Helm is the CNCF-graduated package manager for Kubernetes, shipping as a single Go CLI binary (cmd/helm/helm.go) built on the Cobra command framework. In production it packages applications as "charts" — versioned bundles of templated Kubernetes manifests — and manages their full lifecycle: install, upgrade, rollback, uninstall, and release testing. Release state is persisted in pluggable storage drivers: Kubernetes Secrets, ConfigMaps, in-memory, or SQL (PostgreSQL). It also handles chart repository management, dependency resolution with lock files, OCI registry push/pull, plugin installation (subprocess and WASM/Extism runtimes), and PGP-style provenance signing/verification of chart tarballs. The architecture is a layered Go monolith: pkg/cmd defines ~40 Cobra subcommands that delegate to pkg/action business-logic objects (Install, Upgrade, Rollback, List, Status, etc.); pkg/engine renders Go templates against coalesced chart values; pkg/kube wraps k8s.io/client-go for resource apply/delete with readiness waiting and retrying round-trippers; pkg/registry implements an OCI client via ORAS; internal/plugin provides an extensible plugin system with subprocess and Extism (WASM) runtimes; pkg/provenance handles cryptographic chart signing. Chart APIs are versioned — a public v2 API (pkg/chart/v2) coexists with a gated v3 API (internal/chart/v3), and release records have v1/v2 variants behind accessor interfaces — a deliberate compatibility strategy that introduces some code duplication. The primary data flow is: chart archive (tgz from a repository, local path, or OCI artifact) → chart loader with path-traversal and decompression-size guards → value coalescing (user overrides merged over chart defaults with subchart scoping) → Go template engine with Sprig-style functions → validated YAML manifests → Kubernetes API via client-go; the resulting release record is gzip+base64 encoded into the storage backend. External dependencies are the Kubernetes API server, HTTP/HTTPS chart repositories, OCI registries, and GnuPG-compatible keyrings. The main structural debt is the intentional v2/v3 migration duplication (internal/storage/driver and internal/chart/v3 mirror their public pkg/ counterparts) plus legacy compatibility paths such as requirements.yaml and deprecated boolean --dry-run flags. This is purely an application repository with no data-research character.
Harbor is an open-source, cloud-native container registry platform for managing OCI/Docker images, Helm charts, and other artifacts. It provides a full-stack solution with a Go backend, Angular web portal, PostgreSQL database, and Redis/ValKey job queue. The system supports artifact storage, vulnerability scanning (Trivy integration), SBOM generation, multi-registry replication (Docker Hub, Quay, JFrog, cloud CRs), tag retention policies, immutable tags, RBAC with LDAP/OIDC, robot accounts, webhook/notification pipelines, P2P preheat, and audit logging. The architecture follows a layered pattern: REST API handlers (v2.0) → controllers → managers → DAOs, with middleware chains for security, quota, and content trust. Key entry points include the core API server, job service for background tasks, registry controller for blob/manifest management, and the Angular portal for administration. External dependencies include PostgreSQL, Redis, Trivy scanner, and various cloud registry APIs. The codebase is well-structured with extensive unit and integration tests, though it exhibits some technical debt from generated mocks and legacy components.
The cdk8s repository is an umbrella project that coordinates the CDK8s framework for generating Kubernetes manifests from code in multiple programming languages. It manages the project's website, documentation, and tooling, including automation for importing Kubernetes API schemas, generating documentation, and maintaining dependencies. The core framework logic resides in separate repositories (cdk8s, cdk8s-cli, cdk8s-plus), while this repo focuses on ecosystem support, version tracking, and community engagement through documentation, RFCs, and research into high-level abstractions. Key operational components include a Hugo-based website with Webflow-generated assets, MkDocs-driven documentation that auto-extracts API references from published packages, and Projen-managed project configuration. The repository features automated workflows for dependency upgrades, Kubernetes schema imports, and issue triage, demonstrating a commitment to maintenance and ecosystem compatibility. While containing a research directory for exploring L2 constructs, this activity is strictly in service of framework improvement rather than independent data research. The project exhibits strong engineering practices through its automation pipelines, dependency pinning, and versioned documentation strategy. Technical drift is low due to proactive updates via scheduled workflows and careful management of Kubernetes version alignment. The architecture emphasizes separation of concerns, with clear boundaries between website, documentation, tooling, and external framework packages.
