How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
kube-state-metrics is a Kubernetes metrics exporter that generates Prometheus-compatible metrics from the current state of cluster objects such as pods, deployments, and nodes. It operates by watching the Kubernetes API server and transforming resource snapshots into metric families, which are then exposed over an HTTP endpoint in the Prometheus text-based exposition format for direct scraping. The project distinguishes itself through horizontal scaling capabilities, distributing metric collection across multiple instances using object UID hashing to reduce per-instance memory consumption. It
Kubernetes Goat is a security training environment designed for practicing the identification and exploitation of common vulnerabilities within an intentionally insecure cluster. It provides a controlled setting to simulate system exploitations, including container escapes, role misconfigurations, and server-side requests. The project utilizes scenario-based vulnerability deployment to create specific security flaws. It includes utilities for environment management that allow the cluster to be restored to a clean baseline by removing vulnerable scenarios, service accounts, and role bindings.
Kube-hunter is a security scanner and vulnerability hunter for Kubernetes clusters. It operates as a cloud-native penetration tool designed to identify security weaknesses, infrastructure misconfigurations, and exploitable gaps by simulating attacker techniques. The tool distinguishes itself through a dual-mode scanning engine that executes both remote external probes and internal network scans. It features identity-based impersonation, allowing it to use service account tokens and pod identities to simulate security access from specific cluster roles and determine the potential blast radius
Blocky is a stateless DNS proxy that functions as a network-wide ad-blocker and content filter. It operates as a single binary or Docker container with no database or persistent state, accepting DNS queries over UDP, TCP, HTTPS, TLS, QUIC, and HTTP/3 through a unified plugin-based query pipeline. The core of the system is a client-group policy engine that assigns devices to named groups and applies per-group blocklists, allowlists, and upstream resolvers, with all configuration changes applied through hot-reloading without requiring a restart. The project distinguishes itself through its modu
👀 A Kubernetes cluster resource sanitizer
The main features of derailed/popeye are: Cluster Sanitizers, Live Cluster Security Scanners, Cluster Audit Schedulers, Cluster, Kubernetes Resource Health Auditors, Kubernetes Resource Health Audits, Kubernetes Resource Linters, Resource Linters.
Projects with overlapping indexed features include: kubernetes/kube-state-metrics — kube-state-metrics is a Kubernetes metrics exporter that generates Prometheus-compatible metrics from the current… madhuakula/kubernetes-goat — Kubernetes Goat is a security training environment designed for practicing the identification and exploitation of… aquasecurity/kube-hunter — Kube-hunter is a security scanner and vulnerability hunter for Kubernetes clusters. It operates as a cloud-native… 0xerr0r/blocky — Blocky is a stateless DNS proxy that functions as a network-wide ad-blocker and content filter. It operates as a… cncf/curriculum — The CNCF Curriculum is an open-source repository that organizes exam domains and learning paths for CNCF certification… prometheus/blackbox_exporter — The Blackbox Exporter is a Prometheus-compatible probe that checks the availability and response correctness of…