kapitan 0.36.3.dev6__tar.gz → 0.36.4.dev6__tar.gz

{kapitan-0.36.3.dev6 → kapitan-0.36.4.dev6}/.github/workflows/documentation.yml

@@ -47,10 +47,10 @@ jobs:
           uv run mkdocs --version
 
       - name: Build docs (strict, timeout-guarded)
-        run: make docs_build
+        run: make docs_build UV=uv
 
       - name: Verify rendering and flag-table generation
-        run: make docs_check
+        run: make docs_check UV=uv
 
       # On master pushes (and manual dispatch): refresh the rolling "dev" docs.
       - name: Deploy dev docs

{kapitan-0.36.3.dev6 → kapitan-0.36.4.dev6}/.github/workflows/pex-build-upload.yml

@@ -40,7 +40,6 @@ jobs:
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: |
-            3.10
             3.11
             3.12
             3.13
@@ -61,13 +60,14 @@ jobs:
       - name: Build Pex
         run: |-
           mkdir -p dist
-          uvx pex '.[gojsonnet,omegaconf,reclass-rs]' -r requirements.txt \
+          uvx pex '.[gojsonnet,omegaconf,reclass-rs,rapidyaml]' \
+            -r requirements.txt \
             --python-shebang='#!/usr/bin/env python3' \
             --python=python3.11 \
-            --python=python3.10 \
             --python=python3.12 \
             --python=python3.13 \
             --python=python3.14 \
+            --compile \
             -m kapitan \
             -o dist/kapitan.linux-x86_64.pex
           dist/kapitan.linux-x86_64.pex --help

{kapitan-0.36.3.dev6 → kapitan-0.36.4.dev6}/.github/workflows/python-pypi-publish-dev.yml

@@ -51,7 +51,7 @@ jobs:
           uvx twine check dist/*.whl dist/*.tar.gz
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}

{kapitan-0.36.3.dev6 → kapitan-0.36.4.dev6}/.github/workflows/python-pypi-publish.yml

@@ -81,7 +81,7 @@ jobs:
             release/kapitan-${{ steps.version.outputs.version }}.python.sbom.cdx.json
             release/SHA256SUMS
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}

{kapitan-0.36.3.dev6 → kapitan-0.36.4.dev6}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: kapitan
-Version: 0.36.3.dev6
+Version: 0.36.4.dev6
 Summary: Generic templated configuration management for Kubernetes, Terraform and other things
 Project-URL: Homepage, https://kapitan.dev
 Project-URL: Repository, https://github.com/kapicorp/kapitan

{kapitan-0.36.3.dev6 → kapitan-0.36.4.dev6}/docs/getting_started.md

@@ -53,7 +53,7 @@ Compiled echo-server (0.14s)
 ## running **Kapitan**
 
 !!! success "recommended"
-    ### `kapitan` wrapper script
+    **`kapitan` wrapper script**
     If you use the provided repository, we already package a `kapitan` shell script that wraps the docker command to run **Kapitan**
 
     ```shell
@@ -79,7 +79,7 @@ Compiled echo-server (0.14s)
 [![Releases](https://img.shields.io/github/release/kapicorp/kapitan.svg)](https://github.com/kapicorp/kapitan/releases){: aria-label="GitHub releases"}
 
 !!! success "recommended"
-    ### Docker
+    **Docker**
     ![Docker Pulls](https://img.shields.io/docker/pulls/kapicorp/kapitan)
     [![Docker Image Size](https://img.shields.io/docker/image-size/kapicorp/kapitan/latest.svg)](https://hub.docker.com/r/kapicorp/kapitan){: aria-label="Docker image size"}
     [![Docker](https://github.com/kapicorp/kapitan/workflows/Docker%20Build%20and%20Push/badge.svg)](https://github.com/kapicorp/kapitan/actions?query=workflow%3A%22Docker+Build+and+Push%22){: aria-label="Docker Build and Push status"}

