228
projects
Skip to content
228 projects · 27 categories · CNCF
A control surface for the cloud native ecosystem.
The CNCF landscape lists 200+ projects as a wall of logos. CNCF Atlas turns the same ecosystem into one console: grouped by role, coloured by maturity, and wired to deep-dives that actually read the code.
38
graduated
39
incubating
151
sandbox
126
deep-dives
// THE MAP
The whole ecosystem, as a status board.
Every CNCF project grouped by what it does, with a maturity status bar down the left edge. An arrow → goes to a deep-dive on this site; ↗ goes to the upstream repository of a project the catalog lists but has not written up.
graduatedincubatingsandbox
Security & Compliance31
cert-manager→Falco→in-toto→Kyverno→Open Policy Agent (OPA)→The Update Framework (TUF)→Confidential Containers→Keycloak→Kubescape→Notary Project→OpenFGA→Bank-Vaults→bpfman→Cartography→Cedar→ContainerSSH→Copa→Dex→external-secrets→Keylime↗KubeArmor↗Kubewarden↗OAuth2 Proxy→Open Policy Containers↗OSCAL-COMPASS↗Paralus↗Parsec↗Ratify↗SlimToolkit↗SOPS↗Tokenetes↗
Scheduling & Orchestration30
Application Definition & Image Build28
Automation & Configuration21
Observability16
Container Runtime14
Cloud Native Storage11
Continuous Integration & Delivery9
Cloud Native Network9
Streaming & Messaging6
Container Registry4
Chaos Engineering4
Certified Kubernetes Distribution2
Remote Procedure Call2
Orchestration & Management2
Continuous Optimization1
Feature Flagging1
Certified Kubernetes Installer1
Installable Platform1
Application Frameworks1
// DEEP-DIVES
Read from the source, not the marketing page.
Each deep-dive reads the upstream code at a pinned commit and cites where every claim came from.
AutheliaIndependent
SSO and 2FA for your reverse proxy, plus an OpenID Connect providerRead →OpenFGAIncubating
Zanzibar-style fine-grained authorization from relationship tuples and a declarative modelRead →SpiceDBIndependent
A Zanzibar-inspired permissions database that answers checks by traversing a relationship graphRead →PermifyIndependent
A Zanzibar-style authorization engine backed by relation tuples in PostgreSQLRead →authentikIndependent
A self-hosted identity provider: SSO, OAuth2/OIDC, SAML, and LDAP with a visual flow editorRead →ZITADELIndependent
API-first, event-sourced identity platform with multi-tenancy built inRead →OAuth2 ProxySandbox
A reverse proxy that puts OAuth2/OIDC login in front of a service that has noneRead →in-totoGraduated
Verifies every step of a software supply chain was done as planned by authorized partiesRead →The Update Framework (TUF)Graduated
Secures software update systems so a compromised repo or key cannot push malicious updatesRead →GUACIndependent
Aggregates software supply chain metadata into a queryable graphRead →Argo CDGraduated
Pull-based GitOps continuous delivery for Kubernetes, reconciling cluster state against Git.Read →BuildpacksGraduated
Turn application source code into production-ready OCI images without writing a Dockerfile.Read →cert-managerGraduated
Issues and renews X.509 certificates from ACME, Vault, Venafi, and private CAs as native Kubernetes resources.Read →CiliumGraduated
eBPF-based networking, security, and observability for Kubernetes, with policy written against workload identity.Read →CloudEventsGraduated
A vendor-neutral specification for event data, with SDKs that carry events across HTTP, Kafka, and MQTT.Read →containerdGraduated
An OCI-compliant container runtime daemon, the runtime layer beneath Kubernetes and Docker.Read →CoreDNSGraduated
A DNS server that resolves each query through a configured chain of plugins; the default Kubernetes cluster DNS.Read →CRI-OGraduated
A lightweight, Kubernetes-only Container Runtime Interface implementation for running OCI containers.Read →CrossplaneGraduated
A Kubernetes control-plane framework: define your own APIs and reconcile cloud and in-cluster resources.Read →CubeFSGraduated
A distributed file and object store that separates metadata from data, per-volume replication or erasure coding.Read →DaprGraduated
A sidecar runtime giving any app portable building-block APIs for state, pub/sub, invocation, and actors.Read →DragonflyGraduated
Peer-to-peer distribution of container images, files, and AI models across large clusters.Read →EnvoyGraduated
An out-of-process L4/L7 proxy and universal data plane for polyglot microservices.Read →etcdGraduated
A distributed key-value store that uses Raft to keep a small, critical dataset consistent across a cluster.Read →FalcoGraduated
A runtime security engine that watches Linux kernel events and alerts when activity matches a rule.Read →FluentdGraduated
A unified logging layer that collects events, routes them by tag, buffers, and ships them to many destinations.Read →FluxGraduated
A GitOps tool that keeps a Kubernetes cluster continuously reconciled with manifests stored in Git.Read →HarborGraduated
An OCI registry that adds RBAC, vulnerability scanning, replication, and signature verification.Read →HelmGraduated
The package manager for Kubernetes: bundle, version, and install related resources as a chart.Read →IstioGraduated
A service mesh that puts a programmable proxy next to every workload, moving traffic, mTLS, and telemetry out of app code.Read →JaegerGraduated
A distributed tracing platform; in v2 it ships as an OpenTelemetry Collector distribution.Read →KEDAGraduated
Event-driven autoscaling for Kubernetes, including scale-to-zero, by feeding external events into the HPA.Read →KnativeGraduated
Runs containers as request-driven serverless workloads on Kubernetes, including scale to zero.Read →KubeEdgeGraduated
Extends a Kubernetes control plane to edge nodes and IoT devices over unreliable networks.Read →KubeflowGraduated
Orchestrates end-to-end machine learning workflows on Kubernetes by compiling pipeline definitions into Argo Workflows and tracking every run in ML Metadata.Read →KubernetesGraduated
Run containers across many machines by declaring desired state; controllers drive the cluster toward it.Read →KyvernoGraduated
A Kubernetes admission engine where each policy is itself a Kubernetes resource written as YAML.Read →LinkerdGraduated
A Kubernetes service mesh adding mTLS, metrics, and reliability through a lightweight Rust sidecar proxy.Read →Open Policy Agent (OPA)Graduated
A general-purpose policy engine that decouples authorization from app code, evaluated via the Rego language.Read →OpenTelemetryGraduated
A vendor-neutral standard and toolchain for generating, collecting, and exporting traces, metrics, and logs.Read →PrometheusGraduated
Metrics-based monitoring that pulls time series over HTTP, stores them in a local TSDB, and queries with PromQL.Read →RookGraduated
A Kubernetes operator that runs Ceph as declarative custom resources for block, file, and object storage.Read →SPIFFEGraduated
Standards for giving workloads a short-lived, cryptographically verifiable identity without pre-shared secrets.Read →SPIREGraduated
Issues short-lived, attested workload identities (X509-SVID and JWT-SVID); the SPIFFE reference implementation.Read →VitessGraduated
A clustering system that shards MySQL horizontally behind a single MySQL-compatible endpoint.Read →TiKVGraduated
A distributed, transactional key-value database, the storage layer behind TiDB.Read →Artifact HubIncubating
An open, CNCF-hosted index to find, install, and publish Cloud Native packages across more than two dozen artifact kinds.Read →BackstageIncubating
A framework for building developer portals: a software catalog, templates, and docs assembled into one internal application you own.Read →Chaos MeshIncubating
A Kubernetes-native chaos engineering platform that injects faults into pods, networks, filesystems, and the kernel through custom resources.Read →Cloud CustodianIncubating
A YAML policy engine for cloud governance that queries resources, filters them, and runs actions like tagging, stopping, or deleting, so rules live as code instead of ad hoc scripts.Read →Container Network Interface (CNI)Incubating
A minimal, runtime-agnostic spec plus Go libraries that let any container runtime hand pod networking to pluggable executables.Read →ContourIncubating
A Kubernetes ingress controller that programs Envoy as its data plane, translating Ingress, its HTTPProxy CRD, and Gateway API into live Envoy config over xDS.Read →CortexIncubating
A horizontally scalable, multi-tenant, long-term storage backend for Prometheus that receives metrics over remote write.Read →Emissary-IngressIncubating
Kubernetes-native API gateway and ingress built on Envoy Proxy, driven entirely by CRDs.Read →Flatcar Container LinuxIncubating
A minimal, immutable Linux distribution for running containers, with A/B partitions and atomic automatic updates.Read →FluidIncubating
A Kubernetes operator that makes datasets a first-class resource and orchestrates distributed caches to speed up data access for AI and big-data workloads.Read →gRPCIncubating
A high-performance RPC framework that turns a Protocol Buffers service definition into typed clients and servers running over HTTP/2.Read →HAMiIncubating
Share one physical GPU across Kubernetes pods by memory and compute, with per-pod limits enforced at runtime and no application changes.Read →KarmadaIncubating
Kubernetes-native control plane that propagates and schedules workloads across many clusters and clouds.Read →KeycloakIncubating
Open-source identity and access management server speaking OIDC, OAuth 2.0, and SAML for apps and services.Read →KServeIncubating
Kubernetes-native, multi-framework inference platform that turns a model into an autoscaling InferenceService for both predictive and generative AI.Read →KubescapeIncubating
Open-source Kubernetes security platform for misconfiguration, vulnerability, and runtime scanning from IDE to running cluster.Read →KubeVelaIncubating
Application-centric delivery control plane that turns one OAM Application into multi-cluster Kubernetes resources via composable CUE modules.Read →KubeVirtIncubating
Run and manage KVM virtual machines as first-class Kubernetes workloads.Read →LimaIncubating
Linux virtual machines on macOS, Linux, and Windows with automatic file sharing and port forwarding.Read →LitmusIncubating
Cloud-native chaos engineering for Kubernetes, with a central control plane and a shared hub of reusable experiments.Read →LonghornIncubating
Kubernetes-native distributed block storage that gives every volume its own lightweight engine and replicas.Read →metal3-ioIncubating
Kubernetes-native bare metal host provisioning that drives OpenStack Ironic through the BareMetalHost CRD.Read →MicrocksIncubating
Spec-driven mock and contract-testing server: import an API artifact, get a live mock and contract tests from the same contract.Read →NATSIncubating
High-performance, single-binary messaging for cloud and edge, with optional JetStream persistence.Read →Notary ProjectIncubating
Sign and verify OCI artifacts with X.509 PKI, storing portable signatures as OCI Referrers next to the artifact.Read →OpenCostIncubating
Vendor-neutral CNCF spec and engine for real-time Kubernetes and cloud cost allocation.Read →OpenFeatureIncubating
A vendor-neutral standard and reference daemon (flagd) for feature flag evaluation across any language and backend.Read →OpenKruiseIncubating
Kubernetes controllers that extend the standard workloads and update container images in place without recreating Pods.Read →OpenYurtIncubating
Extend a vanilla Kubernetes control plane to edge nodes with offline autonomy, keeping the upstream API intact.Read →Operator FrameworkIncubating
Toolkit to build, package, and ship Kubernetes Operators in Go, Ansible, or Helm, wired into OLM for install and upgrades.Read →StrimziIncubating
Run and operate Apache Kafka on Kubernetes through declarative custom resources and operators.Read →ThanosIncubating
Extends Prometheus with object-storage long-term retention and a single global query view across many servers.Read →VolcanoIncubating
A Kubernetes-native batch scheduler that adds gang scheduling, queues, and fair-share to clusters running AI, ML, and big-data workloads.Read →Volcano-KthenaIncubating
Kubernetes-native LLM inference orchestration that pairs Volcano gang scheduling with KV-cache-aware, prefill-decode routing.Read →wasmCloudIncubating
A WebAssembly component runtime that runs the same host locally and on Kubernetes, wiring components to swappable capability plugins.Read →Confidential ContainersIncubating
Run unmodified Kubernetes Pods inside confidential VMs and release secrets only to workloads that pass remote attestation.Read →AthenzSandbox
X.509 service identity and fine-grained RBAC for dynamic, hybrid-cloud infrastructure.Read →Aeraki MeshSandbox
A control plane that extends Istio to manage non-HTTP layer-7 protocols like Dubbo, Thrift, and Kafka in a service mesh.Read →AgonesSandbox
Host, run, and scale dedicated multiplayer game servers on Kubernetes using custom resources and controllers.Read →AkriSandbox
Discovers edge leaf devices (cameras, USB, OPC UA) and exposes them to Kubernetes as schedulable resources.Read →AntreaSandbox
A Kubernetes-native CNI that uses Open vSwitch as its data plane to provide pod networking and NetworkPolicy.Read →Apicurio RegistrySandbox
A runtime server that stores, versions, and validates API definitions and event schemas, with pluggable storage backends.Read →ArmadaSandbox
A high-throughput batch job scheduler that queues and schedules work across many Kubernetes clusters from outside the clusters themselves.Read →AtlantisSandbox
A self-hosted server that runs Terraform and OpenTofu from pull request comments, planning and applying infrastructure in the open before merge.Read →Bank-VaultsSandbox
Automates initializing, unsealing, and configuring HashiCorp Vault, keeping unseal keys encrypted with cloud KMS for Kubernetes.Read →BFESandbox
A Go layer-7 load balancer and reverse proxy from Baidu, with content-based routing via a human-readable condition DSL and two-stage GSLB/SLB load balancing.Read →bootcSandbox
Transactional, in-place operating system updates that ship the whole host as an OCI container image.Read →bpfmanSandbox
An eBPF program manager that loads, attaches, and tracks eBPF programs on a node so applications avoid privileged kernel access.Read →Cadence WorkflowSandbox
A fault-tolerant, code-first orchestration engine that runs long-lived workflows and resumes them from event history after any crash.Read →CapsuleSandbox
Soft multi-tenancy for Kubernetes: group namespaces under a Tenant CRD and enforce isolation with admission webhooks.Read →CarinaSandbox
A CSI driver that carves local node disks into volumes with LVM, built for databases that want raw local disk performance.Read →CartographySandbox
