Catalog

Projects are grouped by role and labelled by CNCF maturity. Most link to a full deep-dive: history, architecture, real-world adoption, and code internals read from the upstream repository at a pinned commit. Every CNCF Graduated and Incubating project has one. The Sandbox long tail is listed too, with a one-line description and a link to its repository, so you can tell what a project is without a deep-dive existing yet.

Browse by category

Projects with a deep-dive link to it. The rest link straight to their upstream repository.

Orchestration & Scheduling

KEDAGraduatedEvent-driven autoscaling for Kubernetes, including scale-to-zero, by feeding external events into the HPA.KnativeGraduatedRuns containers as request-driven serverless workloads on Kubernetes, including scale to zero.KubeEdgeGraduatedExtends a Kubernetes control plane to edge nodes and IoT devices over unreliable networks.KubernetesGraduatedRun containers across many machines by declaring desired state; controllers drive the cluster toward it.KarmadaIncubatingKubernetes-native control plane that propagates and schedules workloads across many clusters and clouds.KubeVirtIncubatingRun and manage KVM virtual machines as first-class Kubernetes workloads.OpenKruiseIncubatingKubernetes controllers that extend the standard workloads and update container images in place without recreating Pods.OpenYurtIncubatingExtend a vanilla Kubernetes control plane to edge nodes with offline autonomy, keeping the upstream API intact.VolcanoIncubatingA Kubernetes-native batch scheduler that adds gang scheduling, queues, and fair-share to clusters running AI, ML, and big-data workloads.AgonesSandboxHost, run, and scale dedicated multiplayer game servers on Kubernetes using custom resources and controllers.AkriSandboxDiscovers edge leaf devices (cameras, USB, OPC UA) and exposes them to Kubernetes as schedulable resources.ArmadaSandboxA high-throughput batch job scheduler that queues and schedules work across many Kubernetes clusters from outside the clusters themselves.Cadence WorkflowSandboxA fault-tolerant, code-first orchestration engine that runs long-lived workflows and resumes them from event history after any crash.ClusternetSandboxA Kubernetes addon that manages many child clusters from one parent cluster, so you reach, deploy to, and coordinate them through a single entry point.ClusterpediaSandboxSyncs the resources of many Kubernetes clusters into one relational database and serves them back as an Aggregated API, so kubectl can search every cluster at once.CoHDISandboxA Kubernetes operator that attaches and detaches GPUs to nodes at runtime by driving a Composable Device Infrastructure fabric API.k0sSandboxA single-binary Kubernetes distribution with no host OS dependencies, aimed at bare metal, VMs, and edge.repo ↗k3sSandboxA lightweight Kubernetes distribution packaged as one binary, trimmed down for edge, IoT, and CI.repo ↗kcpSandboxA Kubernetes-style control plane that serves many logical clusters, decoupled from running containers at all.repo ↗KoordinatorSandboxCo-locates latency-sensitive services and batch jobs on the same nodes using QoS classes and resource reclamation.repo ↗KubeFleetSandboxPlaces and propagates workloads across a fleet of Kubernetes clusters from a single hub cluster.repo ↗KubeSliceSandboxJoins namespaces across clusters into one flat network slice with its own gateways and policies.repo ↗KubeStellarSandboxDistributes Kubernetes objects from a central hub to many clusters, for edge, multi-cloud, and hybrid fleets.repo ↗KuredSandboxReboots Kubernetes nodes safely, one at a time, when the OS package manager signals that a reboot is pending.repo ↗Open Cluster ManagementSandboxA hub and spoke standard for registering many Kubernetes clusters and shipping work out to them.repo ↗OpenFunctionSandboxA function-as-a-service platform that builds functions into images and runs them on Knative or KEDA.repo ↗OxiaSandboxA scalable metadata store and coordination service, built to replace ZooKeeper-style dependencies.repo ↗SlimFaaSSandboxA small function-as-a-service runtime for Kubernetes with scale to zero and no external dependencies.repo ↗

