Kong is a cloud-native, platform-agnostic API gateway built on OpenResty/Nginx. It provides traffic management, security, observability, and AI/LLM proxying capabilities through a plugin architecture. The system supports traditional, DB-less, and hybrid deployment modes, with an Admin API for configuration and Kong Manager for GUI-based management. Key features include load balancing, authentication, rate limiting, request/response transformation, and extensive observability integrations.
Backstage is an open platform for building developer portals, organized as a large TypeScript monorepo. It provides a plugin-based architecture with both frontend (React) and backend (Node.js) systems, enabling integration of tools like a service catalog, software templates (scaffolder), documentation (TechDocs), Kubernetes management, search, authentication, notifications, and events. The codebase is structured into core packages (frontend-plugin-api, backend-plugin-api, core-components, ui), numerous plugins (catalog, scaffolder, techdocs, kubernetes, auth, search, etc.), CLI tooling, and a design system (Backstage UI). Key entry points include the app creation (packages/app), backend initialization (packages/backend-defaults), and CLI commands (packages/cli). Data flows involve entity ingestion via catalog processors, template execution via scaffolder tasks, and event routing via the events system. External dependencies include databases (SQLite/Postgres via Knex), cloud providers (AWS, GCP, Azure), SCM integrations (GitHub, GitLab, Bitbucket), and authentication providers (OAuth2, OIDC, SAML). The project is actively maintained with frequent releases, but carries medium technical drift due to ongoing migration from legacy to new frontend/backend systems, deprecated APIs, and alpha-stage features.
Dokku is a production-grade, self-hosted Platform as a Service (PaaS) that manages the full lifecycle of containerized applications. Its architecture is a plugin-based monolith orchestrated by a core Go binary, where every feature (builders, schedulers, proxies, storage, config) is a self-contained plugin that hooks into lifecycle triggers (plugn system). It supports deployment via git push, archives, or Docker images, and can schedule containers locally via Docker or on Kubernetes clusters via its k3s scheduler. The codebase demonstrates high craftsmanship in its plugin architecture and state management. The `common` plugin provides a robust property store, parallel execution engine, and safe command execution utilities that are used across all plugins. The `scheduler-k3s` plugin is a standout, featuring a custom Helm diff engine for previewing infrastructure changes and complex Helm chart generation for Kubernetes resources. The `storage` and `docker-options` plugins contain well-structured parsers for their respective domain-specific languages. While the core Go code is well-structured and heavily tested (Go unit tests, BATS integration tests), the codebase has medium technical drift. The extensive use of shell scripts for plugin triggers introduces fragility, and the Kubernetes scheduler hardcodes specific versions of external tools (cert-manager, KEDA, Traefik) that require manual updates. Despite this, the project is actively maintained with frequent releases, comprehensive migration guides, and a clear deprecation policy, making it a strong example of a long-lived open-source PaaS.
OpenEBS is a CNCF sandbox project providing container-native persistent storage for Kubernetes. This repository is the project's coordination hub: it contains the umbrella Helm chart for deploying OpenEBS (LocalPV hostpath/LVM/ZFS and Mayastor replicated engines), the kubectl-openebs plugin binary for inspecting and managing volumes and nodes, and the openebs-upgrade job for Helm-based upgrades and Mayastor data-plane rolling restarts. It also houses the OpenEBS Enhancement Proposals (OEPs), CI/CD workflows, and release automation. The repo is primarily an application repository rather than a data/research repository; its many markdown design documents are engineering proposals, not analysis artifacts. The main entry points are plugin/src/main.rs, openebs-upgrade/src/bin/upgrade-job/main.rs, and charts/Chart.yaml. The upgrade path uses trait-based Helm upgraders and Kubernetes pre-upgrade hooks, while the plugin dispatches engine-specific operations through a common Operations enum. Externally, it depends on the Kubernetes API, Helm, and several engine submodules/repositories (Mayastor, localpv-lvm, localpv-zfs). Maintenance is active: the last commit is recent, Dependabot is configured, and the CI pipeline includes linting, image building, Trivy scanning, and release workflows. Technical drift is low overall, though the project's reliance on git submodules and Nix-pinned dependencies creates coordination risk across the broader OpenEBS ecosystem.
Karpenter is a Kubernetes cluster autoscaler that provisions and manages compute capacity (nodes) for pods that cannot be scheduled. It operates as a controller-runtime-based operator, using Custom Resource Definitions (CRDs) like NodePool, NodeClaim, CapacityBuffer, and NodeOverlay to declaratively manage node lifecycle. The system continuously reconciles the desired state (unschedulable pods, disruption budgets, static replicas) with the actual cluster state, creating or deleting NodeClaims via a pluggable CloudProvider interface (with implementations for AWS, Azure, GCP, and a fake/KWOK provider for testing). Key entry points include the operator startup in `pkg/operator/operator.go`, the provisioning loop in `pkg/controllers/provisioning/provisioner.go`, and the disruption controller in `pkg/controllers/disruption/controller.go`. External dependencies are minimal: it requires a Kubernetes cluster with controller-runtime, Prometheus for metrics, and optional DRA (Dynamic Resource Allocation) support via a separate driver. The codebase is production-grade, with extensive unit and integration tests, performance benchmarks, and a well-defined event/metrics system.
