Projects sharing features with External Secrets

Helmfile is a declarative tool for managing Kubernetes Helm releases across multiple environments. It defines the desired state of releases in version-controlled YAML files and synchronizes the cluster to match that state, acting as both a release manager and a state sync orchestrator. The tool layers environment-specific values, secrets, and lifecycle hooks onto shared release definitions, enabling consistent multi-environment deployments. Helmfile distinguishes itself through several integrated capabilities: it generates separate dependency lockfiles per environment for staged rollout of ch

Snyk is an application security testing platform designed to identify and remediate vulnerabilities across source code, open-source dependencies, container images, and infrastructure-as-code configurations. It functions as a comprehensive security workflow automation tool, utilizing a static analysis engine and dependency graph mapping to detect security flaws and license compliance issues throughout the software development lifecycle. The platform distinguishes itself through agentic workflow orchestration and an automated remediation pipeline that generates and submits pull requests to patc

Bruno is a local-first API client designed for building, testing, and managing network requests across a wide range of protocols. By storing all collections and configurations as plain-text files directly on the local filesystem, it enables native version control and offline access, ensuring that project data remains under user control without requiring cloud synchronization. The platform distinguishes itself through a declarative approach to API management, utilizing a domain-specific language to define request parameters and metadata. This architecture supports a robust testing environment

KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices.

Falco is an eBPF runtime security monitor and cloud native detection engine that identifies abnormal behavior and security threats across hosts and containers. It functions as a Linux kernel event auditor, capturing system calls and kernel events in real-time to detect malicious activity. The system distinguishes itself through a rule-based threat detection model that evaluates system activity against a library of community-maintained rules and custom security definitions. It enriches raw kernel events with container and Kubernetes metadata to provide observability into isolated environments

Review Access - kubectl plugin to show an access matrix for server resources

Static analysis from configs → Kubernetes NetworkPolicies in seconds

ThreatMapper is a cloud native application protection platform and infrastructure security scanner. It functions as a vulnerability management system and cloud workload telemetry collector designed to monitor workloads and detect security risks across cloud and container environments. The platform distinguishes itself through a network traffic visualizer that uses machine learning to classify communication patterns and a graph-based attack mapping system to identify high-risk paths between vulnerabilities and network dependencies. Its broader capabilities cover cloud infrastructure complianc

Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container images, filesystems, and infrastructure as code files. It functions as a software composition analysis tool and an infrastructure security scanner, providing automated checks for CI/CD pipelines and cloud environments to ensure the integrity of the software supply chain. The tool distinguishes itself through a modular, plugin-based architecture that allows for the independent inspection of diverse targets. It utilizes a declarative policy engine to evaluate configurations agai

kube-bench is a Kubernetes security benchmark scanner and configuration auditor. It verifies if a cluster adheres to the Center for Internet Security standards and other hardening guides to identify security misconfigurations and vulnerabilities. The tool operates as a containerized security scanner, utilizing host namespaces to analyze nodes and control plane components without requiring the installation of binaries directly on the host. It supports multiple Kubernetes distributions, applying environment-specific benchmarks to ensure auditing accuracy for managed services. The project cover

Kubescape is a security platform for Kubernetes that provides tools for scanning clusters, configurations, and container images against industry compliance and security benchmarks. It functions as a suite of security utilities, including a compliance auditor, a misconfiguration scanner, and a container vulnerability scanner. The project differentiates itself through automated remediation and active enforcement. It can automatically patch operating system vulnerabilities in images and fix security errors within manifest files. It also utilizes an admission controller to block the deployment of

Security risk analysis for Kubernetes resources

A tool to scan Kubernetes cluster for risky permissions

Gatekeeper is a Kubernetes admission control and policy enforcement engine used to ensure cluster resources comply with organizational security and configuration standards. It intercepts API requests to validate or reject non-compliant resources before they are persisted in the cluster. The project uses a parameterized policy library and custom resource definitions to create reusable templates and enforcement rules. It distinguishes itself through a hub-and-spoke management model, allowing a controller in a management cluster to enforce policies across separate target clusters. Beyond admiss

Devbox is a development environment orchestrator designed to create reproducible, isolated workspaces for software projects. By leveraging declarative configuration files and the Nix package manager, it ensures that project dependencies, environment variables, and tooling remain consistent across different machines and team members. It functions as a central manager for project-specific environments, providing isolated shell execution that prevents conflicts with host system software. The project distinguishes itself through its ability to bridge local development and cloud-hosted infrastruct

Trufflehog is a security tool designed to continuously monitor code repositories and cloud environments to detect, verify, and remediate exposed sensitive credentials and API keys. It functions as a comprehensive secret scanning engine that integrates directly into deployment pipelines and version control systems to intercept sensitive data before it is committed or pushed. By utilizing read-only operations and volatile memory processing, the system ensures that discovered credentials are never stored persistently, maintaining strict data privacy throughout the scanning lifecycle. The platfor

