Falco is a cloud-native runtime security daemon that monitors Linux system calls, Kubernetes audit logs, and plugin-supplied events in real time. It applies a flexible rule engine to detect anomalous behavior and generates alerts via multiple output channels (stdout, file, syslog, HTTP, program). The codebase is a monolithic C++ application with a modular internal architecture: a sequenced action pipeline (app/app.cpp) drives startup, configuration, plugin loading, rule compilation, event processing, and output dispatch. The rule engine (userspace/engine/) parses YAML rule definitions, resolves macros and filters, indexes rules by event type, and matches events efficiently. The output subsystem uses a thread-safe worker queue with a watchdog. Falco supports hot-reload via inotify file watching and a Unix socket control endpoint. It is deployed as a Helm chart on Kubernetes (DaemonSet/Deployment) and is packaged as DEB, RPM, and Docker images. The repository includes extensive unit tests (Google Test), end-to-end event generator tests, and CI/CD pipelines for building, testing, and publishing. External dependencies include falcosecurity/libs (sinsp), falcoctl, OpenSSL, cURL, yaml-cpp, and jemalloc. The architecture demonstrates strong engineering practices with clean abstractions (indexed_vector, atomic_signal_handler, yaml_helper) and composable action steps.
This repository provides Docker images and Kubernetes Helm charts for deploying Selenium Grid, the industry-standard browser automation framework. It covers all major browser backends (Chrome, Firefox, Edge, Chromium) and supports multiple deployment modes: standalone single-container, hub-and-node, fully distributed grid, and dynamic grid with Docker-in-Docker or Kubernetes backends. The architecture follows a microservice pattern where each Grid component (Router, Distributor, Session Queue, Nodes, etc.) runs in its own container, orchestrated by supervisord. Beyond core Grid images, the repo includes a comprehensive monitoring stack with a Go-based Prometheus exporter that scrapes the Grid GraphQL endpoint, pre-built Grafana dashboards, and a KEDA external scaler for Kubernetes native autoscaling. Video recording and upload services are provided as sidecar containers, with both event-driven (ZeroMQ) and polling-based implementations. The CI/CD pipeline is extensive, with GitHub Actions workflows for building multi-architecture images (amd64/arm64), running integration tests, scanning for vulnerabilities, and publishing to Docker Hub and GHCR. The codebase is well-tested with unit tests for Go components, Python integration tests for autoscaling, and Java/Playwright browser tests. Despite its complexity, the repository demonstrates solid engineering practices with clear separation of concerns, reusable shell libraries, and automated dependency management via Renovate and Dependabot.
OpenEBS is a CNCF sandbox project providing container-native persistent storage for Kubernetes. This repository is the project's coordination hub: it contains the umbrella Helm chart for deploying OpenEBS (LocalPV hostpath/LVM/ZFS and Mayastor replicated engines), the kubectl-openebs plugin binary for inspecting and managing volumes and nodes, and the openebs-upgrade job for Helm-based upgrades and Mayastor data-plane rolling restarts. It also houses the OpenEBS Enhancement Proposals (OEPs), CI/CD workflows, and release automation. The repo is primarily an application repository rather than a data/research repository; its many markdown design documents are engineering proposals, not analysis artifacts. The main entry points are plugin/src/main.rs, openebs-upgrade/src/bin/upgrade-job/main.rs, and charts/Chart.yaml. The upgrade path uses trait-based Helm upgraders and Kubernetes pre-upgrade hooks, while the plugin dispatches engine-specific operations through a common Operations enum. Externally, it depends on the Kubernetes API, Helm, and several engine submodules/repositories (Mayastor, localpv-lvm, localpv-zfs). Maintenance is active: the last commit is recent, Dependabot is configured, and the CI pipeline includes linting, image building, Trivy scanning, and release workflows. Technical drift is low overall, though the project's reliance on git submodules and Nix-pinned dependencies creates coordination risk across the broader OpenEBS ecosystem.