App Definition & GitOps

Argo CDGraduatedPull-based GitOps continuous delivery for Kubernetes, reconciling cluster state against Git.BuildpacksGraduatedTurn application source code into production-ready OCI images without writing a Dockerfile.CloudEventsGraduatedA vendor-neutral specification for event data, with SDKs that carry events across HTTP, Kafka, and MQTT.DaprGraduatedA sidecar runtime giving any app portable building-block APIs for state, pub/sub, invocation, and actors.FluxGraduatedA GitOps tool that keeps a Kubernetes cluster continuously reconciled with manifests stored in Git.HelmGraduatedThe package manager for Kubernetes: bundle, version, and install related resources as a chart.Artifact HubIncubatingAn open, CNCF-hosted index to find, install, and publish Cloud Native packages across more than two dozen artifact kinds.KubeVelaIncubatingApplication-centric delivery control plane that turns one OAM Application into multi-cluster Kubernetes resources via composable CUE modules.Operator FrameworkIncubatingToolkit to build, package, and ship Kubernetes Operators in Go, Ansible, or Helm, wired into OLM for install and upgrades.AtlantisSandboxA self-hosted server that runs Terraform and OpenTofu from pull request comments, planning and applying infrastructure in the open before merge.CarvelSandboxA set of single-purpose Kubernetes tools whose in-cluster engine, kapp-controller, fetches, templates, and deploys application config as one declarative pipeline.CDK for Kubernetes (CDK8s)SandboxDefine Kubernetes manifests in real programming languages and synthesize them into plain YAML.CozystackSandboxA bare-metal private-cloud framework that serves managed Kubernetes, VMs, and databases as Flux HelmReleases through one aggregated API.TektonIncubatingKubernetes-native CI/CD: pipelines, tasks, and runs are custom resources, and every step is a container in a pod.kbindSandboxBinds services from a provider cluster into a consumer cluster, so applications consume them as local APIs.repo ↗KCLSandboxA constraint-based configuration language with types and schemas, aimed at Kubernetes manifests and policy.repo ↗KonveyorSandboxAnalyses existing applications and plans their migration and modernisation onto Kubernetes.repo ↗kptSandboxTreats Kubernetes configuration as data, applying reusable functions to manifests instead of templating them.repo ↗KUDOSandboxDeclares operator behaviour as plans and phases in YAML, so an operator needs no custom Go controller.repo ↗KusionStackSandboxAn intent-driven platform orchestrator that compiles application intent into the resources each environment needs.repo ↗MesherySandboxA management plane for service meshes and cloud native infrastructure, applying designs as versioned configuration.repo ↗OpenChoreoSandboxAn internal developer platform for Kubernetes with a Backstage portal, CI/CD, GitOps, and built-in observability.repo ↗OpenGitOpsSandboxA vendor-neutral set of GitOps principles and terminology, maintained as a specification rather than a tool.repo ↗PipeCDSandboxA GitOps delivery platform that deploys Kubernetes, Terraform, Lambda, and Cloud Run from one pipeline model.repo ↗PorterSandboxPackages an application, its client tools, and its deployment logic into one versioned bundle anyone can install.repo ↗RadiusSandboxModels an application and its dependencies as one graph, then provisions and connects them per environment.repo ↗ScoreSandboxA workload specification developers write once, translated into Kubernetes, Compose, or other platform config.repo ↗Serverless WorkflowSandboxA vendor-neutral DSL for declaring workflows, with runtimes that execute the same definition anywhere.repo ↗ShipwrightSandboxRuns container image builds inside Kubernetes using Buildpacks, Buildah, or Kaniko, driven by custom resources.repo ↗StackerSandboxBuilds OCI images and related artifacts such as SBOMs from a declarative YAML file, with no daemon involved.repo ↗werfSandboxA CLI that builds images and delivers them to Kubernetes, with Git as the single source of truth for the desired state.repo ↗xRegistrySandboxAn abstract model and REST interface for registries of metadata, so different registries are discovered the same way.repo ↗

Provisioning & Infrastructure

CrossplaneGraduatedA Kubernetes control-plane framework: define your own APIs and reconcile cloud and in-cluster resources.metal3-ioIncubatingKubernetes-native bare metal host provisioning that drives OpenStack Ironic through the BareMetalHost CRD.KairosSandboxTurns any Linux distribution into an immutable, atomically upgradable OS image for edge Kubernetes nodes.repo ↗KubeanSandboxCluster lifecycle management built on Kubespray, driven entirely by Kubernetes custom resources.repo ↗KubeClipperSandboxInstalls and manages the lifecycle of Kubernetes clusters on existing hosts, through a web console and an API.repo ↗NMstateSandboxDeclarative host network configuration, applied on nodes through a Kubernetes operator or a local command line tool.repo ↗OpenTofuSandboxAn open source infrastructure as code tool, forked from Terraform and governed by the community.repo ↗TinkerbellSandboxProvisions bare metal machines: network and ISO boot, BMC control, a metadata service, and a workflow engine.repo ↗

