cert-manager is a Kubernetes add-on to automate the management and issuance of TLS certificates from various issuing sources. It will ensure certificates are valid and up to date periodically, and attempt to renew certificates at an appropriate time before expiry.
 
It is easy to use Kubernetes-native certificate management. It supports Let's Encrypt, HashiCorp Vault, Venafi and private PKI.

cert-manager is a Kubernetes add-on to automate the management and issuance of TLS certificates from various issuing sources. It will ensure certificates are valid and up to date periodically, and attempt to renew certificates at an appropriate time before expiry.

cert-manager - Automatically provision and manage TLS certificates in Kubernetes

kube-monkey is an implementation of Netflix's Chaos Monkey for Kubernetes clusters. It randomly deletes Kubernetes (k8s) pods in the cluster encouraging and validating the development of failure-resilient services.
 
It runs at a pre-configured hour (run_hour, defaults to 8 am) on weekdays, and builds a schedule of deployments that will face a random Pod death sometime during the same day. The time-range during the day when the random pod Death might occur is configurable and defaults to 10 am to 4 pm.

kube-monkey is an implementation of Netflix's Chaos Monkey for Kubernetes clusters. It randomly deletes Kubernetes (k8s) pods in the cluster encouraging and validating the development of failure-resilient services.



kube-monkey - An implementation of Netflix's Chaos Monkey for Kubernetes clusters

Rook is an open source cloud-native storage orchestrator for Kubernetes, providing the platform, framework, and support for a diverse set of storage solutions to natively integrate with cloud-native environments. Rook turns storage software into self-managing, self-scaling, and self-healing storage services. It does this by automating deployment, bootstrapping, configuration, provisioning, scaling, upgrading, migration, disaster recovery, monitoring, and resource management. Rook uses the facilities provided by the underlying cloud-native container management, scheduling and orchestration platform to perform its duties.

Rook is an open source cloud-native storage orchestrator for Kubernetes, providing the platform, framework, and support for a diverse set of storage solutions to natively integrate with cloud-native environments. 

Rook - Storage Orchestration for Kubernetes

The Fn project is a container native serverless platform that you can run anywhere -- any cloud or on-premise. It’s easy to use, supports every programming language, and is extensible and performant. Fn packages your functions as containers and runs on any platform supporting Docker. Push your functions to a repository and deploy anywhere--your laptop or the cloud. 


Fn - The container native, cloud agnostic serverless platform.

Weave is a simple, portable and reliable way to network and manage containers and microservices. It provides a simple and resilient network for your application that is portable across data centers and public clouds. Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Applications use the network just as if the containers were all plugged into the same network switch, without having to configure port mappings, ambassadors or links.
 
Services provided by application containers on the Weave network can be exposed to the outside world, regardless of where they are running. Similarly, existing internal systems can be opened to accept connections from application containers irrespective of their location.

Weave is a simple, portable and reliable way to network and manage containers and microservices. It provides a simple and resilient network for your application that is portable across data centers and public clouds. Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. 

Weave - Simple, Resilient Multi-host Docker Networking

OpenEBS is containerized block storage written in Go for cloud native and other environments w/ per container (or pod) QoS SLAs, tiering and replica policies across AZs and environments, and predictable and scalable performance.
 
OpenEBS allows you to treat your persistent workload containers, such as DBs on containers, just like other containers. OpenEBS itself is deployed as just another container on your host, and enables storage services that can be designated on a per pod, application, cluster or container level, including:
<ul>
<li>Data persistence across nodes, dramatically reducing time spent rebuilding Cassandra rings for example</li>
<li>Synchronization of data across availability zones and cloud providers</li>
<li>Use of commodity hardware plus a container engine to deliver seriously scale out block storage</li>
<li>Integration with orchestrators, so that developer and application intent flows into OpenEBS configurations automatically</li>
<li>Management of tiering to and from S3 and other targets</li>
<li>Plus we are bringing our experience from BSD based containerization and delivering QoS for customers from our CloudByte experience over to OpenEBS - expect to see more intelligence and manageability</li>
</ul>

OpenEBS is containerized block storage written in Go for cloud native and other environments w/ per container (or pod) QoS SLAs, tiering and replica policies across AZs and environments, and predictable and scalable performance. 


OpenEBS - Containerized Storage for Containers

CRI-O is an OCI-based implementation of Kubernetes Container Runtime Interface. CRI-O is meant to provide an integration path between OCI conformant runtimes and the kubelet. Specifically, it implements the Kubelet Container Runtime Interface (CRI) using OCI conformant runtimes. The scope of CRI-O is tied to the scope of the CRI.