kapitan-0.36.4.dev6/docs/pages/blog/posts/2026-06-25.md

@@ -0,0 +1,324 @@
+---
+author_gh_user: Moep90
+read_time: 12m
+date: 2026-06-25
+title: "Packaging an Air-Gapped Kubernetes Stack with Kapitan and OCM"
+description: "An end-to-end guide to building a self-contained, air-gapped Kubernetes bundle: template an OCM recipe with Kapitan, then package and ship it with the ocm CLI."
+---
+
+# Packaging an Air-Gapped Kubernetes Stack with Kapitan and OCM
+
+Air-gapped clusters are a recurring headache. You have a connected build host
+and a target cluster with no route to the internet, and somewhere between them
+sits a USB stick. Everything the cluster needs has to be packaged on the
+connected side: rendered manifests, Helm charts, and every container image those
+charts pull. The package must be genuinely self-contained, so that once it lands,
+the cluster pulls nothing from outside.
+
+This post walks through one end-to-end approach using two tools that fit
+together well: [Kapitan](https://kapitan.dev) for configuration, and the
+[Open Component Model](https://ocm.software) (OCM) for transport. The example
+packages a typical "day-0" platform stack (cert-manager, trust-manager, Harbor,
+Argo CD, and Loki/Grafana), but the pattern works for anything.
+
+## The one idea that makes this clean
+
+It is tempting to make Kapitan *build* the package: have `kapitan compile` shell
+out to the `ocm` CLI and emit a transport archive directly. It works, but it
+conflates two jobs.
+
+Kapitan is a templating engine. It is deterministic, runs offline, and turns
+configuration into rendered files. Building an OCM package is a different kind of
+work: pulling gigabytes of multi-architecture images and invoking an external
+CLI, with all the network, side effects, and large artifacts that implies. Those
+two jobs belong in different layers:
+
+```
+Kapitan (template)                       ocm (build / package)
+─────────────────────────                ─────────────────────────
+renders component-constructor.yaml   ->  ocm add component-version    (build)
+from inventory data                      ocm transfer --copy-resources (materialise)
+                                         ocm sign / verify / push
+```
+
+Kapitan emits the build recipe; a handful of shell steps cook it. That keeps to
+how Kapitan already works: it renders manifests and scripts, and leaves running
+them to the right tool. The payoff is that `kapitan compile` stays fast and
+offline, and `ocm` does the heavy lifting where retries, caching, and registry
+credentials already live.
+
+Everything below follows from that split.
+
+## Prerequisites
+
+- The new-generation `ocm` CLI (the `open-component-model` rewrite). Check with
+  `ocm version`.
+- `kapitan` and `helm`.
+- A connected build host, and a target environment with an internal OCI registry
+  (Harbor, Zot, or anything OCI 1.1 compliant).
+
+## Step 1 - List the charts
+
+The bundle is plain inventory data, and for the common case it is just a list of
+charts. You do not enumerate images: the ones each chart pulls are discovered
+from the chart itself in Step 3. You say what you want to install; the tooling
+works out what that drags in.
+
+```yaml
+# inventory/classes/components/ocm-airgap.yml
+parameters:
+  ocm_bundle:
+    component: example.org/platform/bootstrap
+    version: "0.1.0"
+    provider: example
+
+    charts:
+      - name: cert-manager
+        repo: https://charts.jetstack.io
+        version: v1.20.2
+      - name: harbor
+        repo: https://helm.goharbor.io
+        version: "1.19.1"
+      # … the rest of your stack
+```
+
+Some charts point their images at odd registries. Argo CD, for instance, has
+historically used a vendor mirror for its Redis image. When you need to pin or
+relocate one, add an explicit `images:` list here and let it override discovery;
+otherwise you leave it out and ship exactly what the charts render.
+
+## Step 2 - Template the OCM recipe
+
+OCM builds from a `component-constructor.yaml`. We render the chart side of it
+from the data above with a Jinja2 template:
+
+```jinja
+{% set b = inventory.parameters.ocm_bundle -%}
+# GENERATED by kapitan. Do not edit.
+components:
+  - name: {{ b.component }}
+    version: "{{ b.version }}"
