// the find
kapicorp/kapitan
Generic templated configuration management for Kubernetes, Terraform and other things
Kapitan is a configuration management tool that sits above Helm, Kustomize, Jsonnet, and Terraform — you define a hierarchical inventory once, then compile it into rendered output for all your targets. It's for platform engineering teams managing the same services across many environments who are tired of duplicating values across separate toolchains.
The inventory-driven model with reclass classes genuinely solves the copy-paste problem that plagues large multi-env setups — a single class change propagates everywhere. Native secret management covering GPG, Vault, AWS/GCP/Azure KMS is built-in rather than bolted on, which is rare for this kind of tool. Supporting Jsonnet, Jinja2, Helm, Kustomize, and CUE as input types means teams don't have to rewrite existing templates to adopt it. The compile step produces fully rendered plain-text output, which plays well with GitOps pipelines and makes diffs meaningful.
The learning curve is steep — you have to internalize reclass's class/target model plus whichever input types you're using, and the documentation doesn't bridge that gap well for newcomers. At under 2k stars, the community is small; if you hit an obscure edge case with a KMS backend or the CUE input type, you may be debugging it yourself. The inventory abstraction adds a layer of indirection that makes debugging non-trivial — when compiled output is wrong, tracing which class contributed the bad value requires familiarity with how reclass merges. Python dependency chain makes installation brittle on teams that don't control their Python environments, which is why the Docker image is the recommended path.