Projects sharing features with Sealed Secrets

This project is a Kubernetes controller that automates the issuance, renewal, and lifecycle management of TLS certificates. It functions as a native extension to the cluster API, using custom resource definitions and reconciliation loops to maintain the desired state of certificates and trust bundles across distributed services. By integrating directly with the cluster's admission control and secret storage systems, it ensures that cryptographic identities are consistently provisioned and available for application workloads. The project distinguishes itself through its extensive support for a

Sops is a secrets encryption tool designed to encrypt and decrypt sensitive values within configuration files. It functions as a manager for secrets that integrates with cloud key vaults and PGP keys to secure data stored in version-controlled files. The tool utilizes structure-preserving encryption to encrypt individual values while keeping the overall file format and non-sensitive keys intact. It employs a KMS-backed encryption model, interfacing with external key management services from AWS, GCP, and Azure to handle cryptographic operations without exposing private keys locally. The proj

Flux is a Kubernetes GitOps delivery tool used to automate application deployments by synchronizing cluster state with configurations stored in Git, OCI, or Helm repositories. It functions as a set of controllers that monitor desired state in external sources and continuously reconcile the live cluster to match those definitions. The system distinguishes itself through a multi-cluster management plane that coordinates application delivery across fleets of remote clusters from a central hub. It provides a dedicated mechanism for automated image updates, which scans container registries for new

Kubebuilder is a framework and set of scaffolding tools used to build Kubernetes APIs and controllers. It functions as an operator framework that provides generators for custom resource definitions, admission webhooks, and RBAC manifests to extend cluster functionality. The project distinguishes itself through marker-based code generation, which parses source code comments to automatically produce Kubernetes manifests and boilerplate logic. It employs a hub-and-spoke versioning model to translate data between multiple API versions and uses a three-way merge strategy to automate project migrat

gopass is a terminal-based password manager and GPG secret store used for generating, storing, and retrieving encrypted credentials. It functions as a collaborative secret manager that encrypts data using GPG or age and synchronizes it across devices and teams using Git. The system distinguishes itself by treating version control repositories as the primary storage backend, enabling secure secret sharing and version history for credentials. It utilizes a hierarchical directory structure to organize secrets on the filesystem and supports multi-store mounting to combine multiple independent rep

Crossplane is a Kubernetes-based control plane framework that functions as a cloud resource orchestrator and infrastructure-as-code platform. It enables the management of heterogeneous infrastructure by extending the Kubernetes API to provision and maintain external cloud services through declarative configuration. By utilizing custom resource controllers, it continuously reconciles the state of external infrastructure with defined desired states, ensuring consistent deployment and lifecycle management across multiple cloud providers. The platform distinguishes itself through its composition-

The Prometheus Operator is a Kubernetes monitoring orchestrator and controller that manages Prometheus clusters and observability components through declarative custom resources. It functions as a custom resource controller that translates high-level Kubernetes resource definitions into the configuration files required by the underlying monitoring software. The project automates the deployment, scaling, and lifecycle of an observability stack, including the integration of components like Thanos and Alertmanager. It distinguishes itself by syncing monitoring targets, alerting rules, and scrape

This project is a Go language library that provides a programmatic interface for interacting with the Kubernetes API server. It serves as a client for managing cluster resources, offering both typed interfaces for compile-time safety and dynamic interfaces for unstructured data and custom resource management. The library includes a controller framework designed for building event-driven automation. This framework utilizes informers to maintain local resource caches and rate-limited work queues to decouple event detection from state reconciliation. High availability is supported through a lead

Kube-rs is a Rust client library and runtime for interacting with the Kubernetes API server. It provides a type-safe interface for managing cluster resources and state, including a toolkit for defining custom resource definitions and a framework for building admission webhooks to validate or mutate API requests. The project distinguishes itself through a dedicated controller runtime that implements event-driven reconciliation loops to align actual cluster state with desired configurations. It utilizes a streaming system to monitor resource changes and synchronize remote states into a local qu