Service Mesh & Networking

CiliumGraduatedeBPF-based networking, security, and observability for Kubernetes, with policy written against workload identity.CoreDNSGraduatedA DNS server that resolves each query through a configured chain of plugins; the default Kubernetes cluster DNS.EnvoyGraduatedAn out-of-process L4/L7 proxy and universal data plane for polyglot microservices.IstioGraduatedA service mesh that puts a programmable proxy next to every workload, moving traffic, mTLS, and telemetry out of app code.LinkerdGraduatedA Kubernetes service mesh adding mTLS, metrics, and reliability through a lightweight Rust sidecar proxy.Container Network Interface (CNI)IncubatingA minimal, runtime-agnostic spec plus Go libraries that let any container runtime hand pod networking to pluggable executables.Aeraki MeshSandboxA control plane that extends Istio to manage non-HTTP layer-7 protocols like Dubbo, Thrift, and Kafka in a service mesh.AntreaSandboxA Kubernetes-native CNI that uses Open vSwitch as its data plane to provide pod networking and NetworkPolicy.k8gbIncubatingGlobal load balancing across Kubernetes clusters, built out of DNS delegation and CoreDNS instead of an appliance or a control plane.KmeshSandboxA service mesh data plane that moves traffic management into the kernel with eBPF, avoiding a per-pod sidecar.repo ↗Kube-OVNSandboxBrings OVN and Open vSwitch networking to Kubernetes, adding subnets, VPCs, QoS, and traffic mirroring.repo ↗kube-vipSandboxProvides a virtual IP for the control plane and load balancer addresses for services, with no cloud dependency.repo ↗KumaSandboxAn Envoy-based service mesh that covers both Kubernetes and plain VMs from a single control plane.repo ↗LoxiLBSandboxAn eBPF load balancer for Kubernetes, edge, and 5G that handles cluster services and external traffic alike.repo ↗MetalLBSandboxGives LoadBalancer services a real IP on bare metal clusters, announced over ARP or BGP.repo ↗Network Service MeshSandboxConnects workloads across clusters and clouds into on-demand virtual L3 networks, independent of the CNI in use.repo ↗OVN-KubernetesSandboxA CNI plugin that implements Kubernetes networking on top of OVN, shipped by several Kubernetes distributions.repo ↗SermantSandboxA proxyless service mesh for Java that injects traffic governance through a Java agent instead of a sidecar.repo ↗SpiderpoolSandboxIP address management for underlay and RDMA networking on bare metal, virtual machines, and public cloud.repo ↗SubmarinerSandboxConnects pods and services across Kubernetes clusters with encrypted tunnels and cross-cluster service discovery.repo ↗

API Gateway

ContourIncubatingA Kubernetes ingress controller that programs Envoy as its data plane, translating Ingress, its HTTPProxy CRD, and Gateway API into live Envoy config over xDS.Emissary-IngressIncubatingKubernetes-native API gateway and ingress built on Envoy Proxy, driven entirely by CRDs.BFESandboxA Go layer-7 load balancer and reverse proxy from Baidu, with content-based routing via a human-readable condition DSL and two-stage GSLB/SLB load balancing.EasegressSandboxA Go traffic gateway with a result-driven filter pipeline and embedded etcd for self-contained HA.HigressSandboxAn API gateway that embeds a forked Istio Pilot to turn Ingress and nginx annotations into Envoy config, with a Wasm plugin layer for AI and traffic.KgatewaySandboxAn Envoy-powered Kubernetes gateway that implements Gateway API, with a control plane for routing and policy.repo ↗KuadrantSandboxAdds rate limiting, authentication, and DNS policy on top of Gateway API gateways such as Istio and Envoy Gateway.repo ↗

