kapitan 0.36.1.dev2__tar.gz → 0.36.1.dev3__tar.gz

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/.github/workflows/python-pypi-publish-dev.yml

@@ -46,10 +46,16 @@ jobs:
       - name: Build and check
         run: |
           uv build
-          uvx twine check dist/*
+          # Restrict to actual distributions so this stays correct if
+          # non-package artifacts (SBOM, checksums) are ever added to dist/.
+          uvx twine check dist/*.whl dist/*.tar.gz
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
+          # Dev versions are derived from distance-from-latest-tag, so the same
+          # version can be recomputed across runs (re-runs, tag moves, etc.).
+          # Treat "already on PyPI" as a no-op instead of failing the workflow.
+          skip-existing: true

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/.github/workflows/python-pypi-publish.yml

@@ -51,27 +51,35 @@ jobs:
           fi
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "Detected version: ${VERSION}"
+      - name: Stage release artifacts
+        run: |
+          # Keep dist/ pristine (wheel + sdist only) so the PyPI publish step,
+          # which uploads everything in dist/, is not fed non-distribution
+          # files (SBOM, SHA256SUMS) that twine rejects. Release-only extras
+          # live in release/ alongside copies of the distributions.
+          mkdir -p release
+          cp dist/kapitan-*.whl dist/kapitan-*.tar.gz release/
       - name: Generate SBOM
         timeout-minutes: 10
         run: |
-          scripts/generate_sbom.sh "${{ steps.version.outputs.version }}" dist
+          scripts/generate_sbom.sh "${{ steps.version.outputs.version }}" release
       - name: Generate SHA256 checksums
         timeout-minutes: 5
         run: |
-          scripts/generate_checksums.sh dist dist/SHA256SUMS
+          scripts/generate_checksums.sh release release/SHA256SUMS
       - name: Validate checksums
         timeout-minutes: 5
         run: |
-          (cd dist && sha256sum -c SHA256SUMS)
+          (cd release && sha256sum -c SHA256SUMS)
       - name: Upload release artifacts
         if: github.event_name == 'release'
         uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         with:
           files: |
-            dist/kapitan-*.whl
-            dist/kapitan-*.tar.gz
-            dist/kapitan-${{ steps.version.outputs.version }}.python.sbom.cdx.json
-            dist/SHA256SUMS
+            release/kapitan-*.whl
+            release/kapitan-*.tar.gz
+            release/kapitan-${{ steps.version.outputs.version }}.python.sbom.cdx.json
+            release/SHA256SUMS
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/.github/workflows/test-build-publish.yml

@@ -62,7 +62,10 @@ jobs:
     runs-on: ubuntu-24.04
     outputs:
       has-docs-changes: ${{ steps.filter.outputs.docs }}
-      has-code-changes: ${{ steps.filter.outputs.code }}
+      # On a release event the tag rides on top of master, so paths-filter diffs an
+      # empty range (master...tag) and reports no code changes. Force-enable the code
+      # path on releases so the docker build/push and multi-arch manifest always run.
+      has-code-changes: ${{ steps.filter.outputs.code == 'true' || github.event_name == 'release' }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -73,6 +76,28 @@ jobs:
         with:
           predicate-quantifier: 'every'
           filters: .github/filters/filters.yml
+
+  version-info:
+    name: compute package version
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.compute.outputs.version }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # Tags are required for uv-dynamic-versioning to compute distance
+          # from the latest release.
+          fetch-depth: 0
+          filter: blob:none
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
+      - id: compute
+        # Invoke the same tool the build backend uses, so the resolved version
+        # matches what an unbypassed build would have produced.
+        run: |
+          VERSION=$(uvx uv-dynamic-versioning)
+          echo "Computed version: ${VERSION}"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
   precommit:
     name: precommit checks
     needs: [setup, check-changes]
@@ -159,7 +184,7 @@ jobs:
 
   build:
     name: build ${{ matrix.platform.platform }} image using python ${{ matrix.python-version }}
-    needs: [setup, precommit, test, check-changes]
+    needs: [setup, precommit, test, check-changes, version-info]
     runs-on: ${{ matrix.platform.runner }}
     permissions:
       contents: read
@@ -266,11 +291,16 @@ jobs:
           cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-${{ matrix.platform.platform }}-py${{ matrix.python-version }}
           build-args: |
             PYTHON_VERSION=${{ matrix.python-version }}
+            KAPITAN_VERSION=${{ needs.version-info.outputs.version }}
 