CRI-O - OCI-based implementation of Kubernetes Container Runtime Interface

Deepfence ThreatMapper helps you to monitor and secure your running applications, in Cloud, Kubernetes, Docker, and Fargate Serverless. ThreatMapper scans your platforms and identifies pods, containers, applications, and infrastructure. Use ThreatMapper to discover the topology of your applications and attack surface. It obtains manifests of dependencies from running pods and containers, serverless apps, applications, and operating system. ThreatMapper matches these against vulnerability feeds to identify vulnerable components.
 
ThreatMapper discovers, annotates and displays the topology of your applications across multiple cloud environments. It ranks discovered vulnerabilities against CVSS and other severity scores, exploit method and proximity to attack surface, in order to identify which issues pose the greatest risk of exploit.

Deepfence ThreatMapper helps you to monitor and secure your running applications, in Cloud, Kubernetes, Docker, and Fargate Serverless. ThreatMapper scans your platforms and identifies pods, containers, applications, and infrastructure. Use ThreatMapper to discover the topology of your applications and attack surface. It obtains manifests of dependencies from running pods and containers, serverless apps, applications, and operating system. ThreatMapper matches these against vulnerability feeds to identify vulnerable components.

DeepFence - Identify vulnerabilities in running containers, images, hosts and repositories

KEDA is a Kubernetes-based Event Driven Autoscaler. With KEDA, you can drive the scaling of any container in Kubernetes based on the number of events needing to be processed. KEDA works alongside standard Kubernetes components like the Horizontal Pod Autoscaler and can extend functionality without overwriting or duplication. 
 
With KEDA you can explicitly map the apps you want to use event-driven scale, with other apps continuing to function. This makes KEDA a flexible and safe option to run alongside any number of any other Kubernetes applications or frameworks.

KEDA is a Kubernetes-based Event Driven Autoscaler. With KEDA, you can drive the scaling of any container in Kubernetes based on the number of events needing to be processed. KEDA works alongside standard Kubernetes components like the Horizontal Pod Autoscaler and can extend functionality without overwriting or duplication. 

KEDA - Kubernetes-based Event Driven Autoscaling component. It provides event driven scale for any container running in Kubernetes 

Kyverno is a policy engine designed for Kubernetes. With Kyverno, policies are managed as Kubernetes resources and no new language is required to write policies. This allows using familiar tools such as kubectl, git, and kustomize to manage policies. Kyverno policies can validate, mutate, and generate Kubernetes resources. The Kyverno CLI can be used to test policies and validate resources as part of a CI/CD pipeline.
 
Kyverno allows cluster administrators to manage environment specific configurations independently of workload configurations and enforce configuration best practices for their clusters. Kyverno can be used to scan existing workloads for best practices, or can be used to enforce best practices by blocking or mutating API requests.

Kyverno is a policy engine designed for Kubernetes. With Kyverno, policies are managed as Kubernetes resources and no new language is required to write policies. This allows using familiar tools such as kubectl, git, and kustomize to manage policies. Kyverno policies can validate, mutate, and generate Kubernetes resources. The Kyverno CLI can be used to test policies and validate resources as part of a CI/CD pipeline.



Kyverno - Kubernetes Native Policy Management



Karpenter simplifies Kubernetes infrastructure with the right nodes at the right time. It automatically launches just the right compute resources to handle your cluster's applications. It is designed to let you take full advantage of the cloud with fast and simple compute provisioning for Kubernetes clusters. Its main job is to add nodes to handle unschedulable pods, schedule pods on those nodes, and remove the nodes when they are not needed.
 
It responds quickly and automatically to changes in application load, scheduling, and resource requirements, placing new workloads onto a variety of available compute resource capacity. It comes with a set of opinionated defaults in a single, declarative Provisioner resource which can easily be customized. No additional configuration required.

Karpenter simplifies Kubernetes infrastructure with the right nodes at the right time. It automatically launches just the right compute resources to handle your cluster's applications. It is designed to let you take full advantage of the cloud with fast and simple compute provisioning for Kubernetes clusters. Its main job is to add nodes to handle unschedulable pods, schedule pods on those nodes, and remove the nodes when they are not needed.

Karpenter - Kubernetes Node Autoscaling: built for flexibility, performance, and scalability

Dragonfly is an open source intelligent P2P based image and file distribution system. Its goal is to tackle all distribution problems in cloud native scenarios. It is efficient with P2P and CDN technology which reduces image distribution time significantly and expedite delivery. it supports large-scale file distribution with improved downloading speed and success rate and lower consumption of bandwidth, especially cross-IDC bandwidth.
 