Observability

FluentdGraduatedA unified logging layer that collects events, routes them by tag, buffers, and ships them to many destinations.JaegerGraduatedA distributed tracing platform; in v2 it ships as an OpenTelemetry Collector distribution.OpenTelemetryGraduatedA vendor-neutral standard and toolchain for generating, collecting, and exporting traces, metrics, and logs.PrometheusGraduatedMetrics-based monitoring that pulls time series over HTTP, stores them in a local TSDB, and queries with PromQL.CortexIncubatingA horizontally scalable, multi-tenant, long-term storage backend for Prometheus that receives metrics over remote write.OpenCostIncubatingVendor-neutral CNCF spec and engine for real-time Kubernetes and cloud cost allocation.ThanosIncubatingExtends Prometheus with object-storage long-term retention and a single global query view across many servers.HolmesGPTSandboxAn AI agent that investigates production incidents by driving read-only observability tools through a controlled LLM loop.Inspektor GadgetSandboxA collection of eBPF gadgets that trace syscalls, network, and file activity on Linux and map every event back to a pod.repo ↗K8sGPTSandboxScans a cluster for broken resources and explains each problem in plain language, optionally through an LLM.repo ↗KeplerSandboxEstimates per-pod and per-node energy use from eBPF probes and hardware counters, exported as Prometheus metrics.repo ↗KuberhealthySandboxRuns synthetic checks as pods, so monitoring reports whether the cluster actually works rather than whether it is up.repo ↗Logging Operator (Kube Logging)SandboxManages Fluent Bit and Fluentd log pipelines on Kubernetes from custom resources, configurable per namespace.repo ↗PersesSandboxA dashboard tool for Prometheus, Thanos, and Jaeger data, with dashboards defined as versionable resources.repo ↗PixieSandboxInstruments a cluster with eBPF and answers questions about traffic, requests, and performance without code changes.repo ↗TricksterSandboxAn HTTP reverse proxy and cache for time series databases that serves dashboard queries from a delta cache.repo ↗

Security & Compliance

cert-managerGraduatedIssues and renews X.509 certificates from ACME, Vault, Venafi, and private CAs as native Kubernetes resources.FalcoGraduatedA runtime security engine that watches Linux kernel events and alerts when activity matches a rule.KyvernoGraduatedA Kubernetes admission engine where each policy is itself a Kubernetes resource written as YAML.Cloud CustodianIncubatingA YAML policy engine for cloud governance that queries resources, filters them, and runs actions like tagging, stopping, or deleting, so rules live as code instead of ad hoc scripts.KubescapeIncubatingOpen-source Kubernetes security platform for misconfiguration, vulnerability, and runtime scanning from IDE to running cluster.Confidential ContainersIncubatingRun unmodified Kubernetes Pods inside confidential VMs and release secrets only to workloads that pass remote attestation.Bank-VaultsSandboxAutomates initializing, unsealing, and configuring HashiCorp Vault, keeping unseal keys encrypted with cloud KMS for Kubernetes.CartographySandboxPulls cloud and SaaS assets and the relationships between them into a Neo4j graph so you can query exposure and access paths with Cypher.CopaceticSandboxPatches known OS-package vulnerabilities into an existing container image as an additive layer, driven by a scanner report, without a rebuild.EraserSandboxDeletes vulnerable and unwanted container images from every Kubernetes node, never touching images a running container uses.External Secrets OperatorSandboxSyncs secrets from external managers like AWS, Vault, and GCP into native Kubernetes Secrets.KeylimeSandboxRemote attestation for machines using TPM measured boot, with continuous runtime integrity monitoring.repo ↗KubeArmorSandboxRestricts what a pod may execute, read, and reach at runtime, enforced through LSMs such as AppArmor and BPF-LSM.repo ↗OSCAL-COMPASSSandboxTools for authoring, validating, and governing compliance documents in the NIST OSCAL format.repo ↗ParsecSandboxA platform abstraction that lets applications use a machine's hardware security features through one API.repo ↗SlimToolkitSandboxInspects a container image at runtime and rebuilds it with only the files the application actually uses.repo ↗SOPSSandboxEncrypts the values inside YAML, JSON, and env files with KMS, age, or PGP, leaving the structure readable in git.repo ↗