werf is a production-grade CLI tool for full-cycle CI/CD of containerized applications to Kubernetes. It provides a unified pipeline for building container images (via Docker or Buildah backends), managing Git-based reproducible configurations (giterminism), deploying Helm charts with advanced tracking and lifecycle management, and performing cleanup of container registry and host resources. The architecture is monolithic but modular, with clear interface abstractions for container backends, registry clients, stage storage, and parallel execution. The codebase demonstrates high craftsmanship in areas like composable path matching, deterministic slug generation, and distributed locking, though it carries some duplication between legacy and modern deploy engines and a few forked dependencies. The repository is actively maintained with frequent releases and extensive test coverage across unit, integration, and e2e suites.
Kubenix is a Nix-based framework for declarative Kubernetes management. It uses the NixOS module system to define Kubernetes resources, Helm charts, Docker images, and custom resources in a type-safe, composable manner. The project provides a CLI tool for applying manifests with diffing, pruning, and secret injection via vals. At its core, kubenix is a set of Nix library functions and modules that evaluate user configuration to produce Kubernetes YAML/JSON. It supports submodules (nested composable configurations), testing frameworks (including kubetest), and code generation from Kubernetes OpenAPI specs. The architecture is purely functional, leveraging Nix's lazy evaluation to merge and validate resources at build time. This is a hybrid project combining a library (Nix modules and functions) with an application (CLI tool), but it is classified as an application because its primary deliverable is a deployable package and CLI.
Zarf is an air-gap native package manager for Kubernetes. It provides a CLI tool to build, sign, publish, and deploy immutable software bundles (packages) into disconnected Kubernetes clusters. The architecture consists of a Go CLI that orchestrates package lifecycle (create, deploy, remove, publish, inspect), a mutating admission webhook agent that rewrites container image references and Git URLs to point to internal Zarf services, and a set of embedded tools (Helm, K9s, Syft, Cosign, etc.). Key capabilities include OCI-based package distribution, Helm chart and manifest deployment, Git repository mirroring, SBOM generation, and Cosign-based signing/verification with both key and keyless modes. The codebase is well-structured with extensive unit and e2e tests, a clean separation between API versions (v1alpha1/v1beta1) with bidirectional conversion, and several reusable subsystems for value merging, archive extraction, template processing, and Kubernetes resource waiting. It is actively maintained with frequent releases and a large community (2000+ stars).
Kapitan is a configuration-as-code CLI tool that renders infrastructure manifests (Kubernetes, Terraform, Docker, etc.) from a hierarchical YAML inventory and pluggable template engines (Jsonnet, Jinja2, Kadet, Helm, Kustomize, CUE). It manages secrets via references (GPG, cloud KMS, Vault, base64), fetches remote dependencies (Git, HTTP, OCI, Helm charts), and supports multiple inventory backends (Reclass, OmegaConf). The compilation pipeline is inventory-driven: targets define classes and parameters, which are deep-merged and interpolated, then passed to input-type compilers that produce deterministic output files. The architecture is modular—separate packages for inputs, inventory backends, secrets/references, and dependency management—all orchestrated by the `kapitan compile` CLI command. It is not a data research project; it is a production-grade infrastructure tool with a large test suite, CI/CD, and documented extension points.
This is a Kubernetes controller that manages Helm chart deployments via Custom Resource Definitions (HelmChart and HelmChartConfig). It watches these CRDs and creates Kubernetes Jobs to run Helm install, upgrade, or delete operations, with a two-phase apply pattern that suspends jobs before updating them to avoid race conditions. The controller is built on the rancher/wrangler framework and handles complex features like failure policies, server-side apply, driver selection (secret vs configmap), values from secrets, HelmChartConfig merging, and bootstrapping. It is the core Helm management component of k3s and is designed to be deployed as a Deployment with a ServiceAccount and ClusterRole.
