITHUB_REF_NAME#v}"
+          else
+            VERSION="${GITHUB_SHA::8}"
+          fi
+          SBOM_FILE="dist/kapitan-${VERSION}-py${{ matrix.python-version }}-${PLATFORM_SLUG}-docker.sbom.cdx.json"
+          # Generate SBOM from production+extras deps via uv export.
+          # --all-extras matches the Docker image which installs gojsonnet/omegaconf/reclass-rs.
+          # --no-group test/docs prevents dev tooling from contaminating the SBOM.
+          uv export \
+              --no-dev --no-group test --no-group docs \
+              --all-extras --no-editable \
+              --format requirements-txt --no-hashes | \
+            grep -Ev '^[[:space:]]*(#|\.[[:space:]]*$|$)' | \
+            uvx --from 'cyclonedx-bom>=4,<5' cyclonedx-py requirements \
+              --mc-type application \
+              --of JSON \
+              --output-reproducible \
+              -o "${SBOM_FILE}" -
+          echo "sbom-file=${SBOM_FILE}" >> "$GITHUB_OUTPUT"
+          echo "platform-slug=${PLATFORM_SLUG}" >> "$GITHUB_OUTPUT"
+          echo "Docker SBOM generated: ${SBOM_FILE}"
+
+      - name: Validate Docker SBOM
+        if: github.event_name != 'pull_request'
+        run: scripts/validate_sbom.sh "${{ steps.docker-sbom.outputs.sbom-file }}"
+
+      - name: Upload Docker SBOM artifact
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: docker-sbom-py${{ matrix.python-version }}-${{ steps.docker-sbom.outputs.platform-slug }}
+          path: ${{ steps.docker-sbom.outputs.sbom-file }}
+          retention-days: 1
+
       - name: Push image to DockerHub
         env:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -281,6 +334,35 @@ jobs:
           build-args: |
             PYTHON_VERSION=${{ matrix.python-version }}
 
+  upload-docker-sboms:
+    name: upload Docker SBOMs to release
+    needs: [setup, build]
+    if: github.event_name == 'release'
+    runs-on: ${{ needs.setup.outputs.runner }}
+    permissions:
+      contents: write
+    steps:
+      - name: Download Docker SBOM artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: docker-sbom-*
+          merge-multiple: true
+          path: dist/sboms
+
+      - name: Verify SBOMs were downloaded
+        run: |
+          count=$(find dist/sboms -name '*.sbom.cdx.json' -type f | wc -l)
+          echo "Found ${count} Docker SBOM(s)"
+          if [ "${count}" -eq 0 ]; then
+            echo "ERROR: no Docker SBOMs downloaded; build artifacts may have expired (retention=1 day)." >&2
+            exit 1
+          fi
+
+      - name: Upload Docker SBOMs to release
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        with:
+          files: dist/sboms/*.sbom.cdx.json
+
   build-multi-architecture:
     name: combine platform images for python ${{ matrix.python-version }}
     needs:

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/.pre-commit-config.yaml

@@ -13,6 +13,11 @@ repos:
     hooks:
       - id: end-of-file-fixer
       - id: check-merge-conflict
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.10.0.1
+    hooks:
+      - id: shellcheck
+        args: [--severity=warning]
   - repo: https://github.com/rhysd/actionlint
     rev: 'v1.7.7'
     hooks:

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kapitan
-Version: 0.35.2.dev20
+Version: 0.35.2.dev22
 Summary: Generic templated configuration management for Kubernetes, Terraform and other things
 Project-URL: Homepage, https://kapitan.dev
 Project-URL: Repository, https://github.com/kapicorp/kapitan

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/cli.py

@@ -91,7 +91,8 @@ def trigger_compile(args):
             ref_controller=ref_controller,
             args=args,
         )
-    except:
+    except Exception as e:
+        logger.debug("Compile failed: %s", e, exc_info=True)
         sys.exit(1)
 
 