This is a production-grade Kubernetes operator written in Go that manages the full lifecycle of MariaDB databases (including Galera clusters, asynchronous replication, and MaxScale proxies) on Kubernetes. It implements a custom resource definition (CRD) pattern with controllers, validating webhooks, and sidecar agents to handle deployment, scaling, TLS, backups (logical and physical), point-in-time recovery, and SQL resource management (users, grants, databases). The operator is built with controller-runtime and kubebuilder, and includes extensive integration tests using Ginkgo/Gomega and envtest. Its architecture is modular, with separate controllers for each CRD, reusable builder packages for Kubernetes objects, and well-factored utility packages for data structures, PKI, condition management, and statefulset helpers. The codebase is actively maintained, with a rich set of examples, Helm charts, and multi-cluster support. It does not include any data research or analytics components.
Harbor is an open-source, cloud-native container registry platform for managing OCI/Docker images, Helm charts, and other artifacts. It provides a full-stack solution with a Go backend, Angular web portal, PostgreSQL database, and Redis/ValKey job queue. The system supports artifact storage, vulnerability scanning (Trivy integration), SBOM generation, multi-registry replication (Docker Hub, Quay, JFrog, cloud CRs), tag retention policies, immutable tags, RBAC with LDAP/OIDC, robot accounts, webhook/notification pipelines, P2P preheat, and audit logging. The architecture follows a layered pattern: REST API handlers (v2.0) → controllers → managers → DAOs, with middleware chains for security, quota, and content trust. Key entry points include the core API server, job service for background tasks, registry controller for blob/manifest management, and the Angular portal for administration. External dependencies include PostgreSQL, Redis, Trivy scanner, and various cloud registry APIs. The codebase is well-structured with extensive unit and integration tests, though it exhibits some technical debt from generated mocks and legacy components.
Tilt is a local development orchestration tool for Kubernetes and Docker Compose microservice environments. The Go binary evaluates a Starlark-based Tiltfile, watches the filesystem, builds container images, applies changes to a cluster or docker-compose stack, streams logs, and presents state through both a terminal HUD and a React web UI. The architecture is a single CLI/daemon combining a controller-runtime-style apiserver with custom v1alpha1 resource types, a Redux-like central store with actions and reducers, engine subscribers that react to state changes, and reconcilers per resource type. Key entry points are cmd/tilt/main.go, internal/cli/* for command handling, internal/engine/upper.go for the main event loop, and internal/controllers/core/* for reconciliation. External dependencies include Docker daemons/buildx, Kubernetes API servers, docker-compose, git, and optional Tilt Cloud analytics/telemetry endpoints. The codebase is exceptionally large and well-tested, though it carries visible dual-paradigm debt: older store/engine patterns coexist with newer apiserver/controller patterns, and many feature flags are marked obsolete.
Stern is a Go CLI tool that tails multiple pods and containers on Kubernetes, with color-coded output, regex-based filtering, and customizable Go templates. It relies on the Kubernetes client-go library to watch pod events and stream logs from matching containers. The architecture is a single binary with a Cobra command tree, where the core logic in the `stern/` package handles target filtering (by pod name, container name, container state, condition), log line parsing (timestamp extraction, include/exclude/highlight regex), and template rendering. The code is well-structured, thoroughly tested, and follows modern Go patterns. It supports advanced features like interactive prompts, shell completion (bash/zsh/fish), config files, and various output formats. While most components are tightly integrated for this specific use case, several sub-packages (color management, condition matching, container state matching, log filtering utilities) are cleanly isolated and could be reused in other Kubernetes or CLI projects.
VictoriaLogs is a high-performance, lightweight log management system designed for both small and large-scale deployments. It consists of multiple Go-based services for log ingestion (vlagent, vlinsert), storage (vlstorage), and querying (vlselect), complemented by a Preact/TypeScript web UI (vmui). The system uses a columnar storage approach with bloom filters, custom encoding, and a pipeline-based query engine (LogsQL) for efficient log processing. Key architectural patterns include composable data transformation pipes, extensible filter systems, mergeable statistical aggregations, and object pooling for performance optimization. The frontend features a modular component architecture with custom hooks for state management, contextual controls, and interactive visualizations.