This repository is the official Helm chart collection for deploying Kong API Gateway and related operators (Kong Ingress Controller, Kong Gateway Operator, Kong Operator, Kong AI Gateway) on Kubernetes. It provides production-grade deployment templates with support for DB-less, PostgreSQL, hybrid mode, enterprise features, cert-manager integration, Prometheus monitoring, and admission webhooks. The architecture is a multi-chart Helm repository with subcharts for CRDs (kic-crds, gwapi-crds, ko-crds) and extensive CI snapshot testing via helm-chartsnap. Key entry points include the main `charts/kong/` chart for the gateway and ingress controller, `charts/kong-operator/` for the Kong Operator managing Konnect and AI gateway resources, and `charts/gateway-operator/` for the Gateway API operator. External dependencies include Kong container images, cert-manager, Bitnami PostgreSQL (optional), and Konnect SaaS for enterprise deployments. The repository is actively maintained with regular releases, changelogs, and upgrade guides, though CRDs are auto-generated and may drift from upstream operator versions.
This repository provides a Helm chart for deploying Uptime-Kuma, a self-hosted uptime monitoring tool, on Kubernetes. The chart is well-structured with support for Deployment or StatefulSet, persistent storage, ingress, external database (MariaDB/MySQL), Prometheus ServiceMonitor, and network policies. It includes comprehensive helm-unittest tests, CI/CD pipelines for linting, testing, and releasing, and automated dependency updates via Renovate. The chart is actively maintained and follows Helm best practices.
Portainer Community Edition is a full-stack container management platform providing a unified web UI and REST API for Docker, Docker Swarm, Podman, Kubernetes, Azure Container Instances, and edge computing environments. The backend is written in Go, using BoltDB for storage, gorilla/mux for routing, and includes proxy layers for Docker/Kubernetes/Azure APIs, Helm chart management, GitOps workflows, LDAP/OAuth authentication, RBAC, and backup/restore functionality. The frontend is a hybrid of legacy AngularJS (1.8) and modern React with TypeScript, using React Query, Zustand, Formik, Yup, and a custom UI component library with Storybook. Key entry points are the Go main command (api/cmd/portainer/main.go) and the webpack-compiled React/AngularJS app (app/app.js). The system manages endpoints, stacks, services, containers, volumes, networks, images, registries, edge devices, user teams, and access controls through a layered architecture of HTTP handlers, data services, and middleware. External dependencies include Docker SDK, Kubernetes client libraries, Helm SDK, and various third-party registries.
Khue's Homelab is a GitOps-driven infrastructure-as-code framework that automates a complete self-hosted Kubernetes platform from bare metal to user-facing applications. The codebase is organized into five layers: metal (Ansible roles that PXE-boot Fedora Server, bootstrap a k3s cluster with kube-vip HA, and install Cilium for networking/load balancing), system (bootstrap Helm charts for ArgoCD, cert-manager, ingress-nginx, Rook Ceph, and monitoring), platform (Gitea, Woodpecker CI, Grafana, Kanidm identity, Dex SSO, zot container registry), apps (Jellyfin + the *arr stack, Matrix, Paperless, Ollama, and more), and external (Terraform-managed Cloudflare DNS, tunnel, and ntfy alerting). ArgoCD ApplicationSets watch the git repository and deploy every Helm chart, making the repo itself the source of truth; a single top-level `make` drives the entire pipeline. The project demonstrates strong IaC craftsmanship: idempotent Ansible roles with checksum-verified downloads and run_once state handling (k3s token genesis, kubeconfig extraction), an ephemeral PXE server with per-MAC kickstart files and DHCP-proxy mode, declarative random secret generation via a small Go tool combined with the External Secrets Operator for cross-namespace secret sync, and a Terraform module that creates least-privilege Cloudflare API tokens injected directly into the cluster. It also includes a Nix dev shell for reproducible tooling, pre-commit hooks, Woodpecker CI that renders Helm diffs on pull requests, and Terratest-based smoke/integration/version tests. The author explicitly labels the project ALPHA and recommends forking for personal use. It is best treated as a reference architecture and a collection of reusable provisioning patterns rather than a turnkey product; some portions (scripts/hacks, take-screenshots, the gitea config job) are acknowledged work-in-progress, and a few pinned versions lag the ecosystem (Go 1.19 in-cluster compile jobs, k3s 1.30, several stale container image tags).