Consul Template is a configuration renderer and dynamic configuration manager that generates files by populating templates with data from Consul and Vault. It functions as a service discovery template engine and secrets management integrator, transforming cluster catalog and health data into formatted configuration files. The tool distinguishes itself by acting as a process supervisor and notifier, capable of executing shell commands or restarting applications automatically after templates are updated. It features a long-polling watcher to monitor remote key-value stores and employs a shared

Kruise is a workload management system designed for large-scale applications on Kubernetes. It provides a framework for advanced orchestration, scaling, and upgrade strategies to maintain stability in massive deployments. The project is distinguished by its ability to perform in-place updates of container images and resource limits without deleting and recreating pods. It includes a dedicated image pre-puller to accelerate pod startup and a sidecar injector to dynamically manage the lifecycle of sidecar containers. Additionally, a resource distributor synchronizes configuration maps and secre

Flux is a Kubernetes GitOps controller and deployment engine that synchronizes cluster state with configurations stored in a Git repository. It serves as a system for continuous delivery, utilizing a manifest generator to create configuration files from templates and a reconciliation loop to ensure the live environment matches the desired state defined in versioned repositories. The project distinguishes itself through a container image automator that scans registries and updates manifests based on semantic versioning or regular expressions. It incorporates secure configuration deployment via

Pipeline is a Kubernetes native CI/CD framework and cloud native pipeline orchestrator. It functions as a custom resource controller that translates declarative pipeline definitions into coordinated pod executions and managed workloads. The system acts as a containerized task runner, allowing for the execution of standalone build steps and reusable tasks that process specific inputs to produce defined outputs. It enables the orchestration of complex workflows by running a sequence of independent containers as modular components within a cloud environment. The platform covers automated softwa

KubeVirt is a Kubernetes virtualization platform and cloud-native hypervisor manager. It provides a runtime environment that allows virtual machines to be defined, launched, and managed as declarative resources within a Kubernetes cluster, enabling them to run alongside containers on the same nodes. The system enables the hybridization of cloud infrastructure by combining traditional virtual machines with containerized workloads on a single shared platform. It supports the live migration of running virtual machines between physical hosts to facilitate cluster maintenance and load balancing.

Flagger is a Kubernetes progressive delivery operator that automates the gradual release of new software versions. It functions as a canary release manager and traffic shifter, integrating with service meshes and ingress controllers to control request distribution between application versions. The project focuses on reducing production risk by implementing canary releases, blue-green deployments, and A/B testing. It utilizes a metric-driven analysis loop to monitor request success rates and durations, automatically promoting a release or triggering a state-based rollback if health criteria ar

KServe is a Kubernetes-native platform for deploying and serving machine learning models as scalable inference services. It supports both generative AI models, including large language models, and traditional predictive models from frameworks such as TensorFlow, PyTorch, Scikit-Learn, XGBoost, and ONNX. The platform manages the full lifecycle of model deployments, including revision tracking, canary rollouts, A/B testing, and automatic rollbacks, and provides serverless scale-to-zero capabilities for cost-efficient resource management. KServe distinguishes itself through a standardized infere

The logging operator is a Kubernetes-native controller designed to automate the deployment, configuration, and lifecycle management of log collection and routing infrastructure. By utilizing custom resource definitions, it provides a declarative framework for standardizing how container logs are captured, processed, and forwarded across distributed cluster environments. The project distinguishes itself through its support for multi-tenant logging architectures, allowing administrators to enforce namespace-scoped isolation for log collection and routing configurations. It employs a sidecar inj

Sops is a secrets encryption tool designed to encrypt and decrypt sensitive values within configuration files. It functions as a manager for secrets that integrates with cloud key vaults and PGP keys to secure data stored in version-controlled files. The tool utilizes structure-preserving encryption to encrypt individual values while keeping the overall file format and non-sensitive keys intact. It employs a KMS-backed encryption model, interfacing with external key management services from AWS, GCP, and Azure to handle cryptographic operations without exposing private keys locally. The proj

kro is a Kubernetes resource orchestrator and API abstraction layer that enables the definition of simplified custom API surfaces. It allows users to map high-level inputs to complex templates of underlying Kubernetes objects, effectively grouping interdependent resources into single, manageable units. The project differentiates itself by automating the generation of custom resource definitions and dedicated controllers from resource graph specifications without requiring manual Go code. It employs a dependency manager that uses directed acyclic graphs to coordinate the creation, readiness, a

The etcd-operator is a custom resource controller designed to automate the deployment, scaling, backup, and recovery of distributed key-value storage clusters on container orchestration platforms. By extending container orchestration APIs with custom resource definitions, the system manages multi-node database instances through declarative configuration files and a continuous controller reconciliation loop that drives cluster provisioning, scaling, and maintenance. The operator provides automated cluster member recovery, detecting unresponsive nodes and executing membership replacements to pr