Skip to content
Catalog
Every project below links to a full deep-dive: history, architecture, real-world adoption, and code internals read from the upstream repository at a pinned commit. Projects are grouped by role and labelled by CNCF maturity.
Browse by category
Orchestration & Scheduling
KEDAGraduatedEvent-driven autoscaling for Kubernetes, including scale-to-zero, by feeding external events into the HPA.KnativeGraduatedRuns containers as request-driven serverless workloads on Kubernetes, including scale to zero.KubeEdgeGraduatedExtends a Kubernetes control plane to edge nodes and IoT devices over unreliable networks.KubernetesGraduatedRun containers across many machines by declaring desired state; controllers drive the cluster toward it.KarmadaIncubatingKubernetes-native control plane that propagates and schedules workloads across many clusters and clouds.KServeIncubatingKubernetes-native, multi-framework inference platform that turns a model into an autoscaling InferenceService for both predictive and generative AI.KubeflowIncubatingOrchestrates end-to-end machine learning workflows on Kubernetes by compiling pipeline definitions into Argo Workflows and tracking every run in ML Metadata.KubeVirtIncubatingRun and manage KVM virtual machines as first-class Kubernetes workloads.metal3-ioIncubatingKubernetes-native bare metal host provisioning that drives OpenStack Ironic through the BareMetalHost CRD.OpenKruiseIncubatingKubernetes controllers that extend the standard workloads and update container images in place without recreating Pods.OpenYurtIncubatingExtend a vanilla Kubernetes control plane to edge nodes with offline autonomy, keeping the upstream API intact.VolcanoIncubatingA Kubernetes-native batch scheduler that adds gang scheduling, queues, and fair-share to clusters running AI, ML, and big-data workloads.Volcano-KthenaIncubatingKubernetes-native LLM inference orchestration that pairs Volcano gang scheduling with KV-cache-aware, prefill-decode routing.AgonesSandboxHost, run, and scale dedicated multiplayer game servers on Kubernetes using custom resources and controllers.AkriSandboxDiscovers edge leaf devices (cameras, USB, OPC UA) and exposes them to Kubernetes as schedulable resources.ArmadaSandboxA high-throughput batch job scheduler that queues and schedules work across many Kubernetes clusters from outside the clusters themselves.Cadence WorkflowSandboxA fault-tolerant, code-first orchestration engine that runs long-lived workflows and resumes them from event history after any crash.HAMiIncubatingShare one physical GPU across Kubernetes pods by memory and compute, with per-pod limits enforced at runtime and no application changes.
App Definition & GitOps
Argo CDGraduatedPull-based GitOps continuous delivery for Kubernetes, reconciling cluster state against Git.CloudEventsGraduatedA vendor-neutral specification for event data, with SDKs that carry events across HTTP, Kafka, and MQTT.CrossplaneGraduatedA Kubernetes control-plane framework: define your own APIs and reconcile cloud and in-cluster resources.DaprGraduatedA sidecar runtime giving any app portable building-block APIs for state, pub/sub, invocation, and actors.FluxGraduatedA GitOps tool that keeps a Kubernetes cluster continuously reconciled with manifests stored in Git.HelmGraduatedThe package manager for Kubernetes: bundle, version, and install related resources as a chart.Artifact HubIncubatingAn open, CNCF-hosted index to find, install, and publish Cloud Native packages across more than two dozen artifact kinds.BuildpacksIncubatingTurn application source code into production-ready OCI images without writing a Dockerfile.KubeVelaIncubatingApplication-centric delivery control plane that turns one OAM Application into multi-cluster Kubernetes resources via composable CUE modules.Operator FrameworkIncubatingToolkit to build, package, and ship Kubernetes Operators in Go, Ansible, or Helm, wired into OLM for install and upgrades.AtlantisSandboxA self-hosted server that runs Terraform and OpenTofu from pull request comments, planning and applying infrastructure in the open before merge.CozystackSandboxA bare-metal private-cloud framework that serves managed Kubernetes, VMs, and databases as Flux HelmReleases through one aggregated API.
Service Mesh & Networking
CiliumGraduatedeBPF-based networking, security, and observability for Kubernetes, with policy written against workload identity.CoreDNSGraduatedA DNS server that resolves each query through a configured chain of plugins; the default Kubernetes cluster DNS.EnvoyGraduatedAn out-of-process L4/L7 proxy and universal data plane for polyglot microservices.IstioGraduatedA service mesh that puts a programmable proxy next to every workload, moving traffic, mTLS, and telemetry out of app code.LinkerdGraduatedA Kubernetes service mesh adding mTLS, metrics, and reliability through a lightweight Rust sidecar proxy.Container Network Interface (CNI)IncubatingA minimal, runtime-agnostic spec plus Go libraries that let any container runtime hand pod networking to pluggable executables.Aeraki MeshSandboxA control plane that extends Istio to manage non-HTTP layer-7 protocols like Dubbo, Thrift, and Kafka in a service mesh.AntreaSandboxA Kubernetes-native CNI that uses Open vSwitch as its data plane to provide pod networking and NetworkPolicy.