+    provider:
+      name: {{ b.provider }}
+    resources:
+{% for c in b.charts %}
+      - name: {{ c.name }}-chart
+        type: helmChart
+        version: "{{ c.version }}"
+        input:
+          type: helm
+          path: charts/{{ c.name }}-{{ c.version }}.tgz
+{% endfor %}
+```
+
+Charts use `input.type: helm`, which embeds them by value from a local `.tgz` at
+construction time. The images come next, in Step 3, appended by reference
+(`access.type: ociArtifact`) once discovery has found them. By reference because
+the new-generation `ocm` only embeds images at construction with a separate
+plugin; referencing them now and materialising at transfer time (Step 5) is the
+idiomatic path, and it keeps `kapitan compile` cheap.
+
+Wire the template into a target as an ordinary `jinja2` input, with no `ocm`
+involved:
+
+```yaml
+# inventory/targets/airgap-bundle.yml
+classes:
+  - components.ocm-airgap
+parameters:
+  kapitan:
+    vars:
+      target: airgap-bundle
+    compile:
+      - output_path: ocm
+        input_type: jinja2
+        input_paths:
+          - templates/ocm/component-constructor.yaml
+```
+
+Render it:
+
+```bash
+kapitan compile -t airgap-bundle
+# -> compiled/airgap-bundle/ocm/component-constructor.yaml
+```
+
+That output is a valid `component-constructor.yaml` and nothing else. No network,
+no `ocm`, and it finishes in well under a second. It is the recipe.
+
+## Step 3 - Fetch the charts and discover their images
+
+Charts are embedded by value, so they have to exist locally before the build.
+Pull them once on the connected host:
+
+```bash
+helm repo add jetstack https://charts.jetstack.io
+helm repo add harbor    https://helm.goharbor.io
+# … your repos
+
+helm pull jetstack/cert-manager --version v1.20.2 -d lib/ocm/charts/
+helm pull harbor/harbor         --version 1.19.1  -d lib/ocm/charts/
+# … one per chart
+```
+
+The template referenced them as `charts/<name>-<version>.tgz`, relative to the
+directory we run `ocm` from next.
+
+Now discover the images. Render each chart, pull the image references out, and
+append them to the rendered constructor as `ociArtifact` resources. This is why
+the inventory only needed charts: the image list is computed, not typed by hand.
+
+```bash
+constructor=compiled/airgap-bundle/ocm/component-constructor.yaml
+for tgz in lib/ocm/charts/*.tgz; do
+  helm template release "$tgz" | yq '.. | .image? // empty'
+done | sort -u | while read -r ref; do
+  name=${ref##*/}; name=${name%%[:@]*}        # last path segment, minus tag/digest
+  yq -i ".components[0].resources += [{
+    \"name\": \"$name\",
+    \"type\": \"ociArtifact\",
+    \"version\": \"${ref##*:}\",
+    \"access\": {\"type\": \"ociArtifact\", \"imageReference\": \"$ref\"}
+  }]" "$constructor"
+done
+```
+
+That snippet is deliberately small; harden it for your stack (handle digests,
+dedupe, relocate registries). Because it is deterministic, you can run it in CI
+and fail the build when a chart bump introduces an image your registry does not
+mirror yet. If a chart points somewhere you do not trust, the optional `images:`
+override from Step 1 wins.
+
+## Step 4 - Build the CTF archive
+
+Now `ocm` enters, in a build script. `ocm add component-version` reads the
+rendered constructor and writes a CTF (Common Transport Format) archive, a
+directory holding an `artifact-index.json` and content-addressed blobs.
+
+One gotcha: `ocm` resolves a helm input's relative `path` against the process
+working directory, not against a flag. So run it from where the charts live:
+
+```bash
+cd lib/ocm
+ocm add component-version \
+  --repository ../../compiled/airgap-bundle/transport-archive \
+  --constructor ../../compiled/airgap-bundle/ocm/component-constructor.yaml \
+  --component-version-conflict-policy replace
+```
+
+Inspect the result:
+
+```bash
+ocm get cv \
+  "CTF::./compiled/airgap-bundle/transport-archive//example.org/platform/bootstrap:0.1.0" \
+  -o yaml
+```
+
+At this point the CTF is small, a few hundred kilobytes. It contains the chart
+bytes and a list of image *references*, each already pinned to a digest. The
+actual image payload is not in it yet. This is the half-step that surprises
+people: the archive looks like a package, but it is really a manifest plus charts.