This is an Astronomer-maintained Helm chart for deploying Apache Airflow on Kubernetes with custom extensions like git-sync relay, dag-deploy server, auth/logging sidecars, and pgbouncer. It wraps the upstream Apache Airflow chart as a subchart and adds robust security hardening (Pod Security Standards restricted), ingress support, and OpenShift compatibility. The repository includes an extensive test suite that validates rendered templates against Kubernetes API schemas across multiple versions (1.31-1.35) and runs functional tests on kind clusters. The chart is well-structured with modular Helm templates, helper functions for common patterns (private CA trust, sidecar injection, service account naming), and comprehensive CI/CD pipelines. It is actively maintained and used by Astronomer to distribute Airflow via their Helm repository.
This repository contains Helm charts and tooling for deploying the Astronomer Platform (a Kubernetes-hosted enterprise data platform for Apache Airflow) into Kubernetes clusters. It provides a modular architecture with subcharts for core components (Houston API, Commander, Navigator, Pilot, Registry) and infrastructure (NGINX, Prometheus, Grafana, Alertmanager, Elasticsearch, Vector, PostgreSQL, NATS). The repository supports multiple deployment topologies (control plane, data plane, unified) and includes enterprise features like high availability, network policies, RBAC, and external secret management. Extensive testing validates chart rendering and functional behavior across Kubernetes versions, with automation scripts for local development, version migration, and cluster setup.
This is a Kubernetes controller that manages Helm chart deployments via Custom Resource Definitions (HelmChart and HelmChartConfig). It watches these CRDs and creates Kubernetes Jobs to run Helm install, upgrade, or delete operations, with a two-phase apply pattern that suspends jobs before updating them to avoid race conditions. The controller is built on the rancher/wrangler framework and handles complex features like failure policies, server-side apply, driver selection (secret vs configmap), values from secrets, HelmChartConfig merging, and bootstrapping. It is the core Helm management component of k3s and is designed to be deployed as a Deployment with a ServiceAccount and ClusterRole.
Kubenurse is a Kubernetes DaemonSet that monitors network connectivity within a cluster by performing periodic checks on API server access (direct and DNS), service/ingress reachability, and inter-node communication. It exports detailed Prometheus metrics including request duration histograms, error counters, and a neighbourhood incoming checks gauge. The architecture uses a controller-runtime client for Kubernetes API discovery, implements an efficient O(N) neighbourhood filtering algorithm based on SHA256 hashing to avoid quadratic scaling, and leverages Go's httptrace package for granular connection metrics. The application features graceful shutdown, TLS support, readiness probes that respect node schedulability, and extensive configuration via environment variables or Helm values.
This repository contains the official Helm charts for deploying SonarQube on Kubernetes, maintained by SonarSource. It provides two charts: `sonarqube` for standard (Community/Developer/Enterprise) deployments and `sonarqube-dce` for Data Center Edition with clustered search and application nodes. The charts are production-grade, supporting a wide range of Kubernetes features including StatefulSets, Deployments, Ingress, NetworkPolicies, PodDisruptionBudgets, Prometheus monitoring, Istio service mesh with strict mTLS, OpenShift integration, and autoscaling via HPA and KEDA. A distinguishing feature is the agentic AI subsystem: the charts deploy an orchestrator, hunter, and remediation agent runtimes, a Squid-based egress proxy for sandboxed runtime isolation, gVisor/Kata sandboxing, and an HKDF-based key derivation hook for secure inter-component communication. The repository also includes integrations for Azure and Google Cloud marketplaces, comprehensive CI/CD pipelines (build, sign, publish, compatibility tests), and migration scripts for PostgreSQL and ingress-nginx to Gateway API/Istio. The codebase demonstrates high craftsmanship in Helm template design, with extensive validation, test fixtures, and golden-file tests covering hundreds of configuration permutations.