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/dependency_manager/base.py

@@ -193,7 +193,7 @@ def fetch_git_source(source, save_dir, item_type):
         logger.error(e)
         raise GitFetchingError(
             f"{item_type} {source}: fetching unsuccessful\n{e.stderr}"
-        )
+        ) from e
 
 
 def fetch_http_dependency(dep_mapping, save_dir, force, item_type="Dependency"):

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/inputs/copy.py

@@ -34,6 +34,10 @@ class Copy(InputType):
 
         ignore_missing = config.ignore_missing
 
+        if not os.path.exists(input_path) and not ignore_missing:
+            raise OSError(
+                f"Path {input_path} does not exist and `ignore_missing` is {ignore_missing}"
+            )
         try:
             if os.path.exists(input_path):
                 logger.debug("Copying '%s' to '%s'.", input_path, compile_path)
@@ -55,11 +59,7 @@ class Copy(InputType):
                         compile_path
                     )  # Resolve relative paths
                     copy_tree(input_path, compile_path)
-            elif not ignore_missing:
-                # Raise exception if input path does not exist and ignore_missing is False
-                raise OSError(
-                    f"Path {input_path} does not exist and `ignore_missing` is {ignore_missing}"
-                )
         except OSError as e:
             # Log exception and re-raise
             logger.exception("Input dir not copied. Error: %s", e)
+            raise

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/inputs/jsonnet.py

@@ -37,18 +37,15 @@ def select_jsonnet_runtime(use_go):
     """
     try:
         if use_go:
-            import _gojsonnet
-
-            return _gojsonnet
-        import _jsonnet
-
-        return _jsonnet
-
+            import _gojsonnet as jsonnet_module
+        else:
+            import _jsonnet as jsonnet_module
     except ImportError as exc:
         raise ImportError(
             "Jsonnet is not installed or running on an unsupported architecture. "
             "See https://kapitan.dev/compile/#jsonnet for installation instructions."
         ) from exc
+    return jsonnet_module
 
 
 class Jsonnet(InputType):

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/inputs/kadet.py

@@ -97,9 +97,10 @@ def load_from_search_paths(module_name):
             _path = os.path.join(path, module_name)
             mod, spec = module_from_path(_path, check_name=module_name)
             spec.loader.exec_module(mod)
-            return mod
         except (ModuleNotFoundError, FileNotFoundError):
             pass
+        else:
+            return mod
     raise ModuleNotFoundError(f"Could not load module name {module_name}")
 
 

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/inputs/kustomize.py

@@ -84,18 +84,20 @@ class Kustomize(InputType):
         Raises:
             KustomizeTemplateError: If kustomize build fails
         """
+
+        # Get the absolute path to the input directory
+        abs_input_path = os.path.abspath(input_path)
+        if not os.path.isdir(abs_input_path):
+            raise KustomizeTemplateError(
+                f"Input path {input_path} must be a directory containing a kustomization.yaml file"
+            )
+
+        result = None
         try:
             # Create a temporary directory for our kustomization
             temp_dir = tempfile.mkdtemp()
             kustomization_path = os.path.join(temp_dir, "kustomization.yaml")
 
-            # Get the absolute path to the input directory
-            abs_input_path = os.path.abspath(input_path)
-            if not os.path.isdir(abs_input_path):
-                raise KustomizeTemplateError(
-                    f"Input path {input_path} must be a directory containing a kustomization.yaml file"
-                )
-
             # Copy the input directory to the temporary directory
             input_dir_name = os.path.basename(abs_input_path)
             temp_input_dir = os.path.join(temp_dir, input_dir_name)
@@ -147,11 +149,15 @@ class Kustomize(InputType):
                 result = subprocess.run(
                     cmd, stdout=f, stderr=subprocess.PIPE, text=True, check=False
                 )
-                if result.returncode != 0:
-                    raise KustomizeTemplateError(
-                        f"Kustomize build failed: {result.stderr}"
-                    )
+        except Exception as e:
+            raise KustomizeTemplateError(
+                f"Failed to compile Kustomize overlay: {e!s}"
+            ) from e
+
+        if result.returncode != 0:
+            raise KustomizeTemplateError(f"Kustomize build failed: {result.stderr}")
 