+
+## Step 5 - Materialise by value, then build the ISO
+
+To make the archive self-contained, transfer it into a fresh CTF by value.
+`--copy-resources` downloads every referenced image and rewrites it as a local
+blob:
+
+```bash
+ocm transfer cv --copy-resources --recursive \
+  "CTF::./compiled/airgap-bundle/transport-archive//example.org/platform/bootstrap:0.1.0" \
+  "CTF::./transport-archive"
+```
+
+This is the slow, network-heavy step. Expect minutes and gigabytes, depending on
+your stack. When it finishes, check that the archive really has no external
+dependencies:
+
+```bash
+ocm get cv "CTF::./transport-archive//example.org/platform/bootstrap:0.1.0" -o yaml \
+  | grep -c 'imageReference:'   # expect 0
+```
+
+Zero external references means the cluster will pull nothing from the internet.
+That is the air-gap guarantee, and it is worth checking rather than assuming.
+
+Optionally sign the archive, then pack it into an ISO 9660 image. An ISO is a
+good fit for an air gap: a single immutable file you can mount read-only, burn
+to disc, or attach as virtual media to a server's BMC (iLO or iDRAC). Use `-R`
+(Rock Ridge) so the long sha256 blob filenames survive:
+
+```bash
+ocm sign cv --signature platform --private-key key.pem \
+  "CTF::./transport-archive//example.org/platform/bootstrap:0.1.0"
+
+xorriso -as mkisofs -R -J -joliet-long \
+  -V AIRGAP_BOOTSTRAP_0_1_0 \
+  -o bootstrap-0.1.0.iso transport-archive
+sha256sum bootstrap-0.1.0.iso > bootstrap-0.1.0.iso.sha256
+```
+
+## Step 6 - Import on the air-gapped side
+
+Carry the ISO across. On the target host, check integrity, extract the archive,
+verify the signature, and transfer into the internal registry. `ocm` relocates
+each image into that registry by digest. You can mount the ISO read-only
+(`mount -o loop,ro bootstrap-0.1.0.iso /mnt`), or extract it without root using
+`7z`:
+
+```bash
+sha256sum -c bootstrap-0.1.0.iso.sha256
+7z x bootstrap-0.1.0.iso -o./extracted
+
+ocm verify cv --signature platform --public-key key.pub \
+  "CTF::./extracted/transport-archive//example.org/platform/bootstrap:0.1.0"
+
+ocm transfer cv --copy-resources --recursive \
+  "CTF::./extracted/transport-archive//example.org/platform/bootstrap:0.1.0" \
+  registry.internal
+```
+
+From here, point Argo CD (or `kubectl`) at `registry.internal` for all images and
+charts. Nothing reaches outside the gap.
+
+## Gotchas worth knowing
+
+A few things cost real debugging time.
+
+By reference versus by value: in the new-generation `ocm`, images go in via
+`access: ociArtifact`, which is a reference. Embedding at construction needs a
+plugin. Materialise with `ocm transfer --copy-resources`, not at `add` time.
+
+Plain-HTTP registries: `ocm` defaults to HTTPS. For an unencrypted local
+registry, give the target an explicit `http://` scheme.
+
+Registry compatibility: the archive uses OCI 1.1 artifact manifests. An old
+`registry:2` (OCI 1.0) rejects them outright, while Harbor and Zot accept them.
+Some registries still trip over multi-architecture image indexes, so test your
+real target early.
+
+Multi-arch bloat: `--copy-resources` copies every architecture of each image by
+default. If your cluster is single-arch, filter them out. The full set can easily
+triple the archive size.
+
+Toolchain: Kapitan depends on `jsonnet`, which has no prebuilt wheel for the
+newest Python releases and compiles from source. On a host without a C++
+toolchain, install one (`brew install gcc`, then `CC=... CXX=... uv sync`) before
+anything else.
+
+## The shape of it
+
+The pipeline is four stages:
+
+```
+kapitan compile   ->  component-constructor.yaml      (template, offline)
+ocm add           ->  CTF (charts + image refs)        (build)
+ocm transfer      ->  self-contained CTF -> ISO        (materialise)
+ocm transfer      ->  internal registry                (import)
+```
+
+Kapitan stays a templating engine. `ocm` does the packaging. The boundary is the
+one Kapitan already draws everywhere: render the recipe, run it elsewhere. Keeping
+it makes each side simpler. The configuration stays reproducible and reviewable,
+and the build is something you can rerun, cache, and sign without touching your
+templates.