Dekorate is a Java annotation-processing framework that generates Kubernetes, OpenShift, Knative, and other container orchestration manifests at compile time. It is primarily a library consumed by Java applications, especially those built with Spring Boot, Quarkus, Thorntail, or plain Java. The architecture centers around a `Session` that coordinates `ConfigurationGenerator`s, `ManifestGenerator`s, and a graph of `Decorator`s to produce deployment descriptors. It supports multiple platforms via separate annotation modules (e.g., kubernetes-annotations, openshift-annotations, knative-annotations) and integrates with build tools like Docker, Jib, S2I, and Tekton for CI/CD pipelines. The codebase is well-structured with clean abstractions (Decorator, Configurator, SPI factories) and extensive testing, though it suffers from a high module count and some outdated dependencies (e.g., Java 1.8 baseline, old Spring Boot versions in examples). Overall, it is a mature and capable tool for generating Kubernetes manifests from Java annotations.
Flux2 is a CLI tool (the `flux` command) for implementing GitOps workflows on Kubernetes. It manages the lifecycle of Flux-specific Kubernetes resources (GitRepository, HelmRepository, OCIRepository, Kustomization, HelmRelease, ImageRepository, etc.) by generating manifests, applying them via server-side apply, and monitoring reconciliation status. The CLI is built with Cobra and provides subcommands for bootstrap, install, create, get, reconcile, suspend, resume, export, delete, diff, build, push, pull, tag, trace, tree, events, logs, check, migrate, uninstall, and plugin management. It supports multiple Git providers (GitHub, GitLab, Gitea, Bitbucket Server), OCI registries, Helm repositories, and cloud authentication (AWS, Azure, GCP). The architecture follows an adapter pattern where each resource type implements a common interface, enabling generic command implementations. Key data flows include: (1) bootstrap: clone a Git repository, generate manifests, push sync config, wait for readiness; (2) install: deploy Flux controllers and CRDs onto a cluster; (3) reconcile: fetch desired state from a source (Git, OCI, Helm), compute diff, apply via Kubernetes API, wait for convergence; (4) artifact management: build tarballs from manifests and push to OCI registries with metadata. External dependencies include Kubernetes controller-runtime, go-containerregistry, go-git, and various cloud SDKs. The repository also serves as the distribution hub for Flux controller manifests and includes a GitHub Action for installing the CLI in CI pipelines.
arkade is a command-line tool that functions as a marketplace and installer for developer tools and Kubernetes applications. It provides two primary workflows: downloading CLI binaries (over 200 tools) and installing Kubernetes Helm charts (over 50 apps) with custom overrides. The tool also supports OCI image installation/publishing, Helm chart image version upgrades, system-level package installation (e.g., Node.js, Caddy), and self-updating with SHA-256 verification. The architecture is a monolithic Go CLI built with Cobra, where each subcommand (get, install, update, system, oci, chart, etc.) is a separate command tree. Entry points include main.go (root command) and the various command files under cmd/. External dependencies include GitHub releases API, Helm CLI, kubectl, Docker (for qemu-static), and OCI registries. The codebase demonstrates solid engineering with reusable patterns such as template-based tool definitions, safe archive extraction, and a builder pattern for installer options, though it suffers from a large manual catalog that requires ongoing maintenance.
PullPreview is a GitHub Action implemented in Go that provisions ephemeral preview environments for pull requests. It manages cloud instances (AWS Lightsail or Hetzner), installs Docker or Kubernetes (k3s), and deploys applications using Docker Compose or Helm. The action integrates deeply with GitHub PR workflows: it reacts to labels, synchronizes SSH keys from repository collaborators, updates PR comments with deployment status and preview URLs, and performs scheduled cleanup of dangling instances. The codebase is organized around a provider abstraction pattern, with concrete implementations for Lightsail and Hetzner that share common orchestration logic for instance lifecycle, SSH access, and deployment. It is a self-contained CLI binary that runs as a composite action step, bundling all dependencies into a single executable.