Argo Workflows is a container-native workflow engine that functions as a Kubernetes custom resource controller. It orchestrates complex sequences of containerized tasks by executing them as directed acyclic graphs, allowing for dependency management and parallel processing within a cluster. The system extends the native Kubernetes control plane to manage the full lifecycle of automated processes, from initial triggering to final resource cleanup. The platform distinguishes itself through its controller-pattern reconciliation, which continuously monitors workflow states to align them with desi

This project is a GitOps infrastructure framework designed for managing bare metal servers, container clusters, and networking. It serves as a declarative system for orchestrating the deployment and lifecycle of self-hosted services, using Git as the source of truth to synchronize the desired state of the environment. The framework differentiates itself through a comprehensive automation suite that covers the entire hardware-to-service pipeline. It includes a PXE-based bare metal provisioner for network booting and operating system installation, alongside a lightweight container orchestration

Travis CI is a continuous integration platform and CI/CD pipeline orchestrator that automates the testing and building of code changes from version control systems. It functions as a multi-language test runner and build infrastructure manager, ensuring software quality through automated testing across various programming languages and runtimes. The platform is distinguished by its use of virtual-machine-based isolation for reproducible environments and a configuration-driven approach to pipeline generation. It supports complex testing strategies through parallel matrix execution, allowing job

The project is a declarative GitOps controller and package manager designed to automate the deployment and lifecycle management of Helm charts within a cluster. It continuously watches custom resources and external artifact sources, comparing the actual cluster state against desired declarations to drive reconciliation. Artifacts and manifests are retrieved from standard package repositories, Git sources, OCI registries, and object storage buckets. The system handles complex application delivery through dependency sequencing, automated failure remediation, and drift detection. It supports cro

This is a Java client library for interacting with the Kubernetes API server. It provides a programmatic interface and a set of typed models to manage cluster resources, orchestrate state reconciliation, and administer pods and namespaces within a Kubernetes environment. The library enables the development of custom controllers by providing frameworks for implementing automated control loops that reconcile the actual state of resources with a desired target state. It supports the generation of strongly-typed Java classes from OpenAPI specifications and custom resource definitions to ensure ty

yadm is a dotfile manager that uses Git as its underlying version control engine to track, synchronize, and manage configuration files across multiple machines. It keeps dotfiles in their original home directory locations while providing a system for deploying different file versions based on operating system, hostname, or hardware architecture through an alternate file naming convention. The tool distinguishes itself through several integrated capabilities that go beyond basic version control. It includes a template-based configuration generation system that renders files by merging template

Sample Controller is a reference implementation and developer toolkit for building custom controllers and operators to extend cluster capabilities with domain-specific resource types and reconciliation loops. It provides a foundational framework for defining, registering, and validating custom resource definitions and their instances to store domain-specific data within a cluster. The framework observes remote API servers for resource mutations, queueing discovered instances for asynchronous processing while listening for creation, update, and deletion events to trigger reconciliation logic.

This project provides a framework for building Kubernetes operators and custom controllers. It offers a set of libraries designed to manage the lifecycle of cluster resources, enabling developers to synchronize the actual state of a cluster with a desired configuration through event-driven reconciliation loops. The framework distinguishes itself by providing a manager-orchestrated environment that coordinates multiple controllers and webhooks within a single process. It includes built-in support for optimistic concurrency control to prevent update conflicts and utilizes in-memory informer cac

This project is a comprehensive educational curriculum designed to teach the fundamentals of container orchestration and infrastructure automation. It provides a structured learning path for mastering the lifecycle management of containerized applications, covering the core concepts of declarative resource definitions, control-loop-based reconciliation, and distributed cluster state management. The course distinguishes itself by focusing on practical, hands-on implementation of modern DevOps practices. It guides users through the integration of GitOps workflows for state synchronization, the

