This repository contains the official Helm charts for deploying SonarQube on Kubernetes, maintained by SonarSource. It provides two charts: `sonarqube` for standard (Community/Developer/Enterprise) deployments and `sonarqube-dce` for Data Center Edition with clustered search and application nodes. The charts are production-grade, supporting a wide range of Kubernetes features including StatefulSets, Deployments, Ingress, NetworkPolicies, PodDisruptionBudgets, Prometheus monitoring, Istio service mesh with strict mTLS, OpenShift integration, and autoscaling via HPA and KEDA. A distinguishing feature is the agentic AI subsystem: the charts deploy an orchestrator, hunter, and remediation agent runtimes, a Squid-based egress proxy for sandboxed runtime isolation, gVisor/Kata sandboxing, and an HKDF-based key derivation hook for secure inter-component communication. The repository also includes integrations for Azure and Google Cloud marketplaces, comprehensive CI/CD pipelines (build, sign, publish, compatibility tests), and migration scripts for PostgreSQL and ingress-nginx to Gateway API/Istio. The codebase demonstrates high craftsmanship in Helm template design, with extensive validation, test fixtures, and golden-file tests covering hundreds of configuration permutations.
CloudNativePG is a Kubernetes operator for managing PostgreSQL databases in production. It automates deployment, failover, scaling, backups, upgrades, and connection pooling (PgBouncer) through custom Kubernetes resources (CRDs) and reconciliation loops. The operator consists of two binaries: a manager that runs inside pods to manage PostgreSQL instances, and a kubectl plugin for administrative commands. The architecture is modular with separate reconcilers for clusters, instances, backups, roles, tablespaces, and replication slots. It includes a plugin system (CNPG-I) for extensibility via gRPC, a web server for health probes and metrics, and a Prometheus exporter for monitoring. The codebase is written in a non-standard Go dialect (using URL-like import paths, func keyword, and var type declarations), which may indicate a custom transpiler or DSL. Despite this, the project is production-grade with extensive unit and end-to-end tests, active maintenance, and support for multiple Kubernetes distributions (kind, k3d, OpenShift).
Checkov is a static analysis tool for Infrastructure as Code (IaC) security and compliance. It scans Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, ARM, Bicep, and many other IaC frameworks against thousands of built-in policies covering AWS, Azure, GCP, and other cloud providers. The tool operates as a CLI application and can also be used as a Python library or integrated into CI/CD pipelines. Its architecture is modular, with separate runners per framework, a graph-based analysis engine for cross-resource checks, and a pluggable check registry system. Checkov also includes software composition analysis (SCA) for container images and packages, secrets detection, and integration with the Bridgecrew/Prisma Cloud platform for policy management and reporting.
This repository is a comprehensive collection of over 1200 standalone Bash scripts for DevOps automation, cloud infrastructure management, CI/CD pipeline orchestration, and system administration. It is not a single application but a modular toolbox designed to be used interactively or integrated into CI workflows. The architecture is decentralized: each script is self-contained, sourcing shared libraries from the `lib/` directory for common functions like error handling, API authentication, and OS detection. Key entry points include the top-level `Makefile` for bootstrapping, `lib/utils.sh` as the core utility library, and numerous API wrapper scripts (e.g., `github_api.sh`, `aws_foreach_profile.sh`) that provide consistent patterns for interacting with external services. The primary data flows involve querying cloud provider APIs (AWS, GCP, Cloudflare), managing CI/CD platforms (Jenkins, BuildKite, GitHub Actions), manipulating Git repositories, and performing system tasks like disk benchmarking or SSL certificate verification. External dependencies are extensive but well-managed: the scripts assume the presence of `curl`, `jq`, and platform-specific CLIs (`aws`, `gcloud`, `kubectl`, `gh`), with many install scripts provided to bootstrap these tools. The codebase demonstrates high craftsmanship with consistent error handling (`set -euo pipefail`), input validation, and cross-platform compatibility guards. While some scripts are tailored to the author's personal environment, the core patterns and libraries are designed for reuse across projects.
