Kapitan generators for Kubernetes and Terraform: a signed, gate-checked Helm alternative
Every listed version of these Kapitan generators is gate-checked: it passed secret, malware and code scans, a fixture compile in a gVisor sandbox without network and a maintainer's review. It is published as an attested OCI artifact that you pin by digest.
Use a generatorAdd a generatorRequest a generatorWanted generators
Generators
-
Renders Argo CD Applications, ApplicationSets and AppProjects from inventory parameters, including one Application per target that publishes a Kapitan topic, and optionally Argo CD itself from its release manifest with a Kapitan config management plugin.
- Built for
- Argo CD 3.5.6
- Maintainer
- Moep90
- Popularity
- 28
- Scanned
- 2026-11-05
-
Renders the Tigera operator resources that install Calico and the Calico network policies, network sets, IP pools and BGP resources from inventory parameters.
- Built for
- Calico 3.33.0Tigera operator 1.44.0
- Maintainer
- Moep90
- Popularity
- 23
- Scanned
- 2026-11-05
-
Renders cert-manager Certificates, Issuers, ClusterIssuers and trust-manager Bundles from inventory parameters.
- Built for
- cert-manager 1.21.3trust-manager 0.26.0
- Maintainer
- Moep90
- Popularity
- 27
- Scanned
- 2026-11-05
-
Renders Cilium network policies, LB-IPAM pools and L2 announcement policies from inventory parameters.
- Built for
- Cilium 1.20.4
- Maintainer
- Moep90
- Popularity
- 25
- Scanned
- 2026-10-30
-
Renders CloudNativePG Clusters, Databases, Poolers, ScheduledBackups and Backups and Barman Cloud Plugin ObjectStores from inventory parameters.
- Built for
- Barman Cloud Plugin 0.15.1CloudNativePG 1.30.1
- Maintainer
- Moep90
- Popularity
- 30
- Scanned
- 2026-11-05
-
Renders Crossplane v2 Providers, Functions, CompositeResourceDefinitions, Compositions and ProviderConfigs from inventory parameters.
- Built for
- Crossplane 2.4.3Crossplane Provider AWS 2.9.0
- Maintainer
- Moep90
- Popularity
- 22
- Scanned
- 2026-10-30
-
Renders Dockerfiles, single- or multi-stage, from short image descriptions in the inventory, with package installation for the base image's distribution and non-root user setup, and a Docker Compose file from the kubernetes generator's components.
- Built for
- not recorded
- Maintainer
- Moep90
- Popularity
- 20
- Scanned
- 2026-11-07
-
Renders External Secrets Operator SecretStores, ClusterSecretStores and ExternalSecrets from inventory parameters.
- Built for
- External Secrets Operator 2.14.0
- Maintainer
- Moep90
- Popularity
- 25
- Scanned
- 2026-10-30
-
Renders Flux GitRepositories, OCIRepositories, HelmRepositories, Kustomizations and HelmReleases from inventory parameters, linking each consumer to its source by name.
- Built for
- Flux helm-controller 1.7.1Flux kustomize-controller 1.10.1Flux source-controller 1.10.1
- Maintainer
- Moep90
- Popularity
- 27
- Scanned
- 2026-10-30
-
Renders Grafana Operator instances, dashboards, datasources, folders and alerting resources from inventory parameters.
- Built for
- Grafana Operator 5.25.0
- Maintainer
- Moep90
- Popularity
- 24
- Scanned
- 2026-11-05
-
Renders IronCore Machines, Volumes, Networks, NetworkInterfaces, VirtualIPs, LoadBalancers, NATGateways and NetworkPolicies from inventory parameters.
- Built for
- IronCore 0.9.0
- Maintainer
- Moep90
- Popularity
- 21
- Scanned
- 2026-11-12
-
Renders k3d cluster config files (k3d.io/v1alpha5 Simple) for k3d cluster create --config.
- Built for
- k3d 5.9.0
- Maintainer
- Moep90
- Popularity
- 20
- Scanned
- 2026-11-05
-
Renders KEDA ScaledObjects, ScaledJobs and TriggerAuthentications from inventory parameters.
- Built for
- KEDA 2.21.0
- Maintainer
- Moep90
- Popularity
- 24
- Scanned
- 2026-11-05
-
Renders Keycloak Operator Keycloak instances and KeycloakRealmImports from inventory parameters.