Agones is a Kubernetes game server orchestrator designed for deploying, scaling, and managing dedicated multiplayer game server processes across a distributed cluster. It provides the core infrastructure needed to provision individual or grouped server processes to support real-time multiplayer gaming sessions. The system includes a fleet manager to automate the lifecycle of server groups based on player demand and a health monitor to track the connectivity and operational status of active processes. It integrates with cluster autoscalers to synchronize server resource requirements with cloud

Tink is a multi-language cryptography library and security toolkit providing secure APIs for data encryption and digital signatures. It functions as a data encryption library and digital signature framework designed to prevent common implementation errors across different platforms and operating systems. The project serves as a cryptographic keyset manager, utilizing JSON for the storage, rotation, and serialization of keys to maintain consistency across various programming languages. It ensures identical cryptographic behavior globally by mapping language-specific libraries to a unified set

git-secret is a command line tool and Bash encryption utility used to manage sensitive configuration files and passwords within Git repositories. It enables version controlled secret storage by encrypting files with GPG public keys, ensuring that sensitive data can be committed to a repository without exposing plaintext. The tool utilizes a PGP encryption workflow to control access through a managed keyring of authorized public keys. This allows for the granting and revocation of decryption permissions for specific users. To prevent accidental data leaks, it automatically integrates with Git

Pipeline is a Kubernetes native CI/CD framework and cloud native pipeline orchestrator. It functions as a custom resource controller that translates declarative pipeline definitions into coordinated pod executions and managed workloads. The system acts as a containerized task runner, allowing for the execution of standalone build steps and reusable tasks that process specific inputs to produce defined outputs. It enables the orchestration of complex workflows by running a sequence of independent containers as modular components within a cloud environment. The platform covers automated softwa

This project is a Kubernetes cluster management framework and infrastructure-as-code template designed to bootstrap and maintain Talos Kubernetes clusters on bare-metal or virtual machines. It provides a structured system for deploying complete orchestration environments using declarative configurations and template-driven workflows. The framework distinguishes itself through a GitOps-driven execution model that utilizes Flux for state reconciliation and Renovate for automated dependency updates of Helm charts and container images. It employs a TOML-based configuration system to generate envi

Boundary is an identity-aware access proxy and privileged access management tool. It brokers secure network connections to infrastructure targets by mapping verified user identities to granular permissions, providing a gateway to servers and databases without the need for static credentials or VPNs. The system distinguishes itself through just-in-time connectivity and automated credential injection, delivering short-lived secrets to users during session initialization. It implements a composable security model using allow-only role-based access control and hierarchical resource scoping to iso

AliSQL is a fork of MySQL by Alibaba that extends the relational database management system with enhancements for high performance, scalability, and enterprise-grade availability. It retains the core MySQL identity as a SQL-based database for storing, organizing, and retrieving structured data, while adding optimizations for large-scale transactional and analytical workloads. The project differentiates itself through a set of Alibaba-specific improvements, including a columnar engine for accelerating analytical queries directly on MySQL tables, and a distributed, shared-nothing NDB Cluster en

Velero is a backup and recovery tool for Kubernetes cluster resources and persistent volumes. It functions as a disaster recovery solution and a utility for migrating applications and their associated data between different clusters. The project enables the replication of production environments by cloning cluster resources into development or testing environments for validation and debugging. It provides capabilities for backing up system objects, restoring resources to a known good state, and transferring applications across environments to facilitate system transitions.

Werf is a container image builder, Kubernetes continuous delivery tool, and deployment orchestrator. It creates container images using Dockerfiles or assembly syntax and manages the automated rollout of applications to Kubernetes clusters by translating package definitions into resource manifests. The system differentiates itself through a multi-architecture build pipeline that integrates system emulators to produce images for different CPU architectures on a single host. It employs content-based tagging and layer caching to avoid uploading redundant image layers to remote registries. Beyond