This is an Astronomer-maintained Helm chart for deploying Apache Airflow on Kubernetes with custom extensions like git-sync relay, dag-deploy server, auth/logging sidecars, and pgbouncer. It wraps the upstream Apache Airflow chart as a subchart and adds robust security hardening (Pod Security Standards restricted), ingress support, and OpenShift compatibility. The repository includes an extensive test suite that validates rendered templates against Kubernetes API schemas across multiple versions (1.31-1.35) and runs functional tests on kind clusters. The chart is well-structured with modular Helm templates, helper functions for common patterns (private CA trust, sidecar injection, service account naming), and comprehensive CI/CD pipelines. It is actively maintained and used by Astronomer to distribute Airflow via their Helm repository.
Cassandra Medusa is a production-grade backup and restore tool for Apache Cassandra and DSE, designed to operate at cluster scale. It supports full and differential backups, with storage backends for local filesystems, S3-compatible object stores, Google Cloud Storage, Azure Blob Storage, and IBM Cloud. The tool operates in two modes: a CLI that orchestrates backups across nodes via parallel SSH (pssh), and a gRPC service for Kubernetes sidecar deployments. Backups are stored as indexed blobs (token maps, manifests, schemas) in the chosen storage, with configurable retention and purge policies. It also provides integrity verification (MD5 checksums), monitoring integration (DogStatsD), and snapshot management via nodetool, Jolokia, or the DSE Management API. The architecture is modular: storage backends inherit from an abstract async base class, snapshot creation is abstracted via a service factory, and monitoring is pluggable. Configuration is loaded from INI files, environment variables, and Kubernetes secrets. The codebase uses asyncio for concurrent uploads/downloads with configurable concurrency, tenacity for retry logic, and protocol buffers for the gRPC interface. While primarily an operational tool, its design patterns (abstract storage, factory-based snapshot services, monitoring abstractions) are cleanly separated and could serve as a reference for similar infrastructure tools. Medusa is actively maintained with frequent releases, a comprehensive test suite (unit + integration behave tests), and support for Python 3.10–3.12. The codebase demonstrates solid engineering practices: strong typing (namedtuples), separation of concerns, and minimal framework boilerplate. The integration tests cover multiple storage providers, encryption modes, and cluster topologies, providing high confidence in production readiness.
This is a Kubernetes operator that manages the lifecycle of Prometheus, Alertmanager, and related monitoring components (Thanos Ruler, Prometheus Agent) as Kubernetes native resources. It provides Custom Resource Definitions (CRDs) for declarative configuration and automates deployment, scaling, configuration generation, TLS management, and reconciliation. The operator ensures that Prometheus and Alertmanager instances are correctly configured, updated, and monitored within a Kubernetes cluster, handling tasks such as secret injection, config reloading, and pod repair. The architecture is a monolithic Go binary using the controller-runtime pattern. It includes multiple sub-components: an admission webhook for validation and mutation of CRDs, a prometheus-config-reloader sidecar for dynamic config reload, and a kubelet controller for node endpoint management. The codebase is heavily generated (client-go, apply configurations, informers) and relies on Kubernetes APIs, Prometheus/Alertmanager container images, and optional cloud SDKs (AWS, Azure) for service discovery. Key entry points are `cmd/operator/main.go` (main operator binary), `cmd/admission-webhook/main.go` (webhook server), and `cmd/prometheus-config-reloader/main.go` (config reloader). Data flows: users define CRDs → operator reconciles into StatefulSets/DaemonSets, generates Prometheus/Alertmanager config files with TLS/auth, and manages config reloads. External dependencies include a Kubernetes cluster, Prometheus/Alertmanager container images, and optional cloud services for scrape config discovery.
Bottlerocket is a free, open-source Linux-based operating system purpose-built for hosting containers. It is designed with a strong focus on security, immutability, and reliable updates. The system is configured entirely through an API-driven settings model, with all configuration stored as key-value pairs in a filesystem datastore. It supports multiple orchestrator variants (Amazon EKS, Amazon ECS, VMware, and bare metal) and cloud platforms (AWS, VMware, bare metal), with specialized variants for NVIDIA GPUs and FIPS compliance. The architecture is a minimal, Rust-heavy OS image built via a custom build system (Twoliter). The core components include a settings datastore with serialization/deserialization, a versioned migration framework for safe upgrades/downgrades, per-variant settings plugins loaded as dynamic libraries, and a TUF-based update mechanism with A/B partition flipping. The build system produces bootable images (AMIs, OVAs, raw images) and publishes them to TUF repositories. The codebase is organized as a Cargo workspace with hundreds of small crates, each handling a specific concern (migrations, defaults, plugins, models). Key entry points include the build system (cargo make), the settings datastore library (sources/api/datastore), the migration helpers (sources/api/migration/migration-helpers), and the per-variant settings defaults (sources/settings-defaults). The repository also contains tools for local VM testing, kernel config diffing, and secure boot key generation. While the codebase is well-structured and actively maintained, it suffers from significant duplication across many similar variants (e.g., Kubernetes 1.31 through 1.37) and a large number of archived migrations, which increases maintenance burden.