- Built for
- Keycloak Operator 26.8.2
- Maintainer
- Moep90
- Popularity
- 26
- Scanned
- 2026-11-12
-
Renders kind (Kubernetes IN Docker) cluster configuration files from inventory parameters, with digest-pinned node images by Kubernetes version.
- Built for
- not recorded
- Maintainer
- Moep90
- Popularity
- 20
- Scanned
- 2026-11-05
-
Renders kmcp MCPServer resources that deploy Model Context Protocol servers on Kubernetes.
- Built for
- kmcp 0.4.0
- Maintainer
- Moep90
- Popularity
- 22
- Scanned
- 2026-11-05
-
Renders KServe InferenceServices, runtimes, graphs, local model caches and LLMInferenceServices from inventory parameters.
- Built for
- KServe 0.21.0
- Maintainer
- Moep90
- Popularity
- 22
- Scanned
- 2026-11-05
-
Renders Kubernetes workloads with their Services, ConfigMaps, Secrets, RBAC, autoscaling, NetworkPolicies and volumes from one component block, plus Ingress, Gateway API and cluster policy resources.
- Built for
- Chainsaw 0.2.15GKE Managed Certificates 1.2.12Gateway API 1.7.0Kubernetes 1.37.2Vertical Pod Autoscaler 1.8.1
- Maintainer
- Moep90
- Popularity
- 34
- Scanned
- 2026-11-07
-
Renders KubeVirt VirtualMachines, VMIs, pools, snapshots, CDI DataVolumes and the KubeVirt CSI driver from inventory parameters.
- Built for
- KubeVirt 1.9.1KubeVirt Containerized Data Importer (CDI) 1.66.1Kubernetes 1.37.2Kubernetes CSI external-snapshotter 8.7.0
- Maintainer
- Moep90
- Popularity
- 26
- Scanned
- 2026-11-02
-
Renders Kyverno ValidatingPolicies, MutatingPolicies, GeneratingPolicies, DeletingPolicies and PolicyExceptions, and the legacy ClusterPolicies, Policies and cleanup policies, from inventory parameters.
- Built for
- Kyverno 1.19.2
- Maintainer
- Moep90
- Popularity
- 24
- Scanned
- 2026-10-30
-
Renders Linkerd Servers, authorization policies, authentications, HTTPRoutes and ServiceProfiles from inventory parameters.
- Built for
- Linkerd edge-26.10.3
- Maintainer
- Moep90
- Popularity
- 23
- Scanned
- 2026-11-02
-
Renders Loki Operator LokiStacks, AlertingRules, RecordingRules and RulerConfigs from inventory parameters.
- Built for
- not recorded
- Maintainer
- Moep90
- Popularity
- 22
- Scanned
- 2026-11-05
-
Renders Multus CNI NetworkAttachmentDefinitions from inventory parameters, serialising structured CNI config to JSON.
- Built for
- Multus CNI 4.3.2
- Maintainer
- Moep90
- Popularity
- 23
- Scanned
- 2026-11-12
-
Patches the YAML an earlier compile entry wrote, such as a rendered Helm chart, in place with mutations keyed by id that match objects exactly and merge, keyed-list merge, JSON Patch, delete, retag images or move them to another file, failing when a mutation matches nothing.
- Built for
- Kubernetes 1.37.2
- Maintainer
- Moep90
- Popularity
- 27
- Scanned
- 2026-11-02
-
Writes an OCM component constructor for a target, with every container image of the manifests earlier compile entries wrote as an ociImage resource, an access template for mirrors and pull-through caches, and resources from the inventory for the rest.
- Built for
- not recorded
- Maintainer
- Moep90
- Popularity
- 18
- Scanned
- 2026-11-05
-
Renders OpenTelemetry Operator collectors, Instrumentations, TargetAllocators and OpAMPBridges from inventory parameters.
- Built for
- OpenTelemetry Operator 0.162.0
- Maintainer
- Moep90
- Popularity
- 23
- Scanned
- 2026-10-30
-
Renders Prometheus Operator Prometheus, PrometheusAgent, Alertmanager, AlertmanagerConfig, ThanosRuler, Probe, ScrapeConfig, ServiceMonitor, PodMonitor and PrometheusRule resources, plus Prometheus RBAC, from inventory parameters.