       - name: Test Kapitan image
         if: needs.check-changes.outputs.has-code-changes == 'true'
         run: |
-          docker run -t --rm local-test --version
+          # Assert on the version — `--version` printing 0.0.0 would otherwise
+          # exit 0 and the build-arg wiring could rot silently (see #1552).
+          GOT=$(docker run --rm local-test --version | tr -d '[:space:]')
+          EXP="${{ needs.version-info.outputs.version }}"
+          [ "$GOT" = "$EXP" ] || { echo "version mismatch: got '$GOT' want '$EXP'"; exit 1; }
 
       - name: Set up uv
         if: needs.check-changes.outputs.has-code-changes == 'true' && github.event_name != 'pull_request'
@@ -333,6 +363,7 @@ jobs:
           cache-from: type=gha,scope=${{ github.ref_name }}-${{ matrix.platform.platform }}-py${{ matrix.python-version }}
           build-args: |
             PYTHON_VERSION=${{ matrix.python-version }}
+            KAPITAN_VERSION=${{ needs.version-info.outputs.version }}
 
   upload-docker-sboms:
     name: upload Docker SBOMs to release

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/Dockerfile

@@ -34,6 +34,13 @@ COPY ./uv.lock ./uv.lock
 COPY ./README.md ./README.md
 COPY ./kapitan/version.py ./kapitan/version.py
 
+# uv-dynamic-versioning normally derives the version from git tags, which
+# would require shipping .git into the build context. Instead the caller
+# computes the version once outside Docker and passes it in via this
+# build-arg; the env var tells uv-dynamic-versioning to use it verbatim.
+ARG KAPITAN_VERSION
+ENV UV_DYNAMIC_VERSIONING_BYPASS=${KAPITAN_VERSION}
+
 RUN uv sync --locked --all-extras
 
 COPY ./kapitan ./kapitan

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kapitan
-Version: 0.36.1.dev2
+Version: 0.36.1.dev3
 Summary: Generic templated configuration management for Kubernetes, Terraform and other things
 Project-URL: Homepage, https://kapitan.dev
 Project-URL: Repository, https://github.com/kapicorp/kapitan

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/docs/pages/commands/kapitan_compile.md

@@ -219,7 +219,8 @@ library), enabled with `--yaml-use-rapidyaml`.
           --validate            validate compile output against schemas as specified
                                 in inventory
           --parallelism INT, -p INT
-                                Number of concurrent compile processes, default is 4
+                                Number of concurrent compile processes, default is
+                                min(len(targets), available CPU count)
           --indent INT, -i INT  Indentation spaces for YAML/JSON, default is 2
           --refs-path REFS_PATH
                                 set refs path, default is "./refs"

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/docs/pages/core_concepts.md

