Deploy Cloud Native Applications inside Confidential Enclaves Protect containers while they are running using confidential computing and hardware-backed isolation.

Confidential Containers is an open source community working to enable cloud native confidential computing by leveraging Trusted Execution Environments to protect containers and data.

• Confidential Containers @ GitHub.

Related contents:

• Confidential Containers becomes a CNCF incubating project @ CNCF.

Automated Kubernetes workload resource tracking and adjustment.

Ballast is a Kubernetes operator that automatically right-sizes workload resource requests and limits based on real operational history. It is a more active alternative to Fairwinds Goldilocks: rather than suggesting changes, it applies them — at admission time and on running pods via in-place resize (Kubernetes 1.35+).

The Security Profiles Operator (SPO) is an out-of-tree Kubernetes enhancement which aims to make it easier to create and use SELinux, seccomp and AppArmor security profiles in Kubernetes clusters.

Related contents:

• Security Profiles Operator v1: Stable APIs, Security Hardened, and Shaping Upstream Kubernetes @ CNCF.

External Secrets Operator is a Kubernetes operator that integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager, CyberArk Secrets Manager, Pulumi ESC and many more. The operator reads information from external APIs and automatically injects the values into a Kubernetes Secret.

• External Secrets Operator @ GitHub.

Related contents:

• Discover the External Secret Operator (ESO) OVHcloud Provider to manage your Kubernetes secrets 🎉 @ OVHcloud Blog.

Kubernetes AI Toolchain Operator.

KAITO is an operator that automates the AI/ML model inference or tuning workload in a Kubernetes cluster. The target models are popular open-sourced large models such as falcon and phi-3.

• KAITO @ GitHub.

Related contents:

• Building a Kubernetes-native pattern for AI infrastructure at scale @ The New Stack.

A Kubernetes controller and tool for one-way encrypted Secrets.

Problem: "I can manage all my K8s config in git, except Secrets." Solution: Encrypt your Secret into a SealedSecret, which is safe to store - even inside a public repository. The SealedSecret can be decrypted only by the controller running in the target cluster and nobody else (not even the original author) is able to obtain the original Secret from the SealedSecret.

Related contents:

• GitOps architecture, patterns and anti-patterns @ Platform Engineering.

External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.

• External Secrets Operator @ GitHub.

Related contents:

• (Almost) Every infrastructure decision I endorse or regret after 4 years running infrastructure at a startup @ Jack's home on the web.
• How Maintainer Burnout Is Causing a Kubernetes Security Disaster @ The New Stack.
• GitOps architecture, patterns and anti-patterns @ Platform Engineering.
• Discover the External Secret Operator (ESO) OVHcloud Provider to manage your Kubernetes secrets 🎉 @ OVHcloud.