K8up is a Kubernetes Operator designed for data protection, specifically managing backup and restore operations for Persistent Volume Claims (PVCs) and applications using the Restic backup tool. It functions as a control plane that reconciles Custom Resource Definitions (CRDs) such as Schedule, Backup, Restore, Prune, and Check into Kubernetes Jobs. The architecture is a monolithic binary (`cmd/k8up`) that can run as an operator or a CLI tool, utilizing the Kubebuilder framework and controller-runtime for the operator logic. It supports multiple storage backends (S3, Azure, GCS, Swift, etc.) and integrates with Prometheus for metrics and Grafana for dashboards. The codebase demonstrates a solid separation of concerns, with distinct modules for the operator logic (`operator/`), the Restic CLI wrapper (`restic/`), and the API definitions (`api/v1/`). It employs standard Kubernetes patterns like Job-based execution, RBAC, and Secret management for credentials. The project includes comprehensive testing, including unit tests, integration tests using envtest, and E2E tests using Bats. However, the codebase exhibits signs of technical drift, notably the `go.mod` file specifying a non-existent Go version (1.26), which suggests potential build instability or experimental state. Additionally, deprecated fields in CRDs (e.g., `keepJobs`) require migration attention. This repository is suitable for engineers needing a production-grade backup solution for Kubernetes clusters. It is particularly valuable for teams requiring declarative backup management, multi-cloud storage support, and application-aware backup capabilities via annotations or PreBackupPods. The high technical drift rating is primarily due to the Go version anomaly, but the architectural patterns and test coverage remain robust.
This repository is a comprehensive guide and automation suite for setting up a production-like Kubernetes cluster on local machines (macOS/ARM64 and Linux/AMD64). It combines educational documentation with working bash scripts that automate the entire deployment process from VM provisioning to Kubernetes component installation. The codebase consists primarily of shell scripts for infrastructure automation (VM setup, network configuration, certificate generation, Kubernetes component deployment) and JSON/YAML configuration files for Kubernetes and TLS certificates. The architecture follows a multi-stage deployment pattern: host preparation → VM provisioning → security bootstrapping → control plane setup → worker node setup → cluster services installation. Key entry points include setupall.sh (master orchestration script), auth/genauth.sh (certificate generation), and various setup scripts for individual components (setupcontrol.sh, setupnode.sh, setupcluster.sh). The repository demonstrates solid DevOps engineering practices with idempotent scripts, proper error handling, and clear separation of concerns across different deployment stages.
This repository provides the official Helm charts for deploying Mattermost, an open-source messaging platform, and its associated services (Focalboard, RTCD, Push Proxy, Calls Offloader) onto Kubernetes. The primary deployment method is the `mattermost-operator` chart, which uses Kubernetes Custom Resource Definitions (CRDs) to declaratively manage the full lifecycle of Mattermost installations, including databases, file stores, ingresses, and scaling. Legacy charts (`mattermost-enterprise-edition`, `mattermost-team-edition`) are included but deprecated in favor of the operator. The architecture is a collection of Helm charts, with the operator chart acting as the core. It relies on external dependencies like PostgreSQL, S3-compatible storage, and optionally Elasticsearch and Grafana. The repository demonstrates strong DevOps practices, including automated CI/CD for chart releases, end-to-end testing with kind, and embedded monitoring configuration. Key reusable patterns include a Helm-embedded Grafana dashboard template for application KPIs, an ExternalSecrets integration for secure credential management, a deprecation handling template for managing breaking changes, and advanced Kubernetes storage patterns (EFS, NFS). The codebase is actively maintained but carries some technical drift from legacy components and outdated Kubernetes API versions.
This repository provides Docker Compose and Kubernetes configuration files for deploying a variety of self-hosted applications and system services. It serves as a template repository for deploying services like AdGuard Home, Bitwarden, MinIO, Traefik, and others, as well as system tools like Fail2ban and acme.sh for certificate management. The architecture is modular, with each application having its own directory containing deployment configurations (docker-compose.yml, Helm charts, Kubernetes manifests). There is no single unified application; instead, it offers reusable deployment patterns for individual services. Key entry points are the docker-compose.yml or Helm chart files within each application's directory. The repository relies on external dependencies like Docker, Kubernetes, and Helm for deployment, and the applications themselves depend on their respective upstream container images.