+        try:
             # Read and process the output
             with open(output_file) as f:
                 for doc in yaml.safe_load_all(f):
@@ -167,6 +173,7 @@ class Kustomize(InputType):
                         output_path = os.path.join(compile_path, filename)
                         with open(output_path, "w") as out:
                             yaml.dump(doc, out, default_flow_style=False)
-
         except Exception as e:
-            raise KustomizeTemplateError(f"Failed to compile Kustomize overlay: {e!s}")
+            raise KustomizeTemplateError(
+                f"Failed to compile Kustomize overlay: {e!s}"
+            ) from e

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/inventory/backends/omegaconf/resolvers.py

@@ -315,5 +315,5 @@ def register_user_resolvers(user_resolver_file: str) -> None:
     for name, func in funcs.items():
         try:
             OmegaConf.register_new_resolver(name, func, replace=True)
-        except:
-            logger.warning(f"Could not load resolver {name}")
+        except Exception as e:
+            logger.warning(f"Could not load resolver {name}: {e}")

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/inventory/backends/reclass/__init__.py

@@ -1,6 +1,6 @@
 import logging
 import os
-from datetime import datetime
+from datetime import datetime, timezone
 
 import yaml
 
@@ -46,9 +46,9 @@ class ReclassInventory(Inventory):
             _reclass = reclass.core.Core(
                 storage, class_mappings, reclass.settings.Settings(reclass_config)
             )
-            start = datetime.now()
+            start = datetime.now(timezone.utc)
             rendered_inventory = _reclass.inventory()
-            elapsed = datetime.now() - start
+            elapsed = datetime.now(timezone.utc) - start
             logger.debug(f"Inventory rendering with reclass took {elapsed}")
 
             # store parameters and classes
@@ -63,7 +63,7 @@ class ReclassInventory(Inventory):
                 logger.error("Inventory reclass error: inventory not found")
             else:
                 logger.error(f"Inventory reclass error: {e.message}")
-            raise InventoryError(e.message)
+            raise InventoryError(e.message) from e
 
 
 def get_reclass_config(

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/inventory/backends/reclass_rs/__init__.py

@@ -1,5 +1,5 @@
 import logging
-from datetime import datetime
+from datetime import datetime, timezone
 
 import reclass_rs
 from kapitan.errors import InventoryError
@@ -30,9 +30,9 @@ class ReclassRsInventory(Inventory):
     ):
         try:
             r = self._make_reclass_rs(ignore_class_not_found)
-            start = datetime.now()
+            start = datetime.now(timezone.utc)
             inv = r.inventory()
-            elapsed = datetime.now() - start
+            elapsed = datetime.now(timezone.utc) - start
             logger.debug(f"Inventory rendering with reclass-rs took {elapsed}")
 
             for target_name, nodeinfo in inv.nodes.items():
@@ -43,4 +43,4 @@ class ReclassRsInventory(Inventory):
 
         except ValueError as e:
             logger.error(f"Reclass-rs error: {e}")
-            raise InventoryError(f"{e}")
+            raise InventoryError(f"{e}") from e

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/jinja2_filters.py

@@ -75,8 +75,9 @@ def load_module_from_path(env, path):
                 logger.debug("custom filter loaded from %s", path)
                 env.filters[function] = getattr(custom_filter_module, function)
     except Exception as e:
-        raise OSError(f"jinja2 failed to render, could not load filter at {path}: {e}")
-        logger.debug("failed to find custom filter from path %s", path)
+        raise OSError(
+            f"jinja2 failed to render, could not load filter at {path}: {e}"
+        ) from e
 
 
 def load_jinja2_filters_from_file(env, jinja2_filters):
@@ -132,8 +133,11 @@ def to_bool(a):
     return False
 
