The Kubenomicon was born of a desire to understand more about Kubernetes from an offensive perspective.

This project was heavily inspired by the Kubernetes Threat Matrix from Microsoft which is a great starting point as it provides a framework to help understand some of the concepts in a MITRE ATTACK style framework. The Microsoft Threat Matrix was explicitly not designed to be a playbook offensive for security professionals and thus it lacks the details necessary to actually exploit (and remediate) each attack in Kubernetes cluster.

• Kubenomicon @ GitHub.
• Threat Matrix for Kubernetes @ Microsoft.
• Kubernetes Threat Matrix @ RedGuard.

The Fastest Developer Tool for Kubernetes (open-source). Client-Only Developer Tool for Cloud-Native Development with Kubernetes.

⚡ Automate your deployment workflow with DevSpace and develop software directly inside Kubernetes.

DevSpace is an open-source CLI tool that allows you to accelerate your development workflow when building applications on top of Kubernetes. It provides a powerful localhost UI and uses hot reloading to update containers while you are coding.

• DevSpace @ GitHub.

Wavy is a toolset for running GUI applications on Kubernetes.

Wavy makes it possible to run containerized GUI desktop applications — think VS Code, or Libreoffice — on Kubernetes and makes them accessible via the browser or on a display connected to a node. This workflow allows users to run applications in the cloud and access them from any device without needing to install any software. Wavy works by patching Kubernetes workloads that are annotated with wavy.squat.ai/enable=true to include the necessary tools.

Turnkey Kubernetes networking solution.

The Kube-router is a turnkey solution for Kubernetes networking with aim to provide operational simplicity. Networking is hard as such. In typical Kubernetes cluster you would need to install multiple network components for various functionality. With many moving parts it makes Kubernetes networking even harder. Kube-router provides a cohesive yet lean and powerful alternative to several network components you would use. All this from a single DaemonSet/Binary. It doesn't get any easier.

• Kube-Router @ GitHub.

Bird’s-eye view for Kubernetes. Seabird is the native desktop app that simplifies working with Kubernetes. Native Kubernetes desktop client.

Seabird is a native cross-platform Kubernetes desktop client that makes it super easy to explore your cluster's resources. We aim to visualize all common resource types in a simple, bloat-free user interface.

• Seabird @ GitHub.
• Seabird – Le client natif pour la gestion de Kubernetes sous Windows, macOS et Linux @ Korben :fr:.

K8s-Sherlock is your open-source investigative tool for diving deep into Kubernetes cluster mysteries. Designed to simplify and expedite debugging processes, it's the essential utility for demystifying complex container orchestration issues.

K8s-Sherlock is an open-source Kubernetes pod designed for debugging and diagnostics. As a swiss-army knife for your Kubernetes cluster, it comes pre-loaded with a host of tools to help you diagnose issues with network, containers, and more. Developed to expedite the troubleshooting process, K8s-Sherlock is your go-to pod for resolving complex orchestration issues.

Infrastructure as Code in Any Programming Language. Open Source Infrastructure as Code. Manage infrastructure, secrets, and configurations intuitively on any cloud.Build infrastructure intuitively on any cloud using familiar languages 🚀.

Pulumi's Infrastructure as Code SDK is the easiest way to build and deploy infrastructure, of any architecture and on any cloud, using programming languages that you already know and love. Code and ship infrastructure faster with your favorite languages and tools, and embed IaC anywhere with Automation API.

• Pulumi @ GitHub.

Related contents:

• Terraform vs. Pulumi: Which Is Better for Your IaC Requirements? @ DZone.
• Pimp your Kubernetes cluster with Pulumi @ yodamad's quick blog.
• Tranches de Tech 13 - De la tech et du coeur :fr:.

A more powerful alternative to kubectx and kubens.

kubie is an alternative to kubectx, kubens and the k on prompt modification script. It offers context switching, namespace switching and prompt modification in a way that makes each shell independent from others. It also has support for split configuration files, meaning it can load Kubernetes contexts from multiple files. You can configure the paths where kubie will look for contexts, see the settings section.