- Built for
- Kubernetes 1.37.2Prometheus Operator 0.95.1
- Maintainer
- Moep90
- Popularity
- 26
- Scanned
- 2026-11-12
-
Renders RabbitMQ Cluster Operator and Messaging Topology Operator resources, with their ConfigMaps and Secrets, from inventory parameters.
- Built for
- Kubernetes 1.37.2RabbitMQ Cluster Operator / Messaging Topology Operator 2.23.2 / 1.20.5
- Maintainer
- Moep90
- Popularity
- 26
- Scanned
- 2026-11-02
-
Renders Rook Ceph clusters, pools, filesystems, object stores, NFS, RBD mirrors and CephX clients from inventory parameters.
- Built for
- Rook 1.21.2
- Maintainer
- Moep90
- Popularity
- 22
- Scanned
- 2026-11-12
-
Renders Strimzi Kafka clusters with their KafkaNodePools, KafkaTopics and KafkaUsers from inventory parameters.
- Built for
- Strimzi 1.3.1
- Maintainer
- Moep90
- Popularity
- 25
- Scanned
- 2026-11-12
-
Renders Talos v1.14 machine configurations (v1alpha1 base plus multi-document kinds) for every node of a cluster from one shared base, with optional KubeVirt userdata Secrets and config patches.
- Built for
- Kubernetes 1.37.2Talos 1.14.5
- Maintainer
- Moep90
- Popularity
- 25
- Scanned
- 2026-11-02
-
Renders Terraform JSON for AWS VPCs with subnets, routing and NAT, and hardened S3 buckets, pinned to hashicorp/aws.
- Built for
- hashicorp/aws 6.72.0
- Maintainer
- Moep90
- Popularity
- 24
- Scanned
- 2026-11-12
-
Renders Terraform JSON for Azure virtual networks with derived subnets and network security groups, and for storage accounts with private containers.
- Built for
- hashicorp/azurerm 5.13.0
- Maintainer
- Moep90
- Popularity
- 23
- Scanned
- 2026-11-12
-
Renders Google Cloud VPC networks with subnets, Cloud NAT and firewall rules, and Cloud Storage buckets with IAM members, as Terraform JSON.
- Built for
- hashicorp/google 8.10.0
- Maintainer
- Moep90
- Popularity
- 23
- Scanned
- 2026-11-12
-
Renders Terraform JSON for Open Telekom Cloud VPC networks with NAT egress and KMS-encrypted OBS buckets.
- Built for
- opentelekomcloud/opentelekomcloud 1.37.12
- Maintainer
- Moep90
- Popularity
- 22
- Scanned
- 2026-11-12
-
Renders Tetragon TracingPolicies and TracingPolicyNamespaced from inventory parameters.
- Built for
- Tetragon 1.8.0
- Maintainer
- Moep90
- Popularity
- 19
- Scanned
- 2026-11-02
-
Renders Thanos Operator ThanosQuery, ThanosReceive, ThanosRuler, ThanosStore and ThanosCompact resources from inventory parameters.
- Built for
- Thanos Operator main@1b6edfb
- Maintainer
- Moep90
- Popularity
- 22
- Scanned
- 2026-11-05
-
Renders Velero Backups, Schedules, Restores and storage locations from inventory parameters.
- Built for
- Velero 1.18.4
- Maintainer
- Moep90
- Popularity
- 24
- Scanned
- 2026-11-05
No generator matches. or request one.
How a version gets listed
How kadet-hub works follows the whole process with diagrams, from the pull request to your compile.
Scanned
The gate scans the generator's source for leaked secrets, malware patterns and risky code before anything runs. A finding fails the pull request that registers the version.
Compiled in a sandbox
Its fixture targets compile in a gVisor sandbox without network, on every inventory backend it declares and again with Kapitan's cache. The output is validated against the shipped JSON Schemas and dry-run against a throwaway kube-apiserver with the operators' own CRDs.
Reviewed, signed and pinned
A maintainer reviews the gate report. The version is published as an OCI artifact with a Sigstore signature, an SBOM and a transparency log entry, and you pin it by digest in your inventory. How to consume a generator.