ArcadeDB is a high-performance, multi-model database system supporting graph, document, key-value, time-series, vector, and full-text data models. It exposes multiple query languages (SQL, Cypher, Gremlin, GraphQL) and wire protocols (HTTP, Bolt, PostgreSQL, MongoDB, gRPC). The architecture is modular: a core engine (storage, indexing, query execution) with pluggable server plugins for protocols, replication (Raft-based HA), and observability. It features advanced indexing (LSM-tree, hash, vector quantization, sparse vectors, full-text BM25), time-series with PromQL and downsampling, and graph analytical views with CSR compression. Python bindings allow embedded use. The codebase demonstrates strong engineering with extensive use of interfaces, design patterns, comprehensive test coverage (including issue-specific regression tests), and automated CI/CD with performance benchmarks. It is actively maintained with low technical debt and a clean architecture.
Metacontroller is a Kubernetes add-on that enables writing custom controllers as webhook scripts in any language, without needing to write a full Go controller. It provides two primary controller patterns: CompositeController (manages child resources from a parent) and DecoratorController (attaches additional resources to existing objects matched by selectors). The system is deployed as a cluster add-on via Helm or kustomize manifests, and it runs as a controller-manager binary that watches CompositeController and DecoratorController CRDs, then calls user-defined webhooks (sync, finalize, customize) to determine desired state. The architecture is built on dynamic Kubernetes clients, shared informers with custom indexing, and a webhook executor that supports TLS mutual auth, bearer/basic auth, ETag caching, and per-endpoint configuration. Key entry points include the main binary at pkg/cmd/metacontroller/main.go, the server bootstrap at pkg/server/server.go, and the controller reconciliation loops in pkg/controller/composite and pkg/controller/decorator. External dependencies are the Kubernetes API server, etcd (for integration tests), and user-provided webhook servers. The codebase is well-structured with extensive unit and integration tests, a Helm chart, CI/CD pipelines, and active maintenance with frequent releases.
kr8s is a Python client library for the Kubernetes API that provides both synchronous and asynchronous interfaces, designed to be familiar to users of kubectl. The core implementation is async-first, with sync wrappers generated via an anyio-based bridging layer, ensuring a single source of truth for all logic. The library includes built-in classes for common Kubernetes resources (Pod, Service, Deployment, Node, Job, etc.), dynamic class creation for custom resources, and support for exec, port forwarding, watching, and client caching. Authentication is handled through kubeconfig files, service accounts, exec plugins, OIDC, and direct tokens, all abstracted behind a unified KubeAuth class. The architecture is modular: the main entry points are `kr8s` (sync) and `kr8s.asyncio` (async), with the heavy lifting in `kr8s/_api.py`, `kr8s/_objects.py`, and several utility modules. The library is extensively tested with pytest and Kind clusters, and includes a full featured CLI example (`kubectl-ng`) that reimplements kubectl commands using kr8s, rich, and typer. Documentation is comprehensive, covering installation, authentication, object operations, and guides for building operators. Quality is solid: clean separation of concerns, thoughtful caching (vendored asyncache), robust error handling, and a well-documented API. The primary weakness is the monolithic `_objects.py` (1000+ lines) and the manual sync/async wrapping, which can introduce maintenance overhead. Overall, kr8s is a professionally maintained, production-ready Kubernetes client that stands out for its simplicity and extensibility.
This repository implements OpenTelemetry eBPF Instrumentation (OBI), a production-grade observability agent that uses eBPF to automatically capture distributed traces, metrics, and logs from user-space applications without any code changes. It supports a wide range of protocols (HTTP/1.1, HTTP/2, gRPC, SQL, Redis, Kafka, MongoDB, AMQP, MQTT, DNS, and more) and multiple language runtimes (Go, Java, Python, Node.js, Ruby, .NET, Rust). The agent can run as a standalone binary, a Docker container, or an OpenTelemetry Collector receiver. Its architecture consists of eBPF programs (kprobes, uprobes, tracepoints, TC) that emit events to ring buffers, which are read by Go userspace tracers and processed through a pipeline of discovery, decoration, filtering, and export stages. Telemetry is exported via OTLP (gRPC/HTTP) or Prometheus, with optional Kubernetes metadata enrichment and network flow monitoring. The codebase is well-structured with clear separation of concerns, extensive integration tests, and several reusable generic components (message queues, pipeline runners, expiry caches, attribute filters). It is actively maintained with frequent commits and comprehensive CI/CD.