Related contents:

• Introducing Kubie @ sbstp's blog.
• Gérer vos contextes Kubernetes avec Kubie @ DevSecOps :fr:.

Open-source hyperconverged infrastructure.

The open source hyperconverged infrastructure (HCI) solution for a cloud native world. Harvester is a modern, open, interoperable, hyperconverged infrastructure (HCI) solution built on Kubernetes. It is an open-source alternative designed for operators seeking a cloud-native HCI solution. Harvester runs on bare metal servers and provides integrated virtualization and distributed storage capabilities. In addition to traditional virtual machines (VMs), Harvester supports containerized environments automatically through integration with Rancher. It offers a solution that unifies legacy virtualized infrastructure while enabling the adoption of containers from core to edge locations.

• Harvester @ GitHub.
• Introduction à SUSE Harvester @ Culture et Outils DevSecOps :fr:.

Sealed Secrets provides declarative Kubernetes Secret Management in a secure way. Since the Sealed Secrets are encrypted, they can be safely stored in a code repository. This enables an easy to implement GitOps flow that is very popular among the OSS community.

• Sealed Secrets @ GitHub.
• Chiffrer ses YAML avec Sealed Secrets @ Une Tasse de Café.

Flatcar Container Linux,

A community Linux distribution designed for container workloads, with high security and low maintenance.

• Flatcar @ GitHub.
• Kubernetes : flatcar worker node @ boris-tassou.fr :fr:.

Multi-Cluster Kubernetes Orchestration.

KubeAdmiral is a multi-cluster management system for Kubernetes, developed from Kubernetes Federation v2. Kubernetes Federation v2 allows users to manage Kubernetes resources across multiple clusters through the use of federated types such as FederatedDeployment, FederatedReplicaSet, FederatedSecret, etc. KubeAdmiral extends the Kubernetes Federation v2 API, providing compatibility with the Kubernetes native API and more powerful resource management capabilities.

• KubeAdmiral: Next-Generation Multi-Cluster Orchestration Engine Based on Kubernetes @ DZone.

Kubernetes Native Policy Management.

Kyverno is a policy engine designed for Kubernetes. It can validate, mutate, and generate configurations using admission controls and background scans. Kyverno policies are Kubernetes resources and do not require learning a new language. Kyverno is designed to work nicely with tools you already use like kubectl, kustomize, and Git.

• Kyverno @ GitHub.

Related contents:

• Vos politiques de conformité sur Kubernetes avec Kyverno @ Zwindler's Reflection :fr:.
• Understanding Kyverno: Enhancing Kubernetes Security with Policy Enforcement @ Jyothi Ram's blog.
• Using the Kyverno CLI to Write Policy Test Cases @ The New Stack.
• Simplify Kubernetes Security With Kyverno and OPA Gatekeeper @ The New Stack.
• Announcing Kyverno Release 1.15! @ CNCF.
• Optimizing Kyverno CLI performance: My LFX mentorship journey @ CNCF.
• GitOps architecture, patterns and anti-patterns @ Platform Engineering.
• GitOps policy-as-code: Securing Kubernetes with Argo CD and Kyverno @ CNCF.
• Automating Confidential Containers (CoCo) infrastructure with Kyverno @ CNCF.

KubeSkoop is a kubernetes networking diagnose tool for different CNI plug-ins and IAAS providers. KubeSkoop automatic construct network traffic graph of Pod in the Kubernetes cluster, monitoring and analysis of the kernel's critical path by eBPF, to resolve most of Kubernetes cluster network problems.

• KubeSkoop @ GitHub.

The Kubernetes control plane manager.

An open source control plane manager for unified cluster management. k0smotron allows you to unify your Kubernetes cluster management for an efficient use of resources. It’s designed for k0s.

• k0smotron @ GitHub.
• k0smotron: Open-source Kubernetes cluster management @ Help Net Security.

Efficient and consistent CI/CD with Kubernetes.

A solution for implementing efficient and consistent software delivery to Kubernetes facilitating best practices. werf is a CNCF Sandbox CLI tool to implement full-cycle CI/CD to Kubernetes easily. werf integrates into your CI system and leverages familiar and reliable technologies, such as Git, Dockerfile, Helm, and Buildah.