@@ -58,7 +58,7 @@ You can tell **Kapitan** to **compile** all your targets by running the followin
 ```
 $ kapitan compile
 Rendered inventory (0.06s): discovered 200 targets.
-Compiling 200/200 targets using 64 concurrent processes: (64 CPU detected)
+Compiling 200/200 targets using 64 concurrent processes: (64 CPU available)
 ...
 Compiled production (0.68s)
 ...
@@ -70,7 +70,7 @@ Alternatively, you can select just the target you want to compile, using the `-t
 ```
 $ kapitan compile -t production
 Rendered inventory (0.06s): discovered 200 targets.
-Compiling 1/200 targets using 1 concurrent processes: (64 CPU detected)
+Compiling 1/200 targets using 1 concurrent processes: (64 CPU available)
 Compiled production (0.68s)
 Compiled 1 targets in 0.73s
 ```

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/docs/pages/glossary.md

@@ -67,7 +67,7 @@ The directory tree produced by `kapitan compile`, located at `compiled/`. Each t
 
 ### Parallelism
 
-Kapitan compiles targets in parallel using multiple processes. The default parallelism is `min(number_of_targets, cpu_count)`. You can control it with the `-p` flag.
+Kapitan compiles targets in parallel using multiple processes. The default parallelism is `min(number_of_targets, available_cpu_count)`, where available CPUs account for process affinity and container CPU limits. You can control it with the `-p` flag.
 
 ## References and secrets
 

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/docs/pages/troubleshooting.md

@@ -181,7 +181,7 @@ parameters:
 **Resolution:**
 
 - Compile only the target you need: `kapitan compile -t <target>`.
-- Increase parallelism with `-p` (defaults to CPU count).
+- Increase parallelism with `-p` (defaults to available CPU count).
 - Consider switching to the **reclass-rs** backend for faster inventory rendering.
 - If using OmegaConf, check for expensive custom resolvers.
 

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/kapitan/cli.py

@@ -269,7 +269,7 @@ def build_parser():
         type=int,
         default=from_dot_kapitan("compile", "parallelism", None),
         metavar="INT",
-        help="Number of concurrent compile processes, default is min(len(targets), os.cpu_count())",
+        help="Number of concurrent compile processes, default is min(len(targets), available CPU count)",
     )
     compile_parser.add_argument(
         "--indent",

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/kapitan/inventory/backends/omegaconf/__init__.py

@@ -18,6 +18,7 @@ from kadet import Dict
 from kapitan.errors import InventoryError
 from kapitan.inventory import Inventory, InventoryTarget
 from kapitan.inventory.model import KapitanInventoryMetadata, KapitanInventoryParameters
+from kapitan.utils import available_cpu_count
 from omegaconf import ListMergeMode, OmegaConf
 
 from .migrate import migrate
@@ -79,7 +80,7 @@ class OmegaConfInventory(Inventory):
         if not self.initialised:
             manager = mp.Manager()
             shared_targets = manager.dict()
-            with mp.Pool(min(len(targets), os.cpu_count())) as pool:
+            with mp.Pool(min(len(targets), available_cpu_count())) as pool:
                 r = pool.map_async(
                     self.inventory_worker,
                     [(self, target, shared_targets) for target in targets.values()],

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/kapitan/targets.py

@@ -23,6 +23,7 @@ from kapitan.errors import CompileError, InventoryError, KapitanError
 from kapitan.inputs import get_compiler
 from kapitan.profiling import worker_profile
 from kapitan.resources import get_inventory
+from kapitan.utils import available_cpu_count
 
 
 logger = logging.getLogger(__name__)
@@ -84,10 +85,11 @@ def compile_targets(inventory_path, search_paths, ref_controller, args):
             f"No matching targets found in inventory: {labels if labels else args.targets}"
         )
 
-    parallelism = args.parallelism or min(len(targets), os.cpu_count())
+    available_cpus = available_cpu_count()
+    parallelism = args.parallelism or min(len(targets), available_cpus)
 
     logger.info(
-        f"Compiling {len(targets)}/{len(discovered_targets)} targets using {parallelism} concurrent processes: ({os.cpu_count()} CPU detected)"
+        f"Compiling {len(targets)}/{len(discovered_targets)} targets using {parallelism} concurrent processes: ({available_cpus} CPU available)"
     )
 
     # check if --fetch or --force-fetch is enabled

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/kapitan/utils.py

@@ -39,6 +39,10 @@ from kapitan.version import VERSION
 
 logger = logging.getLogger(__name__)
 
+_CGROUP_V2_CPU_MAX = "/sys/fs/cgroup/cpu.max"
+_CGROUP_V1_CPU_QUOTA = "/sys/fs/cgroup/cpu/cpu.cfs_quota_us"
+_CGROUP_V1_CPU_PERIOD = "/sys/fs/cgroup/cpu/cpu.cfs_period_us"
+
 
 try:
     from enum import StrEnum
@@ -61,6 +65,63 @@ for _YamlLoader in {YamlLoader, yaml.SafeLoader}:
     )
 
 
+def available_cpu_count():
+    """Return CPUs available to this process, accounting for container limits."""
+    os_cpu_count = os.cpu_count() or 1
+    try:
+        cpu_count = min(
+            os_cpu_count,
+            _cpu_count_from_affinity(os_cpu_count),
+            _cpu_count_from_cgroup(os_cpu_count),
+        )
+    except Exception as exc:  # pragma: no cover - defensive fallback
+        logger.debug("Unable to detect available CPU count: %s", exc)
+        cpu_count = os_cpu_count
+
+    return max(1, int(cpu_count or 1))
+
+
+def _cpu_count_from_affinity(os_cpu_count):
+    sched_getaffinity = getattr(os, "sched_getaffinity", None)
