OpenUBA is a full-stack User and Entity Behavior Analytics (UEBA) platform for security anomaly detection, investigation, and response. It provides a complete lifecycle for ML models (install, train, infer, version, share) via a pluggable registry supporting OpenUBA Hub, GitHub, HuggingFace, and local filesystem. The platform includes a rule engine with a visual DAG-based builder (ReactFlow), case management, real-time dashboards, multi-backend visualization (matplotlib, plotly, bokeh, etc.), and an LLM-powered assistant. The backend is built on FastAPI with PostgreSQL, SQLAlchemy, JWT/RBAC authentication, and optional Spark/Elasticsearch integrations. The frontend uses Next.js 14 (App Router), Apollo Client (GraphQL), shadcn/ui, and Recharts. A Python SDK enables programmatic access to all features. The system runs on Kubernetes with a Kopf operator managing custom resources (UBATraining, UBAInference, UBAWorkspace, UBAPipeline) for containerized model execution in isolated Docker images per ML framework (sklearn, PyTorch, TensorFlow, NetworkX). While primarily an application, it includes research-oriented components like experiment tracking, feature store, and Jupyter notebook workspaces, making it a hybrid tool for both security operations and data science workflows.
This is the official Crossplane provider for AWS, a Kubernetes-native controller that manages AWS cloud resources as Custom Resource Definitions (CRDs). It defines hundreds of APIs across 50+ AWS services (EC2, S3, IAM, RDS, EKS, Lambda, etc.) and implements controllers that reconcile the desired state by calling AWS SDK operations. The system follows the Crossplane managed resource pattern: each resource type has a corresponding controller with hooks for observe, create, update, delete, and late initialization. A single binary (`cmd/provider/main.go`) registers all controllers and runs as a Kubernetes controller manager. The project relies heavily on code generators (angryjet, ack-generate, goverter, controller-gen) to produce CRD types, conversion functions, and resolver code from AWS API schemas. Hand-written custom hooks add resource-specific logic (e.g., tag diffing, policy comparison, engine version ordering). While the architecture is solid and the project is actively maintained, technical drift is present due to mixed AWS SDK v1/v2 usage, many incomplete `isUpToDate` implementations, and a large surface of generated code that must be kept in sync.
The Hyperledger Bevel Fabric Operator is a Kubernetes operator for managing the full lifecycle of Hyperledger Fabric networks. It provides custom resource definitions (CRDs) and controllers for Certificate Authorities (CAs), peers, ordering service nodes, chaincode (install, approve, commit), channels (main and follower), identities, network configurations, and an operator UI/API. The system also includes a kubectl plugin for CLI-based management. It supports multiple ingress controllers (Istio, Traefik, Gateway API), credential stores (Kubernetes Secrets, HashiCorp Vault), and database backends for the built-in Fabric CA. The operator vendors and patches upstream Hyperledger Fabric and Fabric CA libraries for cryptographic operations, MSP configuration, policy building, and channel configuration. The codebase is well-structured with generated client code, consistent controller patterns (finalizers, status conditions), and comprehensive integration tests. It is actively maintained under the Hyperledger Bevel project, with a large community and regular releases.
K8up is a Kubernetes Operator designed for data protection, specifically managing backup and restore operations for Persistent Volume Claims (PVCs) and applications using the Restic backup tool. It functions as a control plane that reconciles Custom Resource Definitions (CRDs) such as Schedule, Backup, Restore, Prune, and Check into Kubernetes Jobs. The architecture is a monolithic binary (`cmd/k8up`) that can run as an operator or a CLI tool, utilizing the Kubebuilder framework and controller-runtime for the operator logic. It supports multiple storage backends (S3, Azure, GCS, Swift, etc.) and integrates with Prometheus for metrics and Grafana for dashboards. The codebase demonstrates a solid separation of concerns, with distinct modules for the operator logic (`operator/`), the Restic CLI wrapper (`restic/`), and the API definitions (`api/v1/`). It employs standard Kubernetes patterns like Job-based execution, RBAC, and Secret management for credentials. The project includes comprehensive testing, including unit tests, integration tests using envtest, and E2E tests using Bats. However, the codebase exhibits signs of technical drift, notably the `go.mod` file specifying a non-existent Go version (1.26), which suggests potential build instability or experimental state. Additionally, deprecated fields in CRDs (e.g., `keepJobs`) require migration attention. This repository is suitable for engineers needing a production-grade backup solution for Kubernetes clusters. It is particularly valuable for teams requiring declarative backup management, multi-cloud storage support, and application-aware backup capabilities via annotations or PreBackupPods. The high technical drift rating is primarily due to the Go version anomaly, but the architectural patterns and test coverage remain robust.
