fix(docs): use correct Kustomize Component apiVersion, close coverage gap

Address CodeRabbit full-review findings on #2874:
- All Component examples/fixtures used kustomize.config.k8s.io/v1beta1,
  which is Kustomization's version, not Component's (v1alpha1). Since
  isKustomizeConfigObject matches exact (apiVersion, kind) pairs, the
  examples never actually got the metadata.name exemption they claimed.
  Fixed in the blog post, the kubernetes.mdx walkthrough, and test
  fixtures; kubernetes-validate.mdx now documents both exact pairs
  instead of a kustomize.config.k8s.io/* wildcard.
- Added TestWriteArtifactSingleFileModeWriteFailure, closing the patch
  coverage gap Codecov flagged on writeSingleArtifactFile's two new
  error branches (MkdirAll/WriteFile failure), mirroring the existing
  split=true failure test.

Author: osterman

pkg/provisioner/target/git/git_test.go

@@ -248,7 +248,7 @@ func TestWriteArtifactSingleFileMode(t *testing.T) {
 	path := filepath.Join("kustomize", "overlays", "prod", "kustomization.yaml")
 
 	artifact := &target.ProvisionArtifact{Files: map[string][]byte{
-		"001_kustomize.config.k8s.io_v1beta1_Component_cert-manager.yaml": []byte("apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Component\n"),
+		"001_kustomize.config.k8s.io_v1alpha1_Component_cert-manager.yaml": []byte("apiVersion: kustomize.config.k8s.io/v1alpha1\nkind: Component\n"),
 	}}
 	require.NoError(t, writeArtifact(workdir, path, artifact, false))
 
@@ -259,7 +259,7 @@ func TestWriteArtifactSingleFileMode(t *testing.T) {
 
 	got, err := os.ReadFile(abs)
 	require.NoError(t, err)
-	assert.Equal(t, "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Component\n", string(got))
+	assert.Equal(t, "apiVersion: kustomize.config.k8s.io/v1alpha1\nkind: Component\n", string(got))
 }
 
 func TestWriteArtifactSingleFileModeMergesMultipleDocuments(t *testing.T) {
@@ -287,7 +287,7 @@ func TestWriteArtifactSingleFileModeReplacesExistingDirectory(t *testing.T) {
 	require.NoError(t, os.MkdirAll(filepath.Join(stale, "001_stale.yaml"), 0o755))
 
 	artifact := &target.ProvisionArtifact{Files: map[string][]byte{
-		"001_kustomize.config.k8s.io_v1beta1_Component.yaml": []byte("kind: Component\n"),
+		"001_kustomize.config.k8s.io_v1alpha1_Component.yaml": []byte("kind: Component\n"),
 	}}
 	require.NoError(t, writeArtifact(workdir, path, artifact, false))
 
@@ -320,6 +320,30 @@ func TestWriteArtifactWriteFailure(t *testing.T) {
 	assert.ErrorIs(t, err, errUtils.ErrGitArtifactWrite)
 }
 
+func TestWriteArtifactSingleFileModeWriteFailure(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("file-mode permissions behave differently on Windows")
+	}
+	if currentUser, userErr := user.Current(); userErr == nil && (currentUser.Uid == "0" || currentUser.Username == "root") {
+		t.Skip("running as root ignores filesystem permissions")
+	}
+
+	workdir := t.TempDir()
+	// Make a read-only managed-path parent so writeSingleArtifactFile's
+	// MkdirAll/WriteFile under it fail.
+	managed := filepath.Join(workdir, "clusters")
+	require.NoError(t, os.Mkdir(managed, 0o555))
+	t.Cleanup(func() {
+		_ = os.Chmod(managed, 0o755)
+	})
+
+	err := writeArtifact(workdir, filepath.Join("clusters", "dev", "manifest.yaml"), &target.ProvisionArtifact{Files: map[string][]byte{
+		"namespace.yaml": []byte("kind: Namespace\n"),
+	}}, false)
+	require.Error(t, err)
+	assert.ErrorIs(t, err, errUtils.ErrGitArtifactWrite)
+}
+
 func TestDeliverProviderNotFound(t *testing.T) {
 	g := &gitProvisioner{}
 	atmosConfig := &schema.AtmosConfiguration{

website/blog/2026-08-05-kustomize-gitops-delivery.mdx

@@ -54,7 +54,7 @@ components:
             commit:
               message: "Render manifests for {{ .vars.environment }}"
       manifests:
-        - apiVersion: kustomize.config.k8s.io/v1beta1
+        - apiVersion: kustomize.config.k8s.io/v1alpha1
           kind: Component
           patches:
             - target:

website/docs/cli/commands/kubernetes/kubernetes-validate.mdx

@@ -103,14 +103,19 @@ With `--server`:
 
 ### Kustomize config objects
 
-Kustomize's own `Kustomization` and `Component` objects
-(`apiVersion: kustomize.config.k8s.io/*`) are not Kubernetes API resources —
-they are local input consumed by the `kustomize` build tool itself, and
-Kustomize does not require (or, historically, even permit) a `metadata.name`
-on them. `validate` recognizes these two kinds specifically and does not
-require `metadata.name` for them; every other offline check (a resolvable
-group/version/kind, and DNS-1123 validity for a name that *is* given) still
-applies. See
+Kustomize's own `Kustomization` and `Component` objects are not Kubernetes API
+resources — they are local input consumed by the `kustomize` build tool
+itself, and Kustomize does not require (or, historically, even permit) a
+`metadata.name` on them. `validate` recognizes these two exact, versioned
+pairs and does not require `metadata.name` for them:
+
+- `apiVersion: kustomize.config.k8s.io/v1beta1`, `kind: Kustomization`
+- `apiVersion: kustomize.config.k8s.io/v1alpha1`, `kind: Component`
+
+A `Kustomization`/`Component` object at a different `apiVersion` is not
+recognized and still requires `metadata.name`. Every other offline check (a
+resolvable group/version/kind, and DNS-1123 validity for a name that *is*
+given) still applies regardless. See
 [Generating a Kustomize component for GitOps](/stacks/components/kubernetes#generating-a-kustomize-component-for-gitops)
 for the pattern this supports.
 

website/docs/stacks/components/kubernetes.mdx

@@ -267,7 +267,7 @@ components:
             commit:
               message: "Render manifests for {{ .vars.environment }}"
       manifests:
-        - apiVersion: kustomize.config.k8s.io/v1beta1
+        - apiVersion: kustomize.config.k8s.io/v1alpha1
           kind: Component
           patches:
             - target: