KubeHound is a security analysis tool for Kubernetes clusters that automatically models and computes attack paths. It collects Kubernetes resources (pods, roles, bindings, endpoints, nodes) via a live API or offline dump, transforms them into a property graph stored in JanusGraph (with MongoDB as an intermediate store), and computes privilege escalation and lateral movement paths mapped to MITRE ATT&CK techniques. The system exposes a CLI for local analysis and a gRPC API (KHaaS) for service-oriented deployments, with optional Jupyter notebooks for querying the graph using a custom Gremlin DSL. The architecture is modular: a collector abstraction handles rate-limited streaming from the Kubernetes API; an ingestion pipeline converts raw objects into normalized store models and graph vertices/edges; an edge registry defines over 20 attack types (e.g., PodExec, TokenSteal, ContainerEscape); and a graph builder executes Gremlin traversals to connect vertices into paths. Storage layers use asynchronous writers with micro-batching for high throughput, and an in-memory cache deduplicates identities and roles. Telemetry (Datadog APM, metrics, logs) is integrated throughout. While primarily an application, the repository includes experimental research components (exp/khaudit) for audit reports and MITRE Attack Flow conversion, plus Jupyter notebooks for interactive graph queries, giving it a hybrid character. The codebase demonstrates strong engineering practices: provider interfaces, test mocking, worker pools, retry logic, and comprehensive system tests against real Kind clusters. However, some areas (large cluster optimizations, experimental code, deprecated flags) indicate ongoing evolution and minor technical debt.

This repository is a suite of Kafka cluster management tools developed by DataDog. It provides four primary tools: `topicmappr` for partition reassignment and rebalancing with storage-aware placement, `registry` for a gRPC/HTTP API that exposes Kafka metadata and custom tagging, `autothrottle` for dynamically adjusting replication throttles based on Datadog network metrics, and `metricsfetcher` for pulling partition size and broker storage metrics from Datadog into ZooKeeper. The architecture is a collection of independent CLI binaries and a gRPC server, all sharing well-factored Go libraries (`kafkaadmin`, `kafkazk`, `mapper`) that abstract Kafka admin operations, ZooKeeper interactions, and partition mapping logic. The codebase is production-grade, with extensive unit and integration tests, Docker-based development environments, and CI pipelines. It is tightly coupled to Datadog for metrics and ZooKeeper for metadata, which introduces some drift risk as Kafka evolves away from ZooKeeper. The last commit date (2026-09-16) appears anomalous and may indicate a timestamp issue, but the repository shows active maintenance with recent CI configurations and issue triage.