Anteon (formerly Ddosify) is an open-source platform for Kubernetes monitoring and performance testing. It provides a CLI-based load testing tool (Ddosify) that supports scenario-based testing with dynamic variable injection, extraction from responses, and assertions. Additionally, it includes an eBPF-based agent (Alaz, in a separate repository) for Kubernetes service map creation and real-time metrics collection without sidecars. The self-hosted deployment (in the selfhosted directory) orchestrates the platform using Docker Compose. The core engine is written in Go with a modular architecture, featuring pluggable components for requesters, reporting, and scripting.
Unregistry is a lightweight OCI-compliant container registry that stores images directly in the local containerd content store. It is designed as a simpler alternative to a full Docker registry, primarily for pushing images to remote Docker daemons over SSH without an external registry. The project includes a Go server binary (cmd/unregistry/main.go) that implements the OCI distribution specification using the Docker Distribution library as a framework, with custom middleware that backs blob, manifest, and tag operations with containerd's content and image stores. A companion Bash script, docker-pussh, acts as a Docker CLI plugin to orchestrate pushing images: it establishes an SSH tunnel to a remote host, starts an ephemeral unregistry container, forwards ports, performs a standard docker push, then cleans up. The codebase is well-structured with clean abstractions, comprehensive error handling, and extensive test coverage including conformance tests against the OCI distribution spec and end-to-end tests using Docker-in-Docker containers. The storage layer in internal/storage/containerd demonstrates a solid pattern for integrating containerd with the distribution registry, handling leases, garbage collection labels, and resumable uploads. The project is actively maintained with recent commits and a responsive issue tracker.
werf is a production-grade CLI tool for full-cycle CI/CD of containerized applications to Kubernetes. It provides a unified pipeline for building container images (via Docker or Buildah backends), managing Git-based reproducible configurations (giterminism), deploying Helm charts with advanced tracking and lifecycle management, and performing cleanup of container registry and host resources. The architecture is monolithic but modular, with clear interface abstractions for container backends, registry clients, stage storage, and parallel execution. The codebase demonstrates high craftsmanship in areas like composable path matching, deterministic slug generation, and distributed locking, though it carries some duplication between legacy and modern deploy engines and a few forked dependencies. The repository is actively maintained with frequent releases and extensive test coverage across unit, integration, and e2e suites.
This is a Kubernetes-native security operator that automates vulnerability scanning, configuration auditing, secret scanning, RBAC assessment, infrastructure assessment, and compliance reporting for container workloads. It uses Aqua Security's Trivy as the scanning engine and stores results as custom resource definitions (VulnerabilityReport, ConfigAuditReport, ExposedSecretReport, RbacAssessmentReport, InfraAssessmentReport, SbomReport, ClusterComplianceReport). The operator runs as a controller-manager pod, watches Kubernetes resources, and creates scan jobs in-cluster. It supports multiple scan modes (standalone, client/server, filesystem, rootfs) and integrates with Prometheus for metrics, webhooks for alerting, and OPA/Rego for configurable policy evaluation. The codebase is well-structured with a plugin architecture for scanning, builder patterns for report generation, and extensive test coverage including unit, envtest, integration, and e2e tests.
Kubenix is a Nix-based framework for declarative Kubernetes management. It uses the NixOS module system to define Kubernetes resources, Helm charts, Docker images, and custom resources in a type-safe, composable manner. The project provides a CLI tool for applying manifests with diffing, pruning, and secret injection via vals. At its core, kubenix is a set of Nix library functions and modules that evaluate user configuration to produce Kubernetes YAML/JSON. It supports submodules (nested composable configurations), testing frameworks (including kubetest), and code generation from Kubernetes OpenAPI specs. The architecture is purely functional, leveraging Nix's lazy evaluation to merge and validate resources at build time. This is a hybrid project combining a library (Nix modules and functions) with an application (CLI tool), but it is classified as an application because its primary deliverable is a deployable package and CLI.
This repository contains Helm charts and tooling for deploying the Astronomer Platform (a Kubernetes-hosted enterprise data platform for Apache Airflow) into Kubernetes clusters. It provides a modular architecture with subcharts for core components (Houston API, Commander, Navigator, Pilot, Registry) and infrastructure (NGINX, Prometheus, Grafana, Alertmanager, Elasticsearch, Vector, PostgreSQL, NATS). The repository supports multiple deployment topologies (control plane, data plane, unified) and includes enterprise features like high availability, network policies, RBAC, and external secret management. Extensive testing validates chart rendering and functional behavior across Kubernetes versions, with automation scripts for local development, version migration, and cluster setup.