Open Source Provisioning Software

Reference Airship manifests, CICD, and reference architecture.

A Kubernetes Resource Interface for the Edge

Ansible is a radically simple IT automation platform that makes your applications and systems easier to deploy and maintain. Automate everything from code deployment to network configuration to cloud management, in a language that approaches plain English, using SSH, with no agents to install on remote systems. https://docs.ansible.com.

Apollo is a reliable open-source configuration management system

AWS CloudFormation provides a common language for you to describe and provision all the infrastructure resources in your cloud environment.

Cloud Foundry BOSH is an open source tool chain for release engineering, deployment and lifecycle management of large scale distributed services.

Cadence is a distributed, scalable, durable, and highly available fault-oblivious stateful code platform.

CDK8s lets you define Kubernetes apps and components using familiar programming languages and object-oriented APIs.

CFEngine Community

Chef Infra, a powerful automation platform that transforms infrastructure into code automating how infrastructure is configured, deployed and managed across any environment, at any scale

Rules engine for cloud security, cost optimization, and governance, DSL in yaml for policies to query, filter, and take actions on resources

Cloudify's manager related code

Unified Interface for Constructing and Managing Workflows on different workflow engines, such as Argo Workflows, Tekton Pipelines, and Apache Airflow.

DevStream: the open-source DevOps toolchain manager (DTM).

Docs, API bindings, clients and integrations supporting RackN Digital Rebar data center provisioning and workflow system.

an application that automates the lifecycle of servers

Universal Operator Lifecycle Manager (OLM) for Kubernetes operators, and operators for traditional Linux apps, with declarative integration between operators for automated microservice integration.

kiosk 🏢 Multi-Tenancy Extension For Kubernetes - Secure Cluster Sharing & Self-Service Namespace Provisioning

Run your deep learning workloads on Kubernetes more easily and efficiently.

Kubernetes Native Edge Computing Framework (project under CNCF)

Kubernetes Platform Provisioning for Application Delivery and Infrastruction Management

a lightweight kubernetes multi-tenancy gateway

Platform Engineering Engine: Deliver intentions to Kubernetes and Clouds

A toolkit for building secure, portable and lean operating systems for containers

Self-service, remote installation of Windows, CentOS, ESXi and Ubuntu on real servers turns your data center into a bare-metal cloud.

ManageIQ Open-Source Management Platform

CNCF is an open source software foundation that hosts and nurtures projects like Kubernetes and Prometheus.

Mist is an open source, multicloud management platform

Repository tracking all OpenStack repositories as submodules. Mirror of code maintained at opendev.org.

An open platform that extending your native Kubernetes to edge.

Pulumi - Universal Infrastructure as Code. Your Cloud, Your Language, Your Way 🚀

Server automation framework and application

Enable Self-Service Operations: Give specific users access to your existing tools, services, and scripts

Software to automate the management and configuration of any infrastructure or application at scale. Get access to the Salt software package repository here:

Shifu is the next generation cloud native IoT development framework that could 10X your IoT software development

An edge-native container management system for edge computing

Terraform enables you to safely and predictably create, change, and improve infrastructure. It is an open source tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned.

A workflow engine for provisioning bare metal.

vSphere is the industry-leading server virtualization software and the heart of a modern SDDC, helping you run, manage, connect, and secure your applications in a common operating environment across clouds.

Alibaba Cloud Container Registry (ACR) is a cloud-native artifacts management platform that helps your team build, manage, and ship containerized applications, also provides vulnerability analysis, global synchronization, content trust, and more functionalities out of the box.

Amazon Elastic Container Registry (ECR) is a fully-managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images.

Azure Container Registry allows you to store images for all types of container deployments including DC/OS, Docker Swarm, Kubernetes, and Azure services such as App Service, Batch, Service Fabric, and others.

The toolkit to pack, ship, store, and deliver container content

Container Registry is a single place for your team to manage Docker images, perform vulnerability analysis, and decide who can access what with fine-grained access control.

An open source trusted cloud native registry project that stores, signs, and scans content.

Detect vulnerabilities before images are ever deployed to containers. Store and distribute Docker images in your managed private registry.

Shipping updates continuously and automatically has become a critical element of any successful operation. JFrog is revolutionizing the software world with the practice of Continuous Update, with a speed and continuity that forever changes the way organizations manage and release software.

P2P Docker registry capable of distributing TBs of data in seconds

Authorization service and frontend for Docker registry (v2)

Build, Store, and Distribute your Applications and Containers

Zot is an OCI-native container registry for distributing container images and OCI artifacts.

Application security, API Security, Identity and Access Management, 2FA, Security for container environments

Alcide provides dev-to-production security for workloads running in Kubernetes & Istio

A service that analyzes docker images and scans for vulnerabilities

Apolicy fuses security and compliance into your cloud native development pipeline. Using policy-as-code, we automate risk, policy and remediation from source to production

Aqua Security is a software company providing cloud-native security technology.