+    if sched_getaffinity is None:
+        return os_cpu_count
+
+    try:
+        return len(sched_getaffinity(0))
+    except (NotImplementedError, OSError):
+        return os_cpu_count
+
+
+def _cpu_count_from_cgroup(os_cpu_count):
+    try:
+        if os.path.exists(_CGROUP_V2_CPU_MAX):
+            cpu_quota_us, cpu_period_us = _read_cpu_file(_CGROUP_V2_CPU_MAX).split()
+        elif os.path.exists(_CGROUP_V1_CPU_QUOTA) and os.path.exists(
+            _CGROUP_V1_CPU_PERIOD
+        ):
+            cpu_quota_us = _read_cpu_file(_CGROUP_V1_CPU_QUOTA)
+            cpu_period_us = _read_cpu_file(_CGROUP_V1_CPU_PERIOD)
+        else:
+            return os_cpu_count
+
+        if cpu_quota_us == "max":
+            return os_cpu_count
+
+        cpu_quota_us = int(cpu_quota_us)
+        cpu_period_us = int(cpu_period_us)
+        if cpu_quota_us > 0 and cpu_period_us > 0:
+            return math.ceil(cpu_quota_us / cpu_period_us)
+    except (OSError, ValueError):
+        logger.debug("Unable to detect CPU count from cgroup files", exc_info=True)
+
+    return os_cpu_count
+
+
+def _read_cpu_file(path):
+    with open(path, encoding="utf-8") as cpu_file:
+        return cpu_file.read().strip()
+
+
 def fatal_error(message):
     "Logs error message, sys.exit(1)"
     logger.error(message)

{kapitan-0.36.1.dev2 → kapitan-0.36.1.dev3}/tests/test_utils.py

@@ -13,12 +13,14 @@ import shutil
 import stat
 import tempfile
 import unittest
+from unittest.mock import patch
 
 import yaml
 
 from kapitan.utils import (
     SafeCopyError,
     YamlLoader,
+    available_cpu_count,
     compare_versions,
     copy_tree,
     deep_get,
@@ -265,6 +267,105 @@ class Sha256StringTest(unittest.TestCase):
         self.assertTrue(all(c in "0123456789abcdef" for c in digest))
 
 
+class AvailableCpuCountTest(unittest.TestCase):
+    """Test available_cpu_count uses process-aware CPU detection."""
+
+    def test_uses_affinity_count(self):
+        with (
+            patch("kapitan.utils.os.cpu_count", return_value=64),
+            patch(
+                "kapitan.utils.os.sched_getaffinity",
+                create=True,
+                return_value={0, 1},
+            ),
+            patch("kapitan.utils.os.path.exists", return_value=False),
+        ):
+            self.assertEqual(available_cpu_count(), 2)
+
+    def test_uses_cgroup_v2_quota(self):
+        with (
+            patch("kapitan.utils.os.cpu_count", return_value=64),
+            patch(
+                "kapitan.utils.os.sched_getaffinity",
+                create=True,
+                return_value=set(range(64)),
+            ),
+            patch(
+                "kapitan.utils.os.path.exists",
+                side_effect=lambda path: path == "/sys/fs/cgroup/cpu.max",
+            ),
+            patch("kapitan.utils._read_cpu_file", return_value="250000 100000"),
+        ):
+            self.assertEqual(available_cpu_count(), 3)
+
+    def test_uses_cgroup_v1_quota(self):
+        cgroup_files = {
+            "/sys/fs/cgroup/cpu/cpu.cfs_quota_us": "150000",
+            "/sys/fs/cgroup/cpu/cpu.cfs_period_us": "100000",
+        }
+        with (
+            patch("kapitan.utils.os.cpu_count", return_value=64),
+            patch(
+                "kapitan.utils.os.sched_getaffinity",
+                create=True,
+                return_value=set(range(64)),
+            ),
+            patch(
+                "kapitan.utils.os.path.exists",
+                side_effect=lambda path: path in cgroup_files,
+            ),
+            patch(
+                "kapitan.utils._read_cpu_file",
+                side_effect=lambda path: cgroup_files[path],
+            ),
+        ):
+            self.assertEqual(available_cpu_count(), 2)
+
+    def test_cgroup_quota_takes_minimum_with_affinity(self):
+        with (
+            patch("kapitan.utils.os.cpu_count", return_value=64),
+            patch(
+                "kapitan.utils.os.sched_getaffinity",
+                create=True,
+                return_value={0, 1},
+            ),
+            patch(
+                "kapitan.utils.os.path.exists",
+                side_effect=lambda path: path == "/sys/fs/cgroup/cpu.max",
+            ),
+            patch("kapitan.utils._read_cpu_file", return_value="300000 100000"),
+        ):
+            self.assertEqual(available_cpu_count(), 2)
+
+    def test_cgroup_max_uses_os_cpu_count(self):
+        with (
+            patch("kapitan.utils.os.cpu_count", return_value=8),
+            patch(
+                "kapitan.utils.os.sched_getaffinity",
+                create=True,
+                return_value=set(range(8)),
+            ),
+            patch(
+                "kapitan.utils.os.path.exists",
+                side_effect=lambda path: path == "/sys/fs/cgroup/cpu.max",
+            ),
+            patch("kapitan.utils._read_cpu_file", return_value="max 100000"),
+        ):
+            self.assertEqual(available_cpu_count(), 8)
+
+    def test_never_returns_less_than_one(self):
+        with (
+            patch("kapitan.utils.os.cpu_count", return_value=None),
+            patch(
+                "kapitan.utils.os.sched_getaffinity",
+                create=True,
+                return_value=set(),
+            ),
+            patch("kapitan.utils.os.path.exists", return_value=False),
+        ):
+            self.assertEqual(available_cpu_count(), 1)
+
+
 class RenderJinja2TemplateTest(unittest.TestCase):
     """Test render_jinja2_template renders content with context.