• werf @ GitHub.

PuzzleFS is a next-generation container filesystem.

Puzzlefs is a container filesystem designed to address the limitations of the existing OCI format. The main goals of the project are reduced duplication, reproducible image builds, direct mounting support and memory safety guarantees, some inspired by the OCIv2 design document.

An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters.

Kubescape is an open-source Kubernetes security platform. It includes risk analysis, security compliance, and misconfiguration scanning. Targeted at the DevSecOps practitioner or platform engineer, it offers an easy-to-use CLI interface, flexible output formats, and automated scanning capabilities. It saves Kubernetes users and admins precious time, effort, and resources.

• Kubescape @ GitHub.
• Sécuriser Kubernetes avec Kubescape @ Culture et Outils DevSecOps :fr:.

Get your resource requests "Just Right".

Goldilocks is a utility that can help you identify a starting point for resource requests and limits.

By using the kubernetes vertical-pod-autoscaler in recommendation mode, we can see a suggestion for resource requests on each of our apps. This tool creates a VPA for each workload in a namespace and then queries them for information.

Goldilocks @ GitHub.

Kubernetes-native CI/CD building blocks.

Tekton is a powerful yet flexible Kubernetes-native open source framework for creating continuous integration and delivery (CI/CD) systems. It lets you build, test, and deploy across multiple cloud providers or on-premises systems by abstracting away the underlying implementation details.

Tekton @ GitHub

A vulnerability scanner for container images and filesystems.

Work with remote images registries - retrieving information, images, signing content.

skopeo is a command line utility that performs various operations on container images and image repositories.

Related contents:

• Gérez vos images de conteneurs avec Skopeo @ DevSecOps :fr:.

he Most Flexible IaC Management Platform.

Spacelift is a sophisticated CI/CD platform for Terraform, Terragrunt, CloudFormation, Pulumi, Kubernetes, and Ansible

An open source control plane manager for unified cluster management.

k0smotron allows you to unify your Kubernetes cluster management for an efficient use of resources. It’s designed for k0s.

From pets to cattle: Streamline your Kubernetes control plane management with k0smotron. Experience unparalleled isolation, scalability, and resource efficiency for your Kubernetes control planes with k0smotron - the ultimate Kubernetes management solution. It’s designed for k0s

• k0smotron @ GitHub.
• L’architecture open source k0smotron disponible pour les grandes entreprises @ Goodtech.info :fr:.

Flux is a set of continuous and progressive delivery solutions for Kubernetes that are open and extensible.

• Flux @ GitHub.

Related contents:

• (Almost) Every infrastructure decision I endorse or regret after 4 years running infrastructure at a startup @ Jack's home on the web.
• Rebuilding My Talos Cluster from Bare Metal @ Nerdz.
• How to scale GitOps in the enterprise: From single cluster to fleet management @ Platform Engineering.
• Bootstrapping Flux with Terraform, the right way @ Flux.

Building a virtualization API for Kubernetes.

KubeVirt technology addresses the needs of development teams that have adopted or want to adopt Kubernetes but possess existing Virtual Machine-based workloads that cannot be easily containerized. More specifically, the technology provides a unified development platform where developers can build, modify, and deploy applications residing in both Application Containers as well as Virtual Machines in a common, shared environment.

• KubeVirt @ GitHub

Related contents:

• Extending KubeVirt Through the Network Binding Plugin @ Oilbeater.
• From Pets to Cattle: The New Mindset for Managing VMs @ The New Stack.
• Your Container Is Not a Sandbox @ Emir Beganović.
• Save the Address, Save the Cloud: A Hands-on KubeVirt Live Migration Workshop @ Tigera.
• Why your KubeVirt VMs can’t move between clusters — and how EVPN fixes it @ The New Stack.

Supersonic Subatomic Java.

A Kubernetes Native Java stack tailored for OpenJDK HotSpot and GraalVM, crafted from the best of breed Java libraries and standards.