Creators of Kubescape: the first end-to-end open-source Kubernetes Security platform, made for DevOps.

Fine-grained, policy-based, real-time authorization for APIs and microservices. Aserto is the maintainer of the Topaz and Open Policy Containers OSS projects.

Black Duck provides a comprehensive software composition analysis (SCA) solution for managing security, quality, and license compliance risk that comes from the use of open source and third-party code in applications and containers.

Bloombase is the intelligent storage firewall company

High-performance attack protection for Linux production environments – whether containerized, virtualized, or bare-metal, on-prem or cloud

Cerbos is the open core, language-agnostic, scalable authorization solution that makes user permissions and authorization simple to implement and manage by writing context-aware access control policies for your application resources.

Automatically provision and manage TLS certificates in Kubernetes

Chaitin Tech is a world leading and technology driven cyber security solution provider.

Check Point Software Technologies Ltd. is a leading provider of cyber security solutions to corporate enterprises and governments globally. Check Point protects over 100,000 organizations of all sizes.

Checkov scans cloud infrastructure configurations to find misconfigurations before they are deployed. Checkov manages and analyzes infrastructure as code (IaC) scan results across platforms such as Terraform, CloudFormation, Kubernetes, Helm, ARM Templates and Serverless framework.

InSpec: Auditing and Testing Framework

Vulnerability Static Analysis for Containers

Pioneering the world of self-healing, self-aware, self-sustaining, self-resilient, self-secure and intelligent remediation, MatosSphere brings a complete cloud security and governance solution for your cloud infrastructure.

Confidential Containers is an open source community working to enable cloud native confidential computing by leveraging Trusted Execution Environments to protect containers and data.

ContainerSSH launches a new container for each SSH connection in Kubernetes, Podman or Docker. The user is transparently dropped in the container and the container is removed when the user disconnects. Authentication and container configuration are dynamic using webhooks, no system users required.

Curiefense is a unified, open source platform protecting cloud native applications.

Datica brings the cloud to healthcare and helps highly regulated industries.

Prevent Kubernetes misconfigurations from reaching production (again 😤 )! From code to cloud, Datree provides an E2E policy enforcement solution to run automatic checks for rule violations. See our docs: https://hub.datree.io

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

Dosec Security Platform provides security protection capabilities for containers, kubernetes, microservices, serverless, and DevOps.

External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets.

Kubernetes security, policy and compliance experts

Cloud Native Runtime Security

Fast, portable and reliable dependency analysis for any codebase. Supports license & vulnerability scanning for large monoliths. Language-agnostic; integrates with 20+ build systems.

FossID is a software composition analysis tool that scans code for open source licenses and vulnerabilities.

Fugue empowers cloud engineering and security teams to move faster with confidence in their cloud security. Use Fugue to secure the entire development lifecycle—from infrastructure as code through CI/CD and runtime—using a unified policy engine powered by the Open Policy Agent (OPA), the open source standard for policy as code.

Get your resource requests "Just Right"

Artifact Metadata API

Hexa Policy Orchestrator enables you to manage all of your access policies consistently across software providers.

in-toto is a framework to protect supply chain integrity.

Bootstrap & Maintain Trust on the Edge / Cloud and IoT.

Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx.

Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark

Hunt for security weaknesses in Kubernetes clusters

Runtime protection for Kubernetes & other cloud Workloads. Kubearmor provides a observability and policy enforcement system to restrict any unwanted, malicious behaviour of cloud-native workloads at runtime.

Kubescape is an open source security and compliance platform that scans clusters, Kubernetes manifest files (YAML files, and Helm charts), code repositories, container registries and images. It detects misconfigurations according to frameworks such as the NSA-CISA, MITRE ATT&CK® and CIS, as well as software vulnerabilities, and calculates risk scores.

Manage admission policies in your Kubernetes cluster with ease

Kubernetes Native Policy Management

Metarget is a framework providing automatic constructions of vulnerable cloud native infrastructures.

Cloud native infrastructure security for your entire fleet

Moresec Shangfu Cloud Native Protection Platform is a security protection model based on the concept of cloud native. In view of the characteristics of cloud native application life-cycle, it involves in many stages of security protection, including R&D construction, security testing, image control, container deployment, container operation, etc. Shangfu also integrates security with development which means providing feedback of the application security condition through correlating operation asset, and promoting the iteration and upgrade of application. Whereupon, a closed loop of efficient cloud native application security risk is created, covering the whole stages of DevSecOps.

NeuVector Full Lifecycle Container Security Platform delivers the only cloud-native security with uncompromising end-to-end protection from DevOps vulnerability protection to automated run-time security, and featuring a true Layer 7 container firewall.