Metacontroller is a Kubernetes add-on that enables writing custom controllers as webhook scripts in any language, without needing to write a full Go controller. It provides two primary controller patterns: CompositeController (manages child resources from a parent) and DecoratorController (attaches additional resources to existing objects matched by selectors). The system is deployed as a cluster add-on via Helm or kustomize manifests, and it runs as a controller-manager binary that watches CompositeController and DecoratorController CRDs, then calls user-defined webhooks (sync, finalize, customize) to determine desired state. The architecture is built on dynamic Kubernetes clients, shared informers with custom indexing, and a webhook executor that supports TLS mutual auth, bearer/basic auth, ETag caching, and per-endpoint configuration. Key entry points include the main binary at pkg/cmd/metacontroller/main.go, the server bootstrap at pkg/server/server.go, and the controller reconciliation loops in pkg/controller/composite and pkg/controller/decorator. External dependencies are the Kubernetes API server, etcd (for integration tests), and user-provided webhook servers. The codebase is well-structured with extensive unit and integration tests, a Helm chart, CI/CD pipelines, and active maintenance with frequent releases.
This repository provides a Helm chart for deploying Uptime-Kuma, a self-hosted uptime monitoring tool, on Kubernetes. The chart is well-structured with support for Deployment or StatefulSet, persistent storage, ingress, external database (MariaDB/MySQL), Prometheus ServiceMonitor, and network policies. It includes comprehensive helm-unittest tests, CI/CD pipelines for linting, testing, and releasing, and automated dependency updates via Renovate. The chart is actively maintained and follows Helm best practices.
This repository provides the official Helm charts for deploying Mattermost, an open-source messaging platform, and its associated services (Focalboard, RTCD, Push Proxy, Calls Offloader) onto Kubernetes. The primary deployment method is the `mattermost-operator` chart, which uses Kubernetes Custom Resource Definitions (CRDs) to declaratively manage the full lifecycle of Mattermost installations, including databases, file stores, ingresses, and scaling. Legacy charts (`mattermost-enterprise-edition`, `mattermost-team-edition`) are included but deprecated in favor of the operator. The architecture is a collection of Helm charts, with the operator chart acting as the core. It relies on external dependencies like PostgreSQL, S3-compatible storage, and optionally Elasticsearch and Grafana. The repository demonstrates strong DevOps practices, including automated CI/CD for chart releases, end-to-end testing with kind, and embedded monitoring configuration. Key reusable patterns include a Helm-embedded Grafana dashboard template for application KPIs, an ExternalSecrets integration for secure credential management, a deprecation handling template for managing breaking changes, and advanced Kubernetes storage patterns (EFS, NFS). The codebase is actively maintained but carries some technical drift from legacy components and outdated Kubernetes API versions.
This repository provides a Helm chart for deploying the full Jitsi Meet stack on Kubernetes. Jitsi Meet is an open-source video conferencing platform. The chart includes components for the web UI, XMPP server (Prosody), focus manager (Jicofo), video bridge (JVB), TURN/STUN server (coturn), SIP gateway (Jigasi), recording/streaming (Jibri), transcription services (Skynet, Opus Transcriber Proxy), and collaborative editing (Etherpad, Excalidraw). The chart is structured with separate template directories for each component, common helper templates for naming and labels, extensive configuration in values.yaml, and optional monitoring via Prometheus/Grafana dashboards. It supports advanced features like autoscaling (HorizontalPodAutoscaler for JVB), ingress, Kubernetes Gateway API, custom file injection, and security hardening with read-only root filesystems and dropped capabilities. The repository also includes a GitHub Actions workflow for publishing the chart as an OCI artifact to GitHub Container Registry with cosign signing, plus detailed documentation guides for exposing services, recording, transcription, scaling, and upgrading. The chart is actively maintained with frequent releases (latest v3.9.0) and follows standard Helm repository conventions.
Dapr Dashboard is a web-based UI for Dapr (Distributed Application Runtime) that provides visibility into Dapr applications, components, and configurations. The application consists of a Go backend serving REST APIs and WebSocket connections, and an Angular frontend. It supports three deployment platforms: Kubernetes, Standalone (self-hosted), and Docker Compose. The backend uses platform-specific adapters to interact with each environment, querying Kubernetes APIs, local filesystems, or Docker Compose configurations as needed. The frontend displays instance information, component details, configuration data, control plane status (Kubernetes-only), and real-time log streaming via WebSocket. Despite recent commits, the project is explicitly marked as archived in the README, with users directed to Diagrid Dashboard as an alternative.