Direktiv is a workflow automation and serverless orchestration platform that enables users to define, execute, and manage workflows and services through a web UI or API. The system features a Go-based backend with React/TypeScript frontend, providing namespace-based multi-tenancy, event-driven triggers via CloudEvents and NATS, a plugin-extensible API gateway, and Kubernetes-native service deployment. Key capabilities include workflow execution (YAML/TypeScript), service management, secret/variable storage, file handling, Git-based namespace mirroring, and comprehensive monitoring with OpenTelemetry integration. The architecture follows a microservices-inspired monolith pattern with clear separation between API handling, data storage, execution engine, and gateway plugin systems.
This repository is the official Helm chart collection for deploying Kong API Gateway and related operators (Kong Ingress Controller, Kong Gateway Operator, Kong Operator, Kong AI Gateway) on Kubernetes. It provides production-grade deployment templates with support for DB-less, PostgreSQL, hybrid mode, enterprise features, cert-manager integration, Prometheus monitoring, and admission webhooks. The architecture is a multi-chart Helm repository with subcharts for CRDs (kic-crds, gwapi-crds, ko-crds) and extensive CI snapshot testing via helm-chartsnap. Key entry points include the main `charts/kong/` chart for the gateway and ingress controller, `charts/kong-operator/` for the Kong Operator managing Konnect and AI gateway resources, and `charts/gateway-operator/` for the Gateway API operator. External dependencies include Kong container images, cert-manager, Bitnami PostgreSQL (optional), and Konnect SaaS for enterprise deployments. The repository is actively maintained with regular releases, changelogs, and upgrade guides, though CRDs are auto-generated and may drift from upstream operator versions.
Pipelines-as-Code is a Kubernetes-native CI/CD controller that triggers Tekton PipelineRuns in response to Git webhook events from multiple providers (GitHub, GitLab, Gitea/Forgejo, Bitbucket Cloud/Data Center). In production, it listens for webhook payloads on a configurable endpoint, detects and validates the provider, matches events to PipelineRun templates stored in the repository's `.tekton/` directory using CEL expressions and annotations, resolves remote tasks and pipelines via hub or URL, creates PipelineRun resources with appropriate parameters and secrets, and reports status back to the Git provider (commit statuses, check runs, comments). It supports ChatOps commands (`/test`, `/retest`, `/cancel`), GitOps-style push commands, concurrency limits, automatic cleanup of old PipelineRuns, and optional LLM-driven failure analysis. The architecture consists of three main controllers (controller, watcher, webhook) plus a CLI tool (`tkn-pac`) for bootstrapping, repository management, and local testing. The codebase is well-structured, with clean provider abstractions, a modular queue system, extensive OpenTelemetry instrumentation, and comprehensive test coverage across all providers. While the multi-provider support introduces some duplication, the core patterns (event matching, pipeline resolution, status reporting) are cleanly separated and reusable.
This repository is a comprehensive Chinese-language Docker tutorial and technical book ('Docker ไปๅ ฅ้จๅฐๅฎ่ทต') rather than a traditional software service. The dominant content is structured Markdown chapters covering Docker introduction, installation, images, containers, registries, Dockerfile best practices, Compose, Kubernetes, cloud integrations, security, observability, and practical case studies. It also contains validated example code such as Dockerfiles, Compose files, and Kubernetes manifests, plus a custom toolchain for building static HTML and PDF output. The repository operates as a documentation publishing pipeline. Markdown sources are consumed by npm scripts and Python tools: prepare_pdf_sources.py inlines images as data URIs for PDF generation; build_html_reader.py creates a single-file offline HTML reader with Mermaid and dark-mode support; verify_artifacts.py checks generated artifacts and produces SHA256 manifests. CI workflows on GitHub Pages build and deploy the site, run link checks, validate examples with native tools such as kubeconform and actionlint, and enforce CJK typography rules. Architecturally, this is a collection of small, mostly standalone Python and Node scripts plus CI workflow orchestration; there is no long-running backend or service. Key entry points are package.json scripts and the tools/ and tests/ directories. The data flow is document transformation: Markdown to HTML and PDF, with example validation performed during CI. External dependencies include mdPress, mermaid-cli, pandoc, and container runtime tooling for validating the examples. Maintenance is active and changelog-driven, with frequent updates tracking Docker and Kubernetes versions. Some mirror lists and example image tags inevitably become stale as the ecosystem moves, but the CI and test layers keep the content and build pipeline in good shape. The most reusable value lies in the documentation tooling and validation patterns, not in the tutorial prose itself.