API Gateway
ContourIncubatingA Kubernetes ingress controller that programs Envoy as its data plane, translating Ingress, its HTTPProxy CRD, and Gateway API into live Envoy config over xDS.Emissary-IngressIncubatingKubernetes-native API gateway and ingress built on Envoy Proxy, driven entirely by CRDs.BFESandboxA Go layer-7 load balancer and reverse proxy from Baidu, with content-based routing via a human-readable condition DSL and two-stage GSLB/SLB load balancing.EasegressSandboxA Go traffic gateway with a result-driven filter pipeline and embedded etcd for self-contained HA.HigressSandboxAn API gateway that embeds a forked Istio Pilot to turn Ingress and nginx annotations into Envoy config, with a Wasm plugin layer for AI and traffic.
Observability
FluentdGraduatedA unified logging layer that collects events, routes them by tag, buffers, and ships them to many destinations.JaegerGraduatedA distributed tracing platform; in v2 it ships as an OpenTelemetry Collector distribution.OpenTelemetryGraduatedA vendor-neutral standard and toolchain for generating, collecting, and exporting traces, metrics, and logs.PrometheusGraduatedMetrics-based monitoring that pulls time series over HTTP, stores them in a local TSDB, and queries with PromQL.CortexIncubatingA horizontally scalable, multi-tenant, long-term storage backend for Prometheus that receives metrics over remote write.OpenCostIncubatingVendor-neutral CNCF spec and engine for real-time Kubernetes and cloud cost allocation.ThanosIncubatingExtends Prometheus with object-storage long-term retention and a single global query view across many servers.HolmesGPTSandboxAn AI agent that investigates production incidents by driving read-only observability tools through a controlled LLM loop.
Security & Compliance
cert-managerGraduatedIssues and renews X.509 certificates from ACME, Vault, Venafi, and private CAs as native Kubernetes resources.FalcoGraduatedA runtime security engine that watches Linux kernel events and alerts when activity matches a rule.KyvernoGraduatedA Kubernetes admission engine where each policy is itself a Kubernetes resource written as YAML.Cloud CustodianIncubatingA YAML policy engine for cloud governance that queries resources, filters them, and runs actions like tagging, stopping, or deleting, so rules live as code instead of ad hoc scripts.KubescapeIncubatingOpen-source Kubernetes security platform for misconfiguration, vulnerability, and runtime scanning from IDE to running cluster.Confidential ContainersSandboxRun unmodified Kubernetes Pods inside confidential VMs and release secrets only to workloads that pass remote attestation.Bank-VaultsSandboxAutomates initializing, unsealing, and configuring HashiCorp Vault, keeping unseal keys encrypted with cloud KMS for Kubernetes.CartographySandboxPulls cloud and SaaS assets and the relationships between them into a Neo4j graph so you can query exposure and access paths with Cypher.CopaceticSandboxPatches known OS-package vulnerabilities into an existing container image as an additive layer, driven by a scanner report, without a rebuild.EraserSandboxDeletes vulnerable and unwanted container images from every Kubernetes node, never touching images a running container uses.External Secrets OperatorSandboxSyncs secrets from external managers like AWS, Vault, and GCP into native Kubernetes Secrets.
Identity & Policy
AutheliaIndependentSSO and 2FA for your reverse proxy, plus an OpenID Connect providerOpenFGAIncubatingZanzibar-style fine-grained authorization from relationship tuples and a declarative modelSpiceDBIndependentA Zanzibar-inspired permissions database that answers checks by traversing a relationship graphPermifyIndependentA Zanzibar-style authorization engine backed by relation tuples in PostgreSQLauthentikIndependentA self-hosted identity provider: SSO, OAuth2/OIDC, SAML, and LDAP with a visual flow editorZITADELIndependentAPI-first, event-sourced identity platform with multi-tenancy built inOAuth2 ProxySandboxA reverse proxy that puts OAuth2/OIDC login in front of a service that has noneOpen Policy Agent (OPA)GraduatedA general-purpose policy engine that decouples authorization from app code, evaluated via the Rego language.SPIFFEGraduatedStandards for giving workloads a short-lived, cryptographically verifiable identity without pre-shared secrets.SPIREGraduatedIssues short-lived, attested workload identities (X509-SVID and JWT-SVID); the SPIFFE reference implementation.KeycloakIncubatingOpen-source identity and access management server speaking OIDC, OAuth 2.0, and SAML for apps and services.AthenzSandboxX.509 service identity and fine-grained RBAC for dynamic, hybrid-cloud infrastructure.CapsuleSandboxSoft multi-tenancy for Kubernetes: group namespaces under a Tenant CRD and enforce isolation with admission webhooks.DexSandboxA federated OpenID Connect provider that delegates login to upstream identity providers like LDAP, SAML, GitHub, and Google.