• Quarkus @ GitHub.
• Quarkus Facile : Episode 1 - Introduction @ Sébastien Blanc's YouTube (fr).
• Quarkus 3: The Future of Java Microservices With Virtual Threads and Beyond @ DZone.
• Use GitLab Duo to build and deploy a simple Quarkus-native project @ GitLab blog.
• Observability on Kubernetes with OpenTelemetry, Camel and Quarkus @ Piotr's TechBlog.

Telegraf is the open source server agent to help you collect metrics from your stacks, sensors, and systems.

Telegraf is a server-based agent for collecting and sending all metrics and events from databases, systems, and IoT sensors. Telegraf is written in Go and compiles into a single binary with no external dependencies, and requires a very minimal memory footprint.

Telegraf @ GitHub.

Hardened Containers, Faster Teams, Secure Software.

Automatically eliminate unused software components and deploy smaller, faster, more secure workloads.

The serverless database built for modern development.

Your database should be easy to use, not a source of frustration. Xata easily integrates into your developer workflow, providing the best data experience for Github, Vercel and Netlify based deployments.

• Xata @ GitHub.

Related contents:

• Introducing Xata OSS: Postgres platform with branching, now Apache 2.0 @ xata blog.
• Database Clones in Less Than a Second: Postgres Branching + Scale-to-Zero @ Xata's YouTube.

The Certified Enterprise Kubernetes Distribution

k0s is a highly scalable, certified Kubernetes distribution that works on any infrastructure. It’s built on open source and free.

Linux Native, API-Aware Networking and Security for Containers. eBPF-based Networking, Observability, Security.

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides a simple flat Layer 3 network with the ability to span multiple clusters in either a native routing or overlay mode. It is L7-protocol aware and can enforce network policies on L3-L7 using an identity based security model that is decoupled from network addressing.

• Cilium @ GitHub.

Related contents:

• Installing Cilium on EKS in Overlay(BYOCNI) and CNI Chaining Mode @ Cilium.
• Navigating the ingress-nginx archival: why now is the time to move to Cilium @ CNCF.
• Mon samedi aprèm avec le Cilium d'OVH @ Le blog de Little Jo :fr:.

Portable logs post-processing awk script - colours, emojis and more for Kubernetes logs, containers, journalctl, etc..

Tiny awk script to improve kubernetes logs reading experience.

Kubegres is a Kubernetes operator allowing to deploy one or many clusters of PostgreSql instances with data replication and failover enabled out-of-the box. It brings simplicity when using PostgreSql considering how complex managing stateful-set's life-cycle and data replication could be with Kubernetes.

Kubegres @ GitHub

Supply-chain Levels for Software Artifacts, or SLSA ("salsa").

SLSA is a specification for describing and incrementally improving supply chain security, established by industry consensus. It is organized into a series of levels that describe increasing security guarantees.

It’s a security framework, a checklist of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure. It’s how you get from "safe enough" to being as resilient as possible, at any link in the chain.

• SLSA @ GitHub.

Related contents:

• Securing the software supply chain with the SLSA framework @ Trail of Bits Blog.
• Episode #497: sécurisation de la chaîne d’approvisionnement logicielle (software supply chain) @ NoLimitSecu :fr:.
• Kube-Policies BinauthZ: Closing the Supply Chain Gap in Kubernetes @ Block Engineering Blog.

An open specification for enriching containers with development specific content and settings.

A Development Container (or Dev Container for short) allows you to use a container as a full-featured development environment. It can be used to run an application, to separate tools, libraries, or runtimes needed for working with a codebase, and to aid in continuous integration and testing. Dev containers can be run locally or remotely, in a private or public cloud.

• Development Containers @ GitHub.

Related contents:

• Utilisation des DevContainer @ DevSecOps :fr:.
• Run Your Project in a Dev Container, in Zed @ Zed blog.

Deploy a Production Ready Kubernetes Cluster

• Can be deployed on AWS, GCE, Azure, OpenStack, vSphere, Equinix Metal (bare metal), Oracle Cloud Infrastructure (Experimental), or Baremetal

• Highly available cluster

• Composable (Choice of the network plugin for instance)

• Supports most popular Linux distributions

• Continuous integration tests

• Kubespray @ GitHub.