MicroK8s is a lightweight, single-package Kubernetes distribution distributed as a snap. It bundles upstream Kubernetes components (kube-apiserver, kubelet, etcd, containerd, runc, flannel, Calico CNI, dqlite, Helm) into a single snap package with a unified 'kubelite' binary that runs all control plane services as threads. The system provides a CLI (microk8s) with subcommands for cluster management (enable/disable addons, join/leave cluster, status, reset, upgrade), and an addon system that allows installing additional services (e.g., dashboard, ingress, registry) via git-cloned repositories with executable enable/disable hooks. The architecture is a monolith packaged as a snap, with services managed by snap daemons and configuration stored in snap data directories. Key entry points include the snap hooks (configure, install, remove), wrapper scripts in scripts/wrappers/ (enable.py, disable.py, join.py, status.py, etc.), and the kubelite binary. External dependencies include the snap runtime, upstream Kubernetes binaries, containerd, runc, etcd, dqlite, flanneld, and various CNI plugins. The build system uses pinned component versions with patch management for each Kubernetes release, and upgrade scripts handle migrations between versions with rollback support.
Diun is a Docker image update notifier written in Go that monitors container images across various platforms (Docker, Kubernetes, containerd, Nomad, Swarm, and file-based configurations) for updates. It periodically checks image manifests against a stored state (using BoltDB) and sends notifications via multiple channels (Slack, Telegram, email, etc.) when updates are detected. The application features a modular architecture with pluggable providers and notifiers, a gRPC interface for external interaction, Prometheus metrics, and structured logging. The system is designed for self-hosted environments to automate the detection of base image updates, application releases, and security rebuilds. Key components include a CLI for management, a scheduler for periodic checks, a template system for customizable notifications, and secret handling utilities. Diun's strength lies in its extensibility and wide platform support, making it a versatile tool for DevOps workflows.
M3 is a distributed time-series database and metrics platform originally developed by Uber and now under the Linux Foundation. It provides a full-stack solution for collecting, aggregating, storing, and querying high-volume metric data at scale. The system comprises multiple services: m3dbnode (storage node with custom encoding and persistence), m3coordinator (routing and downsampling gateway), m3aggregator (clustered metrics aggregation with quantile estimation), and m3query (PromQL/Graphite query engine). These services communicate via Thrift, gRPC, and HTTP, and are coordinated through an etcd-based cluster management layer that handles placement, leader election, and configuration distribution. The architecture is highly performance-oriented, featuring extensive object pooling, zero-copy I/O, custom bit-level encoding (m3tsz), and an inverted index (m3ninx) backed by FST segments and Roaring Bitmaps for fast metadata search. The codebase is written in a custom Go-like transpiled language and includes generated code for mocks, protobuf, and Thrift bindings. It integrates deeply with Prometheus (remote write, scrape, and query) and Graphite protocols, and provides a React-based admin UI (m3ctl) for namespace and rule management. The repository also contains a comprehensive suite of unit, integration, and property-based tests, along with Docker-based development and CI environments.
Seldon Core v2 is a production-grade, Kubernetes-native MLOps platform for deploying, scaling, and managing machine learning inference at scale. The system is architected as a set of microservices: a Kubernetes operator manages CRDs (Model, Pipeline, Server, Experiment), a centralized scheduler coordinates model placement and scaling across server replicas, an agent sidecar runs on each inference server to handle model loading/unloading, caching, and reverse proxying, and a Kafka Streams-based dataflow engine executes multi-step inference pipelines with joins, batching, and triggers. Inference requests enter via an Envoy proxy that routes to model servers or pipeline gateways, with Kafka as the underlying data plane for pipeline flows. The platform supports the V2 inference protocol, A/B experiments, explainability, drift detection, and OpenAI API translation. It integrates with MLServer, Triton Inference Server, and custom runtimes, and provides a CLI for lifecycle management.