This repository provides the official Helm charts for deploying Mattermost, an open-source messaging platform, and its associated services (Focalboard, RTCD, Push Proxy, Calls Offloader) onto Kubernetes. The primary deployment method is the `mattermost-operator` chart, which uses Kubernetes Custom Resource Definitions (CRDs) to declaratively manage the full lifecycle of Mattermost installations, including databases, file stores, ingresses, and scaling. Legacy charts (`mattermost-enterprise-edition`, `mattermost-team-edition`) are included but deprecated in favor of the operator. The architecture is a collection of Helm charts, with the operator chart acting as the core. It relies on external dependencies like PostgreSQL, S3-compatible storage, and optionally Elasticsearch and Grafana. The repository demonstrates strong DevOps practices, including automated CI/CD for chart releases, end-to-end testing with kind, and embedded monitoring configuration. Key reusable patterns include a Helm-embedded Grafana dashboard template for application KPIs, an ExternalSecrets integration for secure credential management, a deprecation handling template for managing breaking changes, and advanced Kubernetes storage patterns (EFS, NFS). The codebase is actively maintained but carries some technical drift from legacy components and outdated Kubernetes API versions.
Eidolon is an open-source framework for building, deploying, and managing multi-agent AI applications. It provides a Python SDK with abstractions for LLM integration (OpenAI, Anthropic, Mistral, Ollama, Azure), retrieval-augmented generation (RAG) pipelines, memory systems (vector stores, symbolic memory, file storage), and document processing (loaders, parsers, splitters). Agents are configured declaratively via YAML and can communicate with each other, use tools, and stream responses. The framework includes a Kubernetes operator for production deployment, a web UI built with Next.js and React for chatbot interaction and developer tooling, and a TypeScript client library. It also features built-in agent types like SimpleAgent, RetrieverAgent, SQLAgent, and a Tree-of-Thought agent, along with logic units for web search, browser automation, and API integration.
secretgen-controller is a Kubernetes operator that automates the generation and sharing of secrets within a cluster. It defines custom resources (Certificate, Password, RSAKey, SSHKey) that produce corresponding Kubernetes secrets, and provides cross-namespace secret export/import via SecretExport and SecretImport CRDs. Additionally, a SecretTemplate CRD allows constructing secrets from data in arbitrary Kubernetes resources using JSONPath expressions. The controller is part of the Carvel tool suite and is built with controller-runtime, using generated clientsets and informers for both the original secretgen.k14s.io API group and the newer secretgen.carvel.dev group. The architecture follows the standard Kubernetes operator pattern: a single controller binary (cmd/controller/main.go) registers multiple reconcilers for each CRD, plus a SecretReconciler that handles image pull secret merging from exported secrets. Reconcilers use a thread-safe tracker to watch input resources and a generic status helper to update conditions. Secret generation relies on the cloudfoundry/config-server library for cryptographic operations, with FIPS 140-3 support added for SSH key fingerprints and certificate SubjectKeyId. The sharing subsystem maintains an in-memory cache of secret exports with sorting and weight logic to resolve conflicts. The codebase is well-structured with clear separation of concerns, comprehensive end-to-end tests, and a robust CI/CD pipeline. However, it carries some technical debt: two API groups that may diverge, heavy reliance on code generation, and potential performance issues from listing all resources on every relevant event. The use of panic statements in shared code and the custom fork of cloudfoundry/config-server introduce maintenance risks. Overall, it is a production-grade operator suitable for managing secrets in Kubernetes environments.