{kapitan-0.36.3.dev6 → kapitan-0.36.4.dev6}/docs/pages/external_dependencies.md

@@ -79,7 +79,7 @@ Kapitan also supports caching Use the `--cache` flag to cache the fetched items
 
 === "git"
 
-    ### Syntax
+    **Syntax**
 
     ```yaml
     parameters:
@@ -102,7 +102,7 @@ Kapitan also supports caching Use the `--cache` flag to cache the fetched items
 
         This type depends on the `git` binary installed on your system and available to **Kapitan**.
 
-    ### Example
+    **Example**
 
     Say we want to fetch the source code from our kapitan repository, specifically, `kapicorp/kapitan/kapitan/version.py`. Let's create a very simple target file `inventory/targets/kapitan-example.yml`.
 
@@ -127,7 +127,7 @@ Kapitan also supports caching Use the `--cache` flag to cache the fetched items
 
 === "http"
 
-    ### Syntax
+    **Syntax**
 
     ```yaml
     parameters:
@@ -143,7 +143,7 @@ Kapitan also supports caching Use the `--cache` flag to cache the fetched items
     2. http[s] types can fetch external dependencies available at `http://` or `https://` URL.
     3. archive mode: download and unpack
 
-    ### Example
+    **Example**
 
     === "Single file"
 
@@ -170,7 +170,7 @@ Kapitan also supports caching Use the `--cache` flag to cache the fetched items
 
 === "helm"
 
-    ### Syntax
+    **Syntax**
 
     ```yaml
     parameters:
@@ -192,7 +192,7 @@ Kapitan also supports caching Use the `--cache` flag to cache the fetched items
 
     `source` can be either the URL to a chart repository, or the URL to a chart on an OCI registry (supported since Helm 3.8.0).
 
-    ### Example
+    **Example**
 
     If we want to download the prometheus helm chart we simply add the dependency to the monitoring target.
     We want a specific version `11.3.0` so we put that in.
@@ -223,7 +223,7 @@ Kapitan also supports caching Use the `--cache` flag to cache the fetched items
 
 === "oci"
 
-    ### Syntax
+    **Syntax**
 
     ```yaml
     parameters:
@@ -253,7 +253,7 @@ Kapitan also supports caching Use the `--cache` flag to cache the fetched items
         For a full guide on packaging and publishing your own generator bundles, see
         [Publishing generators as OCI artifacts](publishing_generators.md).
 
-    ### Authentication
+    **Authentication**
 
     Credentials are never stored in the inventory. Kapitan supports two authentication approaches:
 
@@ -279,7 +279,7 @@ Kapitan also supports caching Use the `--cache` flag to cache the fetched items
 
     This is the preferred approach for CI/CD pipelines where credentials are injected as secrets.
 