Its features include: 
<ul>
<li>Implement P2P files distribution with various storage types
(HDFS, storage services from various cloud vendors, Maven, Yum, etc.)
through a unified back-to-source adapter layer.</li>
<li>Support more distribution modes:
active pull, active push, real-time synchronization,
remote replication, automatic warm-up,
cross-cloud transmission, etc.</li>
<li>Provide separation and decoupling between systems,
scheduling and plug-in CDN. Support on-demand deployment with
flexible types: light or heavy, inside or outside,
to meet the actual needs of different scenarios.</li>
<li>Newly designed P2P protocol framework based on
GRPC with improved efficiency and stability.</li>
<li>Perform encrypted transmission, account-based transmission
authentication and rate limit, and multi-tenant isolation mechanism.</li>
<li>Bear more efficient IO methods: multithreaded IO, memory mapping, DMA, etc.</li>
<li>Advocate dynamic compression, in-memory file systems,
and more efficient scheduling algorithms to improve distribution efficiency.</li>
<li>Client allows third-party software to
natively integrate Dragonfly’s P2P capabilities through C/S mode.</li>
<li>Productivity: Support file uploading, task management of
various distribution modes, data visualization, global control, etc.</li>
<li>Consistent internal and external versions, shared core features,
and individual extensions of non-generic features.</li>
<li>Enhanced integration with ecology:
Harbor, Nydus (on-demand image download),
warehouse services for various cloud vendors, etc.</li>
</ul>

Dragonfly is an open source intelligent P2P based image and file distribution system. Its goal is to tackle all distribution problems in cloud native scenarios. It is efficient with P2P and CDN technology which reduces image distribution time significantly and expedite delivery.  it supports large-scale file distribution with improved downloading speed and success rate and lower consumption of bandwidth, especially cross-IDC bandwidth.

Dragonfly - An Open-source P2P-based Image and File Distribution System

Helm is a tool for managing Kubernetes charts. Charts are packages of pre-configured Kubernetes resources. It is a tool that streamlines installing and managing Kubernetes applications. Think of it like apt/yum/homebrew for Kubernetes.

Helm - The Kubernetes Package Manager

ZITADEL provides you with all the features necessary to build great solutions, without the need of building the login and access management yourself. 
 
Its features include: 
<ul><li>Authentication:&nbsp; OpenID Connect 1.0 Protocol (OP), Username / Password,&nbsp; Machine-to-machine (JWT profile), Passwordless with FIDO2</li><li>Multifactor authentication with OTP, U2F</li><li>Federation with OpenID Connect 1.0 Protocol (RP), OAuth 2.0 Protocol (RP)</li><li>Authorization via Role Based Access Control (RBAC)</li><li>Identity Brokering</li><li>Delegation of roles to other organizations for self-management</li><li>Strong audit trail for all IAM resources</li><li>User interface for administration</li><li>APIs for Management, Administration, and Authentication</li><li>Policy configuration and enforcement</li><li>Private Labeling</li></ul>

ZITADEL provides you with all the features necessary to build great solutions, without the need of building the login and access management yourself. 

ZITADEL - Cloud Native Identity and Access Management

Kubescape is an open-source Kubernetes security platform. It includes risk analysis, security compliance, and misconfiguration scanning. Targeted at the DevSecOps practitioner or platform engineer, it offers an easy-to-use CLI interface, flexible output formats, and automated scanning capabilities. It saves Kubernetes users and admins precious time, effort, and resources.
Kubescape scans clusters, YAML files, and Helm charts. It detects misconfigurations according to multiple frameworks (including&nbsp;<a href="https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo/?utm_source=github&amp;utm_medium=repository" target="_blank" rel="noopener">NSA-CISA</a>,&nbsp;<a href="https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/" target="_blank" rel="noopener">MITRE ATT&amp;CK </a>and the&nbsp;<a href="https://www.armosec.io/blog/cis-kubernetes-benchmark-framework-scanning-tools-comparison/?utm_source=github&amp;utm_medium=repository" target="_blank" rel="noopener">CIS Benchmark</a>).
Kubescape uses&nbsp;<a href="https://github.com/open-policy-agent/opa" target="_blank" rel="noopener">Open Policy Agent</a>&nbsp;to verify Kubernetes objects against&nbsp;<a href="https://github.com/kubescape/regolibrary" target="_blank" rel="noopener">a library of posture controls</a>. By default, the results are printed in a console but they can be exported to JSON and PDF.
Kubescape is running the following tests according to what is defined by Kubernetes Hardening Guidance by NSA and CISA.
<ul>
<li>Non-root containers</li>
<li>Immutable container filesystem</li>
<li>Privileged containers</li>
<li>hostPID, hostIPC privileges</li>
<li>hostNetwork access</li>
<li>allowedHostPaths field</li>
<li>Protecting pod service account tokens</li>
<li>Resource policies</li>
<li>Control plane hardening</li>
<li>Exposed dashboard</li>
<li>Allow privilege escalation</li>
<li>Applications credentials in configuration files</li>
<li>Cluster-admin binding</li>
<li>Exec into container</li>
<li>Dangerous capabilities</li>
<li>Insecure capabilities</li>
<li>Linux hardening</li>
</ul>

An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters.



Kubescape - An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters

Discover open source projects across all platforms

Projects