Supply Chain
in-totoGraduatedVerifies every step of a software supply chain was done as planned by authorized partiesThe Update Framework (TUF)GraduatedSecures software update systems so a compromised repo or key cannot push malicious updatesGUACIndependentAggregates software supply chain metadata into a queryable graphHarborGraduatedAn OCI registry that adds RBAC, vulnerability scanning, replication, and signature verification.Notary ProjectIncubatingSign and verify OCI artifacts with X.509 PKI, storing portable signatures as OCI Referrers next to the artifact.DalecSandboxDeclarative YAML to native RPM/DEB packages and minimal, signed, SBOM-attested containers, using only Docker.
Storage & Database
CubeFSGraduatedA distributed file and object store that separates metadata from data, per-volume replication or erasure coding.etcdGraduatedA distributed key-value store that uses Raft to keep a small, critical dataset consistent across a cluster.RookGraduatedA Kubernetes operator that runs Ceph as declarative custom resources for block, file, and object storage.VitessGraduatedA clustering system that shards MySQL horizontally behind a single MySQL-compatible endpoint.TiKVGraduatedA distributed, transactional key-value database, the storage layer behind TiDB.FluidIncubatingA Kubernetes operator that makes datasets a first-class resource and orchestrates distributed caches to speed up data access for AI and big-data workloads.LonghornIncubatingKubernetes-native distributed block storage that gives every volume its own lightweight engine and replicas.CarinaSandboxA CSI driver that carves local node disks into volumes with LVM, built for databases that want raw local disk performance.
Messaging & Streaming
NATSIncubatingHigh-performance, single-binary messaging for cloud and edge, with optional JetStream persistence.StrimziIncubatingRun and operate Apache Kafka on Kubernetes through declarative custom resources and operators.Apicurio RegistrySandboxA runtime server that stores, versions, and validates API definitions and event schemas, with pluggable storage backends.DrasiSandboxDetect changes across data sources with standing Cypher queries and fire reactions, without copying or polling the data.
Runtime
containerdGraduatedAn OCI-compliant container runtime daemon, the runtime layer beneath Kubernetes and Docker.CRI-OGraduatedA lightweight, Kubernetes-only Container Runtime Interface implementation for running OCI containers.DragonflyGraduatedPeer-to-peer distribution of container images, files, and AI models across large clusters.Flatcar Container LinuxIncubatingA minimal, immutable Linux distribution for running containers, with A/B partitions and atomic automatic updates.LimaIncubatingLinux virtual machines on macOS, Linux, and Windows with automatic file sharing and port forwarding.wasmCloudIncubatingA WebAssembly component runtime that runs the same host locally and on Kubernetes, wiring components to swappable capability plugins.bootcSandboxTransactional, in-place operating system updates that ship the whole host as an OCI container image.bpfmanSandboxAn eBPF program manager that loads, attaches, and tracks eBPF programs on a node so applications avoid privileged kernel access.container2wasmSandboxConverts a container image into a WebAssembly image that runs on a WASI runtime or in a browser, by compiling a CPU emulator to Wasm and running a real Linux plus runc inside it.
Container Registry
Chaos Engineering
Developer Tools
BackstageIncubatingA framework for building developer portals: a software catalog, templates, and docs assembled into one internal application you own.gRPCIncubatingA high-performance RPC framework that turns a Protocol Buffers service definition into typed clients and servers running over HTTP/2.MicrocksIncubatingSpec-driven mock and contract-testing server: import an API artifact, get a live mock and contract tests from the same contract.OpenFeatureIncubatingA vendor-neutral standard and reference daemon (flagd) for feature flag evaluation across any language and backend.Connect RPCSandboxA Protocol Buffers RPC framework that generates typed clients and servers on plain net/http, so one server speaks the Connect protocol, gRPC, and gRPC-Web at once.ContainerSSHSandboxAn SSH server that boots a throwaway container for each connection and delegates authentication and per-connection configuration to external HTTP webhooks.DevfileSandboxA YAML standard for cloud development workspaces, defined as Go types that generate every CRD, JSON schema, and TypeScript model.DevSpaceSandboxA client-only CLI that runs your local code inside a Kubernetes pod and syncs edits both ways for in-cluster development.HeadlampSandboxAn extensible web and desktop UI for Kubernetes that proxies every cluster API through its own backend and loads plugins at runtime.