-    ### Example
+    **Example**
 
     Fetching a Kapitan generator bundle published to GHCR and making it available as a Kadet component:
 

{kapitan-0.36.3.dev6 → kapitan-0.36.4.dev6}/kapitan/inventory/backends/omegaconf/resolvers.py

@@ -6,6 +6,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 import copy
+import inspect
 import logging
 import os
 import re
@@ -237,39 +238,52 @@ def condition_equal(*configs):
     return all(config == configs[0] for config in configs)
 
 
+def _register_resolver(name: str, resolver, replace: bool = False) -> None:
+    """Register a resolver using the non-deprecated OmegaConf API.
+
+    OmegaConf >= 2.4.0 deprecates register_new_resolver() in favour of
+    register_resolver(). Older releases only provide the legacy
+    register_resolver(), so fall back to register_new_resolver() there.
+    """
+    if "replace" in inspect.signature(OmegaConf.register_resolver).parameters:
+        OmegaConf.register_resolver(name, resolver, replace=replace)
+    else:
+        OmegaConf.register_new_resolver(name, resolver, replace=replace)
+
+
 def register_resolvers(inventory_path: str = None) -> None:
     """register pre-defined and user-defined resolvers"""
     replace = True
 
     # yaml key utility functions
-    OmegaConf.register_new_resolver("key", key, replace=replace)
-    OmegaConf.register_new_resolver("parentkey", parentkey, replace=replace)
-    OmegaConf.register_new_resolver("fullkey", fullkey, replace=replace)
-    OmegaConf.register_new_resolver("relpath", relpath, replace=replace)
+    _register_resolver("key", key, replace=replace)
+    _register_resolver("parentkey", parentkey, replace=replace)
+    _register_resolver("fullkey", fullkey, replace=replace)
+    _register_resolver("relpath", relpath, replace=replace)
 
     # yaml object utility functions
-    OmegaConf.register_new_resolver("access", access_key_with_dots, replace=replace)
-    OmegaConf.register_new_resolver("escape", escape_interpolation, replace=replace)
-    OmegaConf.register_new_resolver("merge", merge, replace=replace)
-    OmegaConf.register_new_resolver("dict", to_dict, replace=replace)
-    OmegaConf.register_new_resolver("list", to_list, replace=replace)
-    OmegaConf.register_new_resolver("yaml", to_yaml, replace=replace)
-    OmegaConf.register_new_resolver("add", lambda x, y: x + y, replace=replace)
-    OmegaConf.register_new_resolver("default", default, replace=replace)
-    OmegaConf.register_new_resolver("write", write_to_key, replace=replace)
-    OmegaConf.register_new_resolver("from_file", from_file, replace=replace)
-    OmegaConf.register_new_resolver("filename", filename, replace=replace)
-    OmegaConf.register_new_resolver("parent_filename", parent_filename, replace=replace)
-    OmegaConf.register_new_resolver("path", path, replace=replace)
-    OmegaConf.register_new_resolver("parent_path", parent_path, replace=replace)
+    _register_resolver("access", access_key_with_dots, replace=replace)
+    _register_resolver("escape", escape_interpolation, replace=replace)
+    _register_resolver("merge", merge, replace=replace)
+    _register_resolver("dict", to_dict, replace=replace)
+    _register_resolver("list", to_list, replace=replace)
+    _register_resolver("yaml", to_yaml, replace=replace)
+    _register_resolver("add", lambda x, y: x + y, replace=replace)
+    _register_resolver("default", default, replace=replace)
+    _register_resolver("write", write_to_key, replace=replace)
+    _register_resolver("from_file", from_file, replace=replace)
+    _register_resolver("filename", filename, replace=replace)
+    _register_resolver("parent_filename", parent_filename, replace=replace)
+    _register_resolver("path", path, replace=replace)
+    _register_resolver("parent_path", parent_path, replace=replace)
 
     # boolean algebra
-    OmegaConf.register_new_resolver("if", condition_if, replace=replace)
-    OmegaConf.register_new_resolver("ifelse", condition_if_else, replace=replace)
-    OmegaConf.register_new_resolver("and", condition_and, replace=replace)
-    OmegaConf.register_new_resolver("or", condition_or, replace=replace)
-    OmegaConf.register_new_resolver("not", condition_not, replace=replace)
-    OmegaConf.register_new_resolver("equal", condition_equal, replace=replace)
+    _register_resolver("if", condition_if, replace=replace)
+    _register_resolver("ifelse", condition_if_else, replace=replace)
+    _register_resolver("and", condition_and, replace=replace)
+    _register_resolver("or", condition_or, replace=replace)
+    _register_resolver("not", condition_not, replace=replace)
+    _register_resolver("equal", condition_equal, replace=replace)
 