 
-def to_datetime(string, format="%Y-%m-%d %H:%M:%S"):
-    return datetime.datetime.strptime(string, format)
+def to_datetime(string, format="%Y-%m-%d %H:%M:%S", tz=None):
+    dt = datetime.datetime.strptime(string, format)  # noqa: DTZ007 - naive by default; pass tz= for timezone-aware output
+    if tz is not None:
+        dt = dt.replace(tzinfo=tz)
+    return dt
 
 
 def strftime(string_format, second=None):
@@ -141,8 +145,8 @@ def strftime(string_format, second=None):
     if second is not None:
         try:
             second = int(second)
-        except Exception:
-            raise CompileError(f"Invalid value for epoch value ({second})")
+        except (ValueError, TypeError) as e:
+            raise CompileError(f"Invalid value for epoch value ({second})") from e
     return time.strftime(string_format, time.localtime(second))
 
 

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/refs/base.py

@@ -99,7 +99,7 @@ class PlainRef:
             except KeyError:
                 raise RefError(
                     f"PlainRef: cannot access sub-variable key {self.embedded_subvar_path}"
-                )
+                ) from None
         else:
             return self.data
 
@@ -195,9 +195,10 @@ class PlainRefBackend:
     def __contains__(self, ref_path):
         try:
             self.__getitem__(ref_path)
-            return True
         except KeyError:
             return False
+        else:
+            return True
 
     def __iter__(self):
         for full_path in list_all_paths(self.path):
@@ -320,7 +321,7 @@ class Revealer:
                 except KeyError:
                     raise RefError(
                         f"Revealer: cannot access {tag} sub-variable key {ref.embedded_subvar_path}"
-                    )
+                    ) from None
 
             # else this is just a ref
             else:
@@ -359,7 +360,7 @@ class Revealer:
             except KeyError:
                 raise RefError(
                     f"Revealer: cannot access {tag} sub-variable key {subvar_path}"
-                )
+                ) from None
 
     @lru_cache(maxsize=256)
     def _reveal_tag_without_subvar(self, tag_without_subvar):
@@ -395,7 +396,7 @@ class Revealer:
                 return ref.compile()
             # if refs don't exist:
             except KeyError:
-                raise RefError(f"Could not find ref backend for tag: {tag}")
+                raise RefError(f"Could not find ref backend for tag: {tag}") from None
 
         return compile_replace_match
 
@@ -601,7 +602,7 @@ class RefController:
         try:
             yield
         except RefBackendError as e:
-            raise RefBackendError(f"{e}\n  for key {ref_key}")
+            raise RefBackendError(f"{e}\n  for key {ref_key}") from e
 
     def __init__(self, path, **kwargs):
         """
@@ -664,7 +665,7 @@ class RefController:
 
                 self.register_backend(AzureKMSBackend(self.path, **ref_kwargs))
             else:
-                raise RefBackendError(f"no backend for ref type: {type_name}")
+                raise RefBackendError(f"no backend for ref type: {type_name}") from None
         return self.backends[type_name]
 
     def tag_type(self, tag):
@@ -810,11 +811,11 @@ class RefController:
                 except KeyError:
                     raise RefError(
                         f"{func_name}: unknown ref function used. Choose one of: {[key for key in get_func_lookup()]}"
-                    )
-                except TypeError:
+                    ) from None
+                except TypeError as e:
                     raise RefError(
                         f"{func_params}: too many arguments for function {func_name}"
-                    )
+                    ) from e
 
         return ctx
 
@@ -844,7 +845,7 @@ class RefController:
                     # raise RefFromFuncError to indicate new ref needs to be created
                     raise RefFromFuncError(
                         f"{token}: does not exist and must be created from function: {func_str}"
-                    )
+                    ) from None
 
         raise KeyError(f"{tag}: ref not found")
 

{kapitan-0.35.2.dev20 → kapitan-0.35.2.dev22}/kapitan/refs/base64.py

@@ -45,7 +45,7 @@ class Base64Ref(PlainRef):
         decoded = base64.b64decode(self.data)
         try:
             return decoded.decode()
-        except:
+        except UnicodeDecodeError:
             return self.data
 
     def compile_embedded(self):