Identity & Policy

AutheliaIndependentSSO and 2FA for your reverse proxy, plus an OpenID Connect provider OpenFGAIncubatingZanzibar-style fine-grained authorization from relationship tuples and a declarative model SpiceDBIndependentA Zanzibar-inspired permissions database that answers checks by traversing a relationship graph PermifyIndependentA Zanzibar-style authorization engine backed by relation tuples in PostgreSQL authentikIndependentA self-hosted identity provider: SSO, OAuth2/OIDC, SAML, and LDAP with a visual flow editor ZITADELIndependentAPI-first, event-sourced identity platform with multi-tenancy built in OAuth2 ProxySandboxA reverse proxy that puts OAuth2/OIDC login in front of a service that has none Open Policy Agent (OPA)GraduatedA general-purpose policy engine that decouples authorization from app code, evaluated via the Rego language.SPIFFEGraduatedStandards for giving workloads a short-lived, cryptographically verifiable identity without pre-shared secrets.SPIREGraduatedIssues short-lived, attested workload identities (X509-SVID and JWT-SVID); the SPIFFE reference implementation.KeycloakIncubatingOpen-source identity and access management server speaking OIDC, OAuth 2.0, and SAML for apps and services.AthenzSandboxX.509 service identity and fine-grained RBAC for dynamic, hybrid-cloud infrastructure.CapsuleSandboxSoft multi-tenancy for Kubernetes: group namespaces under a Tenant CRD and enforce isolation with admission webhooks.CedarSandboxA policy language and evaluation engine for fine-grained authorization, designed so policies can be analyzed statically and the engine itself formally verified.DexSandboxA federated OpenID Connect provider that delegates login to upstream identity providers like LDAP, SAML, GitHub, and Google.KubewardenSandboxA Kubernetes policy engine whose admission policies compile to WebAssembly, written in CEL, Rego, Rust, or Go.repo ↗ParalusSandboxControlled and audited access to Kubernetes clusters, with short-lived credentials issued per user and role.repo ↗TokenetesSandboxIssues and verifies Transaction Tokens so a call chain carries immutable identity and context between services.repo ↗

Supply Chain

in-totoGraduatedVerifies every step of a software supply chain was done as planned by authorized parties The Update Framework (TUF)GraduatedSecures software update systems so a compromised repo or key cannot push malicious updates GUACIndependentAggregates software supply chain metadata into a queryable graph HarborGraduatedAn OCI registry that adds RBAC, vulnerability scanning, replication, and signature verification.Notary ProjectIncubatingSign and verify OCI artifacts with X.509 PKI, storing portable signatures as OCI Referrers next to the artifact.DalecSandboxDeclarative YAML to native RPM/DEB packages and minimal, signed, SBOM-attested containers, using only Docker.Open Policy ContainersSandboxBuilds, signs, tags, and distributes OPA policy bundles as OCI artifacts through any compliant registry.repo ↗ORASSandboxCLI and SDKs for pushing and pulling arbitrary artifacts, not only images, to and from OCI registries.repo ↗RatifySandboxVerifies signatures, SBOMs, and other artifact metadata at admission time and rejects what fails policy.repo ↗

Storage & Database

CubeFSGraduatedA distributed file and object store that separates metadata from data, per-volume replication or erasure coding.etcdGraduatedA distributed key-value store that uses Raft to keep a small, critical dataset consistent across a cluster.RookGraduatedA Kubernetes operator that runs Ceph as declarative custom resources for block, file, and object storage.VitessGraduatedA clustering system that shards MySQL horizontally behind a single MySQL-compatible endpoint.TiKVGraduatedA distributed, transactional key-value database, the storage layer behind TiDB.FluidIncubatingA Kubernetes operator that makes datasets a first-class resource and orchestrates distributed caches to speed up data access for AI and big-data workloads.LonghornIncubatingKubernetes-native distributed block storage that gives every volume its own lightweight engine and replicas.CarinaSandboxA CSI driver that carves local node disks into volumes with LVM, built for databases that want raw local disk performance.CloudNativePGSandboxA Kubernetes operator that runs PostgreSQL with high availability, using the Kubernetes API itself as the consensus store instead of etcd or Patroni.composefsSandboxA read-only mountable filesystem that stores only metadata and shares file content from an external content-addressed store, with optional fs-verity sealing.CurvineSandboxA Rust distributed cache across memory, SSD, and disk that fronts object storage behind POSIX, S3, and HDFS interfaces.repo ↗HwameiStorSandboxTurns the local disks on Kubernetes nodes into a highly available storage pool for stateful workloads.repo ↗K8upSandboxA backup operator for Kubernetes and OpenShift that schedules Restic backups of volumes and application data.repo ↗KanisterSandboxRuns application-aware backup and restore as Kubernetes Blueprints instead of generic volume snapshots.repo ↗OpenEBSSandboxContainer-native storage that builds persistent volumes out of the local and replicated disks a cluster already has.repo ↗OpenEverestSandboxProvisions and operates database clusters on any Kubernetes infrastructure, across several database engines.repo ↗openGeminiSandboxA distributed time series database built for high write concurrency and long-term storage of metrics.repo ↗Piraeus DatastoreSandboxRuns LINSTOR and DRBD on Kubernetes so pods get replicated block storage from node-local disks.repo ↗SchemaHeroSandboxDeclarative database schema migrations as Kubernetes custom resources, planned and applied by an operator.repo ↗VeleroSandboxBacks up, restores, and migrates Kubernetes cluster resources together with their persistent volumes.repo ↗