K8sGPT is a tool for scanning your kubernetes clusters, diagnosing and triaging issues in simple english. It has SRE experience codified into it’s analyzers and helps to pull out the most relevant information to enrich it with AI.

Scale down Kubernetes deployments after work hours.

Scale down / "pause" Kubernetes workload (Deployments, StatefulSets, and/or HorizontalPodAutoscalers and CronJobs too !) during non-work hours.

Your Kubernetes Platform is one Git commit away.

The DevOps Stack provides a standard Kubernetes Platform, bringing together automated Provisioning as Code, Continuous Application Deployment, and readily-made configurations for the best Cloud Native tools in the industry.

DevOps Stack @ GitHub.

Pod Cleanup is an application that runs inside your Kubernetes cluster and periodically checks for orphaned pods. We initially developed it for the cases where GitLab Runner Manager did not have the chance to clean up the pods it created, like when a manager pod got evicted. However, you can also use it for general pod cleanup.

Kured (KUbernetes REboot Daemon) is a Kubernetes daemonset that performs safe automatic node reboots when the need to do so is indicated by the package management system of the underlying OS.

Kured @ GitHub

Serverless Functions Made Simple. OpenFaaS brings Functions As A Service (FaaS) to Kubernetes.

OpenFaaS® makes it simple to deploy both functions and existing code to Kubernetes

OpenFaaS @ GitHub

Always ready to code.

Gitpod is an open-source Kubernetes application for ready-to-code cloud development environments that spins up fresh, automated dev environments for each task, in the cloud, in seconds. It enables you to describe your dev environment as code and start instant, remote and cloud development environments directly from your browser or your Desktop IDE.

Gitpod @ GitHub.

Open-Source, cloud-Native Storage for Kubernetes. Production ready management for File, Block and Object Storage.

Rook is an open source cloud-native storage orchestrator for Kubernetes, providing the platform, framework, and support for Ceph storage to natively integrate with Kubernetes.

Ceph is a distributed storage system that provides file, block and object storage and is deployed in large scale production clusters.

Rook @ GitHub

kind is a tool for running local Kubernetes clusters using Docker container “nodes”. kind was primarily designed for testing Kubernetes itself, but may be used for local development or CI.

• kind @ GitHub.

Related contents:

• Kind @ Culture et outils DevSecOps :fr:.
• MetalLB and KinD: Loads Balanced Locally @ Tyler Auerbeck's Medium.
• Managing Kubernetes Secrets with Mozilla SOPS and AGE @ Cyril Baah's Medium.

KubeFire is to create and manage Kubernetes clusters running on FireCracker microVMs via weaveworks/ignite.

A distributed, reliable key-value store for the most critical data of a distributed system.

etcd is a strongly consistent, distributed key-value store that provides a reliable way to store data that needs to be accessed by a distributed system or cluster of machines. It gracefully handles leader elections during network partitions and can tolerate machine failure, even in the leader node. Learn more.

• etcd @ GitHub.

Related contents:

• The Complete Guide to ETCD Cluster Setup @ Daniel Persson (Kalaspuffar)'s YouTube.
• The Kubernetes Surgeon’s Handbook: Precision Recovery from etcd Snapshots @ Cloud Native.

DNS and Service Discovery.

CoreDNS is a DNS server. It is written in Go. It can be used in a multitude of environments because of its flexibility.

CoreDNS is a DNS server/forwarder, written in Go, that chains plugins. Each plugin performs a (DNS) function.

CoreDNS can listen for DNS requests coming in over UDP/TCP (go'old DNS), TLS (RFC 7858), also called DoT, DNS over HTTP/2 - DoH - (RFC 8484) and gRPC (not a standard).

• CoreDNS @ GitHub.

Related contents:

• Coredns-manager-operator @ GitHub.
• Exposing Docker's internal DNS with CoreDNS @ /home/theorangeone.
• Mon homelab, ou comment j'essaie de rester dans la game @ Cyril Beaufrere's LinkedIn :fr:.

