Kubernetes

• KubernetesContainer orchestration at scale

  Free / OSS · Apache-2.0 · 128k GitHub stars

  VerdictPowerful but only worth it at scale.

  CatchComplexity is legendary. Small teams often do not need it. Operational burden is significant. The YAML can become unmanageable.

• TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier

  Free / OSS · Apache-2.0 · 38.6k GitHub stars

  VerdictApache-2.0 security scanner. Fully free CLI; Aqua Platform is the paid cousin.

  CatchCLI/CI scanner — not Aqua Platform management UI/RBAC/policy SaaS. Vs Grype/Snyk: Aqua OSS default with broad target surface; Aqua Inc monetizes a separate commercial platform. You still triage and patch.

• TraefikMIT dynamic reverse proxy for Docker/K8s ingress

  Free / OSS · OSS/MIT · 65.3k GitHub stars

  VerdictMIT dynamic proxy for Docker/K8s. Free core; Hub is optional paid.

  CatchVs Caddy: dynamic Docker/K8s LB/Ingress lane, not auto-HTTPS-for-one-binary. Steeper label/static-vs-dynamic model. Not a PaaS. Hub/API-management SKUs are separate paid products you do not need for reverse-proxy duty.

• FluxApache-2.0 CNCF GitOps Toolkit for Kubernetes

  Free / OSS · Apache-2.0 · 8.5k GitHub stars

  VerdictApache-2.0 K8s GitOps. Free on-cluster; not a VM deploy tool.

  CatchK8s-only GitOps Toolkit; not Kamal/Coolify VM PaaS. You need a working cluster plus RBAC plus secrets story. Prefer current Flux Operator docs over legacy bootstrap blogs.

• Argo CDApache-2.0 CNCF declarative GitOps CD for Kubernetes

  Free / OSS · Apache-2.0 · 24.4k GitHub stars

  VerdictApache-2.0 GitOps CD. Free on-cluster; Flux is the toolkit cousin.

  CatchVs Flux: UI/app-centric GitOps CD lane, not Flux Toolkit. Still K8s-only. You run the control plane, secrets, and promotion story. Not Kamal/Coolify for VMs.

• HelmApache-2.0 Kubernetes package manager

  Free / OSS · Apache-2.0 · 30.4k GitHub stars

  VerdictApache-2.0 K8s packaging. Free forever; GitOps tools are a different layer.

  CatchK8s package manager - not Argo CD/Flux GitOps sync, not a cluster itself. Templating can become spaghetti; you still own values, secrets, and upgrade discipline. Not Kamal/Coolify for VMs.

• k9sApache-2.0 terminal UI for Kubernetes

  Free / OSS · Apache-2.0 · 34.9k GitHub stars

  VerdictApache-2.0 K8s TUI. Free forever; you still bring the cluster.

  CatchK8s cluster TUI - not Helm packaging, not a dashboard SaaS. Needs a working kubeconfig and cluster access. Not Lens Electron GUI.

• TiltApache-2.0 microservice dev loop for Kubernetes

  Free / OSS · Apache-2.0 · 10.1k GitHub stars

  VerdictApache-2.0 K8s dev loop. Free forever; use when many services share one cluster while you type.

  CatchVs Skaffold/Garden/DevSpace: Tilt is the Kubernetes *dev control plane*, not a prod CD system and not a Dockerfile replacement (Earthly/BuildKit still own image recipes). You need a cluster and a willingness to learn Tiltfile. Not magic for non-container monoliths.

• watchexecApache-2.0 mature file→command watcher (entr-class)

  Free / OSS · Apache-2.0 · 7.2k GitHub stars

  VerdictApache-2.0 file watcher. Free forever; fill the entr-shaped hole when Tilt is overkill.

  CatchVs Tilt (K8s microservice *dev control plane*): watchexec is the entr-class local file watcher, not a cluster live-update UI. Not a build system and not a process supervisor for multi-service graphs. You still write the command and filter extensions yourself.

• sternApache-2.0 multi-pod Kubernetes log tail

  Free / OSS · Apache-2.0 · 4.9k GitHub stars

  VerdictApache-2.0 K8s log tail. Free forever; follow the fleet, not one pod at a time.

  CatchVs k9s (full Kubernetes *TUI*): stern is the *multi-pod log tail CLI*, not a cluster navigator, not Helm, not a dashboard. Needs kubeconfig and RBAC to read logs. Not Loki/Vector (log pipelines).