     # user defined resolvers - check inventory path first, then fall back to system path
     user_resolver_file = None
@@ -314,6 +328,6 @@ def register_user_resolvers(user_resolver_file: str) -> None:
 
     for name, func in funcs.items():
         try:
-            OmegaConf.register_new_resolver(name, func, replace=True)
+            _register_resolver(name, func, replace=True)
         except Exception as e:
             logger.warning(f"Could not load resolver {name}: {e}")

{kapitan-0.36.3.dev6 → kapitan-0.36.4.dev6}/tests/test_docs_rendering.py

@@ -114,6 +114,52 @@ def _parse_frontmatter(text):
     return data if isinstance(data, dict) else {}
 
 
+# --- Content-tab heading leak guard ----------------------------------------
+#
+# pymdownx.tabbed content is indented under `=== "label"` markers. A real ATX
+# heading (### ...) placed inside a tab still lands in the page's table of
+# contents, regardless of which tab is active. With repeated tabs (git/http/
+# helm/oci each carrying their own "### Syntax"/"### Example") the TOC fills
+# with duplicated, out-of-order entries. Headings inside tabs must be demoted
+# to bold text (**Syntax**); only code comments may be indented under a tab.
+#
+# Detection: an ATX heading is always at column 0 in well-formed Markdown. Any
+# indented `#...` line that is NOT inside a fenced code block is a heading that
+# leaked into tab content.
+
+_FENCE_RE = re.compile(r"^\s*(`{3,}|~{3,})")
+_INDENTED_HEADING_RE = re.compile(r"^[ \t]+#{1,6}\s")
+
+
+def _indented_headings_outside_fences(text):
+    """Return (line_no, line) for ATX headings indented under content tabs."""
+    offenders = []
+    fence = None  # the opening fence token while inside a code block
+    for i, line in enumerate(text.splitlines(), start=1):
+        m = _FENCE_RE.match(line)
+        if m:
+            token = m.group(1)[0]  # ` or ~
+            if fence is None:
+                fence = token
+            elif token == fence:
+                fence = None
+            continue
+        if fence is None and _INDENTED_HEADING_RE.match(line):
+            offenders.append((i, line.rstrip()))
+    return offenders
+
+
+@pytest.mark.parametrize("page", _docs_pages(), ids=_page_id)
+def test_docs_page_has_no_tab_nested_headings(page):
+    offenders = _indented_headings_outside_fences(page.read_text(encoding="utf-8"))
+    rel = _page_id(page)
+    assert not offenders, (
+        f"{rel}: ATX heading(s) indented inside a content tab leak into the page "
+        f"TOC; demote to bold (**Heading**): "
+        + "; ".join(f"L{n}: {ln.strip()}" for n, ln in offenders)
+    )
+
+
 @pytest.mark.parametrize("page", _docs_pages(), ids=_page_id)
 def test_docs_page_has_seo_frontmatter(page):
     frontmatter = _parse_frontmatter(page.read_text(encoding="utf-8"))

{kapitan-0.36.3.dev6 → kapitan-0.36.4.dev6}/tests/test_omegaconf.py

@@ -214,3 +214,18 @@ class TestOmegaConfInventoryMigrationTiming(unittest.TestCase):
             content = f.read()
         self.assertIn("${shared.name}", content)
         self.assertNotIn("${shared:name}", content)
+
+
+class RegisterResolversApiTest(unittest.TestCase):
+    def test_register_resolvers_avoids_deprecated_register_new_resolver(self):
+        import inspect
+        from unittest import mock
+
+        from omegaconf import OmegaConf
+
+        if "replace" not in inspect.signature(OmegaConf.register_resolver).parameters:
+            self.skipTest("OmegaConf.register_resolver() is the legacy API")
+
+        with mock.patch.object(OmegaConf, "register_new_resolver") as deprecated:
+            register_resolvers()
+        deprecated.assert_not_called()