v1.226.0-rc.2

fix(kubernetes): single-file GitOps delivery and Kustomize metadata.name exemption Erik Osterman (Cloud Posse) (@osterman) (#2874)

## what

• kubernetes.gitops.provision.targets.<name> (kind: git) now supports a split tri-state: split: false writes path as a single merged multi-document YAML file instead of always treating path as a directory of auto-named files; unset infers the mode from whether path's last segment looks like a manifest filename (.yaml/.yml/.json).
• Atmos's structural manifest validator no longer requires metadata.name on Kustomize's own Kustomization/Component objects (matched against sigs.k8s.io/kustomize/api/types's own kind/version constants), since Kustomize's own schema and field-enforcement never require one.
• A new validate: false component-level flag opts a component out of both the apply/deploy structural auto-gate and the standalone atmos kubernetes validate command.
• Docs: new "Generating a Kustomize component for GitOps" walkthrough, split documented on kubernetes-deploy.mdx, and the Kustomize exemption / validate: false documented on kubernetes-validate.mdx.
• Changelog post and a new shipped roadmap milestone (with a corrected progress percentage) for the Extensibility initiative.

why

• A git provision target's path was always treated as a directory, so configuring path: ".../kustomization.yaml" created a directory by that name containing an auto-generated file inside it, instead of the exact file Kustomize's remote-include mechanism requires.
• The validator required metadata.name unconditionally, forcing users to add a meaningless name to Kustomize Component/Kustomization objects just to satisfy Atmos, even though Kustomize's own tooling never requires one.
• Together these blocked a real GitOps pattern: rendering a Kustomize patch/component with Terraform-derived values (e.g. via !terraform.state) and committing it to a deployment repo as a proper kustomization.yaml for Argo CD/Flux to consume.

references

• N/A

Summary by CodeRabbit

• New Features

  • Git delivery supports single-file or directory output via split, with automatic mode selection based on the destination path.
  • Kustomize Kustomization and Component objects no longer require metadata.name.
  • Added an optional Kubernetes validate setting to bypass offline structural validation.
  • Successful Kubernetes deliveries now display a confirmation message.

• Bug Fixes

  • Validation-disabled deployments and validation commands now behave correctly; server validation remains available.
  • Git operation errors now include provider details and actionable guidance.

• Documentation

  • Added configuration guidance and GitOps examples for single-file delivery and Kustomize workflows.

🚀 Enhancements

fix(ci): Docker build image mirrors and concurrent output race Erik Osterman (Cloud Posse) (@osterman) (#2884)

## what

• Bump cloudposse/github-action-docker-build-push from v3.0.0 to v3.1.0 in the release docker job (.github/workflows/build.yml).
• Explicitly override the action's binfmt-image input to mirror.gcr.io/tonistiigi/binfmt:qemu-v7.0.0.
• Hold the shared output lock for an entire flush (not per line) in LinePrefixWriter (pkg/io/line_prefix_writer.go), so concurrent Terraform node writers can't interleave a line mid-block.

why

• The release Docker build job was failing due to rate limiting when pulling its buildx builder (moby/buildkit) and QEMU binfmt images from public.ecr.aws.
• v3.1.0 of the action switches the buildx builder's default image to the Google mirror (mirror.gcr.io/moby/buildkit), fixing that pull. The action's binfmt-image input still defaults to public.ecr.aws/eks-distro-build-tooling/binfmt-misc even at v3.1.0 (no upstream fix yet), so it's overridden here directly to the equivalent Google-mirrored tonistiigi/binfmt image, which publishes the same qemu-v7.0.0 tag. Verified live: both mirror.gcr.io/tonistiigi/binfmt:qemu-v7.0.0 and docker.io/tonistiigi/binfmt:qemu-v7.0.0 resolve to the same digest and pull successfully; mirror.gcr.io also falls through to Docker Hub origin on any cache miss, so it's never less reliable than a direct Docker Hub pull.
• Separately, the macOS Acceptance Tests job was failing TestExecuteTerraformConcurrentHooksUseNodeWriters (pkg/scheduler/adapters) with a real, reproducible race: LinePrefixWriter.writeLine acquired/released the shared output mutex per line, so a single Write() call that produced multiple lines (e.g. a hook's buffered \r-then-\n progress update) could have a different node's writer interleave a line in between, corrupting concurrent Terraform output. Reproduced with go test -race -count=200 before the fix (intermittent failures) and confirmed 200/200 clean after.
• Both fixes address CI reliability issues discovered while investigating unrelated failures on this branch; neither changes the shipped Atmos CLI's behavior for end users.

references

• Upstream fix: cloudposse/github-action-docker-build-push v3.1.0
• CI failure: Acceptance Tests (macos), job 92489708710