• kindApache-2.0 Kubernetes clusters inside Docker

  Free / OSS · Apache-2.0 · 15.6k GitHub stars

  VerdictApache-2.0 local kube. Free forever; spin a cluster in Docker, tear it down in CI.

  CatchVs k3d/k3s (lighter single-binary k8s), colima (container runtime host), and minikube: kind is *Kubernetes-in-containers*, not a production control plane and not a substitute for cloud quotas. Needs a working container runtime; multi-node “realism” is still fake under one Docker host.

• DozzleMIT realtime Docker/Swarm/K8s log UI

  Free / OSS · OSS/MIT · 14.7k GitHub stars

  VerdictMIT live container log UI. Lightweight tail vs full observability stacks.

  CatchVs Grafana/Loki, ELK, Datadog (full observability): Dozzle is lightweight realtime log UI, not metrics/traces/storage/retention. If the container is gone, so is the history Dozzle never kept. Pair with a real log backend when you need audit trails.

• Agent SubstrateHigh-density secure sandbox runtime for idle-heavy agent workloads

  Free / OSS · Apache-2.0 · 5.7k GitHub stars

  VerdictApache-2.0 agent sandbox runtime. Reach for dense suspend/resume isolation on K8s; bring cluster ops.

  CatchVs AgentBox and Flue: Substrate is the dense sandbox/runtime control plane on Kubernetes, not a developer ADE and not a TypeScript harness framework. Ops cost is real — you need cluster competence. README notes it is not an officially supported Google product.

• AX (Agent Executor)Apache-2.0 Go CLI and Kubernetes CRDs for running agent tasks

  Free / OSS · Apache-2.0 · 14k GitHub stars

  VerdictApache-2.0 agent executor for Kubernetes. Use the ax-agent-executor CLI and CRDs when durable Task/Workspace/Gateway primitives matter; do not confuse it with AX Check.

  CatchThis is AX Agent Executor, not the live AX Check (Gauge) evaluation product — the names collide, so use the ax-agent-executor slug. Vs Agent Substrate: AX is the task/CLI/CRD experience on top of an agent runtime; vs OneCLI and Dexto: it is Kubernetes execution infrastructure, not a general desktop agent; vs Cua: it is not a browser/computer-use surface. Kubernetes and Agent Substrate operations are still your problem.

• CiliumeBPF networking, security, and observability for Kubernetes

  Free / OSS · Apache-2.0 · 25.7k GitHub stars

  VerdictApache-2.0 eBPF Kubernetes networking. Default when identity-aware policy and Hubble flows beat plain CNI.

  CatchVs flannel/Calico defaults: Cilium is the deeper eBPF control plane — more power, more kernel/datapath expertise. Isovalent/Cisco commercial layers exist around the same codebase; self-host OSS carefully for upgrades and Hubble ops.

• Dapr AgentsApache-2.0 CNCF Dapr durable agent workflows on Kubernetes

  Free / OSS · Apache-2.0 · 764 GitHub stars

  VerdictApache-2.0 durable agents when you already run Dapr/K8s — skip for single-dev laptop harnesses that do not want sidecar ops.

  CatchYou inherit the Dapr + Kubernetes ops surface — overkill for a laptop coding agent. Vs Temporal + mcp-agent durability: different durability stacks; Dapr Agents wins when Dapr is already platform policy, not when you want the lightest local loop.

• kagentApache Kubernetes-native framework for building AI agents

  Free / OSS · Apache-2.0 · 4.1k GitHub stars

  VerdictApache K8s-native agents when fleet deploy lives in the cluster — not ADK/Mastra app frameworks and not Agentgateway proxy alone.

  CatchVs google-adk / mastra / langgraph / agentgateway: ADK/Mastra/LangGraph are code-first agent frameworks; Agentgateway is an MCP/A2A proxy — kagent’s catch is Kubernetes-native agent build/deploy/manage. You need a real cluster and K8s fluency; not the right first tool for a laptop coding-agent seat.

• RadarApache-2.0 Kubernetes web UI — topology, Helm, GitOps, audit, built-in MCP

  Free / OSS · Apache-2.0 · 3.9k GitHub stars

  VerdictApache-2.0 K8s web UI + MCP when day-2 cluster visibility belongs in a browser — OSS binary free forever; Cloud is the paid multi-cluster/SSO line; watch the star heat.