Production Grade k8s Installation, Upgrades and Management. The easiest way to get a production grade Kubernetes cluster up and running. We like to think of it as kubectl for clusters.

kops will not only help you create, destroy, upgrade and maintain production-grade, highly available, Kubernetes cluster, but it will also provision the necessary cloud infrastructure.

AWS (Amazon Web Services) and GCE (Google Cloud Platform) are currently officially supported, with DigitalOcean, Hetzner and OpenStack in beta support, and Azure in alpha.

Open source cost monitoring for cloud native environments.

OpenCost is a vendor-neutral open source project for measuring and allocating infrastructure and container costs in real time. Built by Kubernetes experts and supported by Kubernetes practitioners, OpenCost shines a light into the black box of Kubernetes spend.

OpenCost @ GitHub.

Purpose-built OS for Kubernetes, fully managed by Kubernetes. k3OS is a Linux distribution designed to remove as much OS maintenance as possible in a Kubernetes cluster. It is specifically designed to only have what is needed to run k3s. Additionally the OS is designed to be managed by kubectl once a cluster is bootstrapped. Nodes only need to join a cluster and then all aspects of the OS can be managed from Kubernetes. Both k3OS and k3s upgrades are handled by the k3OS operator.

kube-image-keeper (a.k.a. kuik) is a container image caching system designed for Kubernetes. It ensures the availability of your favorite container images by keeping a local copy within your k8s cluster.

Just-in-time Nodes for Any Kubernetes Cluster.

Karpenter simplifies Kubernetes infrastructure with the right nodes at the right time.

Karpenter automatically launches just the right compute resources to handle your cluster's applications. It is designed to let you take full advantage of the cloud with fast and simple compute provisioning for Kubernetes clusters.

• Karpenter @ GitHub.

Related contents:

• What Karpenter v1.0.0 means for Kubernetes autoscaling @ Cloud Native.
• Tranches de Tech 13 - De la tech et du coeur :fr:.
• Façonnez Votre Cloud avec Karpenter : Les Secrets du Maître Charpentier du Numérique @ GDG France's YouTube :fr:.
• Implementing Karpenter In EKS (From Start To Finish) @ Cloud Native Deep Dive.
• Scaling Nodes From Zero - The Bottleneck @ Labyrinth Labs.
• Understanding Karpenter architecture for Kubernetes autoscaling @ Datadog.
• Key metrics for monitoring Karpenter @ Datadog.
• Karpenter + Cluster API @ A cup of coffee.
• Networking Is Still Hard @ AWS Fundamentals.
• Enabling Karpenter on EKS with Terraform: What It Is, Why It's Worth It, and How to Set It Up @ Ajinkya's dev.to.

Progressive Delivery Operator for Kubernetes. Flagger is a progressive delivery tool that automates the release process for applications running on Kubernetes. It reduces the risk of introducing a new software version in production by gradually shifting traffic to the new version while measuring metrics and running conformance tests.

Flagger @ GitHub.

Open Interoperable HCI with Harvester. Harvester is the next generation of hyperconverged infrastructure designed for the modern cloud-native environment. Completely open-source and free to use, Harvester easily integrates into Rancher helping operators consolidate workloads and reduce the complexity of their infrastructure.

Pluto is a utility to help users find deprecated Kubernetes apiVersions in their code repositories and their helm releases.

Automatically provision and manage TLS certificates in Kubernetes. cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. It supports issuing certificates from a variety of sources, including Let's Encrypt (ACME), HashiCorp Vault, and Venafi TPP / TLS Protect Cloud, as well as local in-cluster issuance. cert-manager also ensures certificates remain valid and up to date, attempting to renew certificates at an appropriate time before expiry to reduce the risk of outages and remove toil.

Open Source Marketplace For Kubernetes. arkade is how developers install the latest versions of their favourite tools and Kubernetes apps. With arkade get, you'll have kubectl, kind, terraform, and jq on your machine faster than you can type apt-get install/brew update.

Deploy a Production Ready Kubernetes Cluster