The solution enables DevSecOps teams to ensure the security, compliance, and operational readiness of their Kubernetes workloads and clusters. By automating the creation, deployment, and lifecycle management of policy-based Intelligent Guardrails, customers can gain insights, alerts, and reports, and enable effective collaboration across development and operations teams.

Notary is a project that allows anyone to have trust over arbitrary collections of data

An open source, general-purpose policy engine.

A docker-inspired CLI for building, tagging, pushing, pulling, and signing OPA policies to and from OCI-compliant registries.

OpenFGA is a high performance and flexible authorization/permission system built for developers and inspired by Google Zanzibar

NIST Certified SCAP 1.2 toolkit

Orca Security provides instant-on, workload-level security for AWS, Microsoft Azure, and Google Cloud Platform.

Noise Cancellation for Application Security. Built for cloud-native applications using container and Kubernetes-based architectures.

Open source, Security-as-Code platform for developers and security teams to identify and eliminate risks in your clouds.

Paralus is a free, open source tool that enables controlled, audited access to Kubernetes infrastructure and Zero trust Kubernetes with zero friction.

Platform AbstRaction for SECurity service

Passage makes it easy for developers to implement passwordless customer identity in any application.

A cli tool to help discover deprecated apiVersions in Kubernetes

Validation of best practices in your Kubernetes clusters

Kubernetes-native security solution, single pane of glass for containers and Kubernetes security.

A complete cloud native application protection platform that secures infrastructure and applications across cloud environments.

Qingteng Honeycomb · Container Security Platform can display risk scenarios visually for enterprises through continuous monitoring and analysis of the container security status, and protects the container environment during the entire life cycle (build, ship, and run) of the container.

Easily find roles and cluster roles attached to any user, service account, or group name in your Kubernetes cluster

A Kubernetes operator that simplifies the management of Role Bindings and Service Accounts.

Rudder is a configuration and security automation platform. Manage your Cloud, hybrid or on-premises infrastructure in a simple, scalable and dynamic way.

Scribe Security is a Tel Aviv, Israel-based provider of a SaaS platform for securing software across various supply chains.

Common go library shared across sigstore services and clients

Snyk is a cloud native application security provider that enables millions of developers to build software securely.

Sonobuoy is a diagnostic tool that makes it easier to understand the state of a Kubernetes cluster by running a set of Kubernetes conformance tests and other plugins in an accessible and non-destructive manner.

Spyderbat provides Linux runtime security, protecting dynamic environments by proactively tracking all user activities by their causal connections to detect and resolve external attacks, misconfigurations, and insider threats.

StackHawk helps developers find and fix application security vulnerabilities before they hit production with CI/CD automation.

StackRox is a Kubernetes-native security platform for cloud-native applications, containers, serverless, and Kubernetes.

Sysdig Secure embeds security and compliance into the build, run and respond stages of the Kubernetes lifecycle. 

Tensor Security is a cloud-native security company focused on providing AI-based and full-stack cloud-native security solutions.

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.

eBPF-based Security Observability and Runtime Enforcement

Python reference implementation of The Update Framework (TUF)

Open source cloud native security observability platform. Linux, K8s, AWS Fargate and more.

Active, zero-trust based security for containers and Kubernetes

Cloud-native authorization for modern applications and APIs, combining the best of Open Policy Agent and Google Zanzibar

Trend Micro, a global technology leader, helps make the world safe for exchanging digital information with its innovative security platform.

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Trivy-Operator operate trivy security tool on the Kubernetes cluster and incorporate it outputs into Kubernetes CRDs (Custom Resource Definitions) and from there, making security reports accessible through the Kubernetes API

Mend is a platform designed to automate open source security and compliance processes.

Zettaset is software-defined encryption that protects against data theft and can be deployed across all physical and virtual environments.

Open source platform for X.509 certificate based service authentication and fine grained access control in dynamic infrastructures

🔥Authing - IDaaS/IAM solution that can Auth to web and mobile applications.

CyberArk Conjur automatically secures secrets used by privileged users and machine identities

A reverse proxy that provides authentication with Google, Azure, OpenID Connect and many more identity providers.

OpenID Certified™ OpenID Connect and OAuth Provider written in Go - cloud native, security-first, open source API security for your infrastructure. SDKs for any language. Works with Hardware Security Modules. Compatible with MITREid.

Pinniped is the easy, secure way to log in to your Kubernetes clusters.

Pomerium is an identity and context-aware access proxy.

The SPIFFE Project

The SPIFFE Runtime Environment

A system for distributing and managing secrets

sso, aka S.S.Octopus, aka octoboi, is a single sign-on solution for securing internal services

The easiest, most secure way to access infrastructure.

Cloud native secrets management for developers - never leave your command line for secrets.

A tool for secrets management, encryption as a service, and privileged access management