Tracee is a runtime security and observability tool that uses eBPF to trace system events and detect threats. It consists of multiple Go binaries: a main security agent (`tracee`) that loads eBPF programs, collects kernel events, and runs detection rules; a gRPC client (`traceectl`) for remote management; an event generator (`evt`) for stress testing; and a Kubernetes operator. The architecture is modular with a clear separation between eBPF event collection, event derivation and enrichment pipelines, data stores (process tree, container info, DNS cache, kernel symbols), a detection engine supporting both Go signatures and YAML-based rules using CEL expressions, and filtering/policy subsystems. The system operates as a daemon with HTTP/gRPC endpoints for metrics, health, and streaming event output, and integrates deeply with Kubernetes via CRDs and controllers. The codebase demonstrates strong engineering with clean abstractions (filter interfaces, data store registries, event derivation framework), reusable utility packages (bucketcache, changelog, string interning, fuzzy parsing), and comprehensive testing including unit, integration, and e2e tests. However, it exhibits technical drift in areas like multiple Go modules with `replace` directives, hardcoded kernel version checks in eBPF probe logic, legacy signature conversion code planned for removal, and some global mutable state. The eBPF C code is complex and kernel-version-sensitive, requiring ongoing maintenance. Overall, it is a well-crafted, production-grade security tool suitable for container and Kubernetes environments.
OpenYurt is a Kubernetes-native edge computing platform implemented as multiple Go binaries. The codebase contains a set of operators, node agents, proxies, and CLIs rather than a single monolith. YurtHub is an edge-side reverse proxy that intercepts kubelet and other node traffic, applies pluggable filters, caches API responses on disk, multiplexes list/watch requests, and can serve from local cache when the cloud API server is unreachable (node autonomy). Yurt-Manager is a controller-runtime manager with about twenty controllers and webhooks for NodePool, YurtAppSet, YurtStaticSet, service topology, Raven gateway networking, hub leader election, load balancer sets, CSR approval, and EdgeX PlatformAdmin. YurtTunnel provides a secure tunnel for kubectl exec/logs and other traffic between cloud and edge nodes. Yurtadm is a CLI for bootstrapping, joining, and resetting nodes, and yurt-iot-dock bridges OpenYurt IoT CRDs to EdgeX Foundry.
YAS (Yet Another Shop) is a production-grade, open-source e-commerce platform implemented as a microservices architecture using Java Spring Boot for the backend and Next.js for the frontend (both storefront and admin backoffice). The system is decomposed into ~15 independent microservices (product, cart, order, customer, inventory, payment, promotion, rating, tax, location, media, search, webhook, recommendation, and sample data) that communicate via REST with resilience4j circuit breakers/retries and event-driven patterns using Kafka and Debezium CDC for cross-service data synchronization (e.g., product changes propagate to Elasticsearch for search and PgVector for recommendation). Authentication and authorization are handled via Keycloak with OAuth2/JWT. The architecture includes BFF (Backend For Frontend) gateways using Spring Cloud Gateway and two Next.js frontends. Infrastructure is fully containerized with Docker Compose and Kubernetes Helm charts, with observability via OpenTelemetry, Grafana, Loki, and Tempo. The codebase includes comprehensive unit/integration tests, UI automation tests (Selenium/Cucumber), and CI/CD pipelines per service. While the repository is primarily an application, it incorporates data engineering patterns (CDC, vector embeddings) for the recommendation and search features, giving it a slight hybrid data character. Overall, the code demonstrates solid engineering practices, a well-defined microservice boundary, and several reusable components, though some duplication across services and boilerplate configs exist.
Fluid is a Kubernetes-native operator for orchestrating distributed data caching and acceleration. It manages multiple cache runtimes (Alluxio, Jindo, JuiceFS, EFC, Thin, Vineyard, CacheRuntime) as custom resources, providing dataset abstraction, automated data operations (DataLoad, DataBackup, DataMigrate, DataProcess), and transparent FUSE mount injection via a CSI driver and mutating webhook. The system comprises several controller binaries, a CSI plugin, and a webhook server, all deployed via Helm charts. The architecture uses a common base engine interface with per-runtime implementations, a template engine for lifecycle management, and extensive utility packages for Kubernetes client operations, port allocation, security filtering, and monitoring.