Pulls cloud and SaaS assets and the relationships between them into a Neo4j graph so you can query exposure and access paths with Cypher.Read →CarvelSandbox
A set of single-purpose Kubernetes tools whose in-cluster engine, kapp-controller, fetches, templates, and deploys application config as one declarative pipeline.Read →CDK for Kubernetes (CDK8s)Sandbox
Define Kubernetes manifests in real programming languages and synthesize them into plain YAML.Read →CedarSandbox
A policy language and evaluation engine for fine-grained authorization, designed so policies can be analyzed statically and the engine itself formally verified.Read →ChaosbladeSandbox
A single command-line tool that injects faults across hosts, the JVM, C++, containers, and Kubernetes by dispatching versioned YAML experiment specs to per-domain executors.Read →CloudNativePGSandbox
A Kubernetes operator that runs PostgreSQL with high availability, using the Kubernetes API itself as the consensus store instead of etcd or Patroni.Read →ClusternetSandbox
A Kubernetes addon that manages many child clusters from one parent cluster, so you reach, deploy to, and coordinate them through a single entry point.Read →ClusterpediaSandbox
Syncs the resources of many Kubernetes clusters into one relational database and serves them back as an Aggregated API, so kubectl can search every cluster at once.Read →CoHDISandbox
A Kubernetes operator that attaches and detaches GPUs to nodes at runtime by driving a Composable Device Infrastructure fabric API.Read →composefsSandbox
A read-only mountable filesystem that stores only metadata and shares file content from an external content-addressed store, with optional fs-verity sealing.Read →Connect RPCSandbox
A Protocol Buffers RPC framework that generates typed clients and servers on plain net/http, so one server speaks the Connect protocol, gRPC, and gRPC-Web at once.Read →container2wasmSandbox
Converts a container image into a WebAssembly image that runs on a WASI runtime or in a browser, by compiling a CPU emulator to Wasm and running a real Linux plus runc inside it.Read →ContainerSSHSandbox
An SSH server that boots a throwaway container for each connection and delegates authentication and per-connection configuration to external HTTP webhooks.Read →CopaceticSandbox
Patches known OS-package vulnerabilities into an existing container image as an additive layer, driven by a scanner report, without a rebuild.Read →CozystackSandbox
A bare-metal private-cloud framework that serves managed Kubernetes, VMs, and databases as Flux HelmReleases through one aggregated API.Read →DalecSandbox
Declarative YAML to native RPM/DEB packages and minimal, signed, SBOM-attested containers, using only Docker.Read →DevfileSandbox
A YAML standard for cloud development workspaces, defined as Go types that generate every CRD, JSON schema, and TypeScript model.Read →DevSpaceSandbox
A client-only CLI that runs your local code inside a Kubernetes pod and syncs edits both ways for in-cluster development.Read →DexSandbox
A federated OpenID Connect provider that delegates login to upstream identity providers like LDAP, SAML, GitHub, and Google.Read →DistributionSandbox
The open-source registry that stores and serves container images, and the OCI Distribution core many registries build on.Read →DrasiSandbox
Detect changes across data sources with standing Cypher queries and fire reactions, without copying or polling the data.Read →EasegressSandbox
A Go traffic gateway with a result-driven filter pipeline and embedded etcd for self-contained HA.Read →EraserSandbox
Deletes vulnerable and unwanted container images from every Kubernetes node, never touching images a running container uses.Read →External Secrets OperatorSandbox
Syncs secrets from external managers like AWS, Vault, and GCP into native Kubernetes Secrets.Read →HeadlampSandbox
An extensible web and desktop UI for Kubernetes that proxies every cluster API through its own backend and loads plugins at runtime.Read →HigressSandbox
An API gateway that embeds a forked Istio Pilot to turn Ingress and nginx annotations into Envoy config, with a Wasm plugin layer for AI and traffic.Read →HolmesGPTSandbox
An AI agent that investigates production incidents by driving read-only observability tools through a controlled LLM loop.Read →TektonIncubating
Kubernetes-native CI/CD: pipelines, tasks, and runs are custom resources, and every step is a container in a pod.Read →k8gbIncubating
Global load balancing across Kubernetes clusters, built out of DNS delegation and CoreDNS instead of an appliance or a control plane.Read →// THE FORMAT
Six sections. Same order. Every time.
01
Overview
What it is, when to use it, the key facts.
02
History
Where it came from and how it got here.
03
Architecture
The components and how a request flows.
04
Adoption
Who runs it and the real alternatives, cited.
05
Internals
The code paths that matter, from source.
06
Getting Started
Install it and get a first setup working.