Messaging & Streaming

NATSIncubatingHigh-performance, single-binary messaging for cloud and edge, with optional JetStream persistence.StrimziIncubatingRun and operate Apache Kafka on Kubernetes through declarative custom resources and operators.Apicurio RegistrySandboxA runtime server that stores, versions, and validates API definitions and event schemas, with pluggable storage backends.DrasiSandboxDetect changes across data sources with standing Cypher queries and fire reactions, without copying or polling the data.TremorSandboxAn event processing runtime for unstructured data, with structural pattern matching for filtering and transformation.repo ↗

Runtime

containerdGraduatedAn OCI-compliant container runtime daemon, the runtime layer beneath Kubernetes and Docker.CRI-OGraduatedA lightweight, Kubernetes-only Container Runtime Interface implementation for running OCI containers.DragonflyGraduatedPeer-to-peer distribution of container images, files, and AI models across large clusters.Flatcar Container LinuxIncubatingA minimal, immutable Linux distribution for running containers, with A/B partitions and atomic automatic updates.LimaIncubatingLinux virtual machines on macOS, Linux, and Windows with automatic file sharing and port forwarding.bootcSandboxTransactional, in-place operating system updates that ship the whole host as an OCI container image.bpfmanSandboxAn eBPF program manager that loads, attaches, and tracks eBPF programs on a node so applications avoid privileged kernel access.container2wasmSandboxConverts a container image into a WebAssembly image that runs on a WASI runtime or in a browser, by compiling a CPU emulator to Wasm and running a real Linux plus runc inside it.HyperlightSandboxA library that runs each function call inside its own micro VM, giving untrusted guest code hardware isolation with a fast start.repo ↗Inclavare ContainersSandboxA confidential computing container runtime that starts workloads inside hardware enclaves.repo ↗InterlinkSandboxExecutes a Kubernetes pod on remote compute such as an HPC batch system, through a virtual kubelet provider.repo ↗KuasarSandboxA container runtime that hosts several sandbox types, microVM, Wasm, and application kernel, behind one containerd shim.repo ↗Podman Container ToolsSandboxThe daemonless container toolchain: Podman runs containers, Buildah builds images, Skopeo moves them between registries.repo ↗uruncSandboxA CRI-compatible runtime that runs unikernels and application kernels as if they were ordinary containers.repo ↗Virtual KubeletSandboxA kubelet implementation that registers a node backed by any API, so pods can land on serverless or external compute.repo ↗youkiSandboxAn OCI container runtime written in Rust, usable as a drop-in alternative to runc.repo ↗

WebAssembly

wasmCloudIncubatingA WebAssembly component runtime that runs the same host locally and on Kubernetes, wiring components to swappable capability plugins.SpinSandboxA framework for building and deploying serverless applications compiled to WebAssembly.repo ↗SpinKubeSandboxRuns Spin WebAssembly applications on Kubernetes as first-class workloads, through a containerd shim and an operator.repo ↗WasmEdge RuntimeSandboxA WebAssembly runtime for cloud, edge, and embedded workloads, with host extensions for networking and inference.repo ↗

AI & Machine Learning

KubeflowGraduatedOrchestrates end-to-end machine learning workflows on Kubernetes by compiling pipeline definitions into Argo Workflows and tracking every run in ML Metadata.HAMiIncubatingShare one physical GPU across Kubernetes pods by memory and compute, with per-pod limits enforced at runtime and no application changes.KServeIncubatingKubernetes-native, multi-framework inference platform that turns a model into an autoscaling InferenceService for both predictive and generative AI.Volcano-KthenaIncubatingKubernetes-native LLM inference orchestration that pairs Volcano gang scheduling with KV-cache-aware, prefill-decode routing.kagentSandboxRuns AI agents inside Kubernetes for DevOps and platform work, with the agents themselves defined as custom resources.repo ↗KAI SchedulerSandboxA Kubernetes scheduler that allocates GPUs to AI workloads with queues, quotas, and fractional sharing.repo ↗KAITOSandboxAn operator that deploys and tunes open-weight language models on Kubernetes, provisioning GPU nodes as needed.repo ↗KitOpsSandboxPackages models, datasets, and code into one versioned OCI artifact, so ML projects ship like container images.repo ↗llm-dSandboxDistributed LLM inference on Kubernetes, built on vLLM and the Gateway API inference extension.repo ↗ModelPackSandboxAn open specification for packaging, distributing, and running AI artifacts in cloud native environments.repo ↗

Container Registry

DistributionSandboxThe open-source registry that stores and serves container images, and the OCI Distribution core many registries build on.zotSandboxAn OCI-native registry that stores images and artifacts with no extra services, from a laptop to production.repo ↗

Chaos Engineering

Chaos MeshIncubatingA Kubernetes-native chaos engineering platform that injects faults into pods, networks, filesystems, and the kernel through custom resources.LitmusIncubatingCloud-native chaos engineering for Kubernetes, with a central control plane and a shared hub of reusable experiments.ChaosbladeSandboxA single command-line tool that injects faults across hosts, the JVM, C++, containers, and Kubernetes by dispatching versioned YAML experiment specs to per-domain executors.KrknSandboxInjects failures into Kubernetes clusters and measures how the workloads and control plane hold up.repo ↗

Developer Tools

BackstageIncubatingA framework for building developer portals: a software catalog, templates, and docs assembled into one internal application you own.gRPCIncubatingA high-performance RPC framework that turns a Protocol Buffers service definition into typed clients and servers running over HTTP/2.MicrocksIncubatingSpec-driven mock and contract-testing server: import an API artifact, get a live mock and contract tests from the same contract.OpenFeatureIncubatingA vendor-neutral standard and reference daemon (flagd) for feature flag evaluation across any language and backend.Connect RPCSandboxA Protocol Buffers RPC framework that generates typed clients and servers on plain net/http, so one server speaks the Connect protocol, gRPC, and gRPC-Web at once.ContainerSSHSandboxAn SSH server that boots a throwaway container for each connection and delegates authentication and per-connection configuration to external HTTP webhooks.DevfileSandboxA YAML standard for cloud development workspaces, defined as Go types that generate every CRD, JSON schema, and TypeScript model.DevSpaceSandboxA client-only CLI that runs your local code inside a Kubernetes pod and syncs edits both ways for in-cluster development.HeadlampSandboxAn extensible web and desktop UI for Kubernetes that proxies every cluster API through its own backend and loads plugins at runtime.koSandboxBuilds and pushes container images for Go programs without a Dockerfile or a running Docker daemon.repo ↗Kube-burnerSandboxDrives load against a Kubernetes API server and measures the result, for scale and performance testing.repo ↗kube-rsSandboxThe Rust client and controller runtime for Kubernetes: typed API access, watchers, and reconcilers.repo ↗KubeElastiSandboxScales workloads to zero and back by queueing incoming requests in a proxy until the pods are ready.repo ↗Podman DesktopSandboxA desktop application for building, running, and inspecting containers and Kubernetes workloads locally.repo ↗Runme NotebooksSandboxTurns Markdown runbooks into executable notebooks, so the documented commands are the ones that actually run.repo ↗Serverless DevsSandboxA CLI that develops and deploys serverless applications across cloud providers from one project definition.repo ↗TelepresenceSandboxRoutes traffic between a remote cluster and a local process, so a service can be debugged on a laptop.repo ↗Visual Studio Code Kubernetes ToolsSandboxThe VS Code extension for browsing clusters, editing manifests, and debugging workloads from the editor.repo ↗