  CatchBrowser UI, not a terminal — if you live in kubectl/k9s only, this is a different seat. The MCP reads and operates through Radar’s cluster context; it does not run agents for you. Scope RBAC tightly: whatever the kubeconfig can do, the UI and MCP can attempt. Paid Radar Cloud adds hosted multi-cluster and SSO while the OSS binary stays free. ★ climbed fast for the project’s age (~3.6k in under a year) — judge it on substance (views, MCP, single binary), not the badge. Young product; pin a release.

• NVIDIA DynamoApache-2.0 datacenter-scale LLM inference orchestration above vLLM, SGLang and TensorRT-LLM

  Free / OSS · Apache-2.0 · 8.3k GitHub stars

  VerdictApache-2.0 cluster-level LLM serving when you run vLLM/SGLang/TRT-LLM across many GPUs — free, but overkill below multi-GPU scale and benchmarks are vendor-run.

  CatchBuilt for multi-GPU, multi-node serving — the README itself says one model on one GPU only needs the engine (see vLLM, or llama-swap for a local model switcher). Realistically NVIDIA hardware and Kubernetes; the headline speedups are vendor and partner benchmarks on GB200/GB300-class racks, so measure on your own GPUs. Lots of moving parts (frontend, router, workers, planner, discovery backend) and a fast release cadence: pin a version. Vs vLLM Semantic Router (model choice per request) and plain vLLM: Dynamo is the cluster scheduler, not a model router or an engine.

• KubescapeApache-2.0 CNCF Kubernetes security — manifest and cluster scans, image CVEs, auto-fix, admission policies, MCP server

  Free / OSS · Apache-2.0 · 11.8k GitHub stars

  VerdictFree, broad Kubernetes posture scanning that fits in CI with one command — start with a single framework to tame the noise, and skip it if you have no Kubernetes.

  CatchCreated and still driven by ARMO, which sells a commercial platform on top, so expect docs and links to point there. Full-framework scans are noisy on a first run; pick one framework or a namespace scope before wiring it into CI. Image scanning wraps Grype, so it overlaps with Trivy if you already run that. The runtime operator is a real in-cluster footprint, not just a CLI.

• Agent SandboxApache-2.0 Kubernetes Sandbox CRD + controller — warm pools for agent runtimes

  Free / OSS · Apache-2.0 · 4.3k GitHub stars

  VerdictApache-2.0 sandbox orchestrator for Kubernetes when agent runtimes need stable, warm, stateful pods — pair it with gVisor or Kata for the actual isolation.

  CatchIt schedules and manages sandboxes; it does not isolate them. Isolation comes from the RuntimeClass you pair it with — gVisor (see the gvisor gem) or Kata Containers — and without one you just have ordinary pods. Assumes you already run and operate a Kubernetes cluster. Vs e2b (hosted sandbox API with an SDK): Agent Sandbox is the self-hosted orchestration layer on your own cluster, with no hosted control plane.

• ToolHiveApache-2.0 MCP server runner + gateway — each server in its own container

  Free / OSS · Apache-2.0 · 2.3k GitHub stars

  VerdictApache-2.0 container-isolated MCP runner when you want every server sandboxed and auditable — bring Docker/Podman and an IdP for real policy.

  CatchEvery MCP server runs in its own container, so you need Docker or Podman even on a laptop. Identity and access policies only apply once you connect an OIDC/OAuth provider — out of the box it is isolation, not authorization. Stacklok sells an enterprise tier on top. Vs metamcp (aggregator/proxy that merges servers into one endpoint) and contextforge (gateway/federation): ToolHive’s lane is per-server container isolation plus a registry.

• KyvernoApache-2.0 CNCF Kubernetes policy engine — policies as YAML, not Rego

  Free / OSS · Apache-2.0 · 8.3k GitHub stars

  VerdictApache-2.0 Kubernetes admission policy engine when policies should be plain YAML — start in audit mode; reach for Rego when logic gets complex.

  CatchEnforces at admission time, so a bad policy (or an unavailable webhook with fail-closed settings) can block deploys cluster-wide — roll out in audit mode first. YAML policies get awkward for complex logic; Rego-based engines express that more cleanly. Vs kubescape (posture and compliance scanning) and topaz (application authorization): Kyverno is the in-cluster admission policy lane.

• HAMiApache-2.0 CNCF project that shares and slices GPUs and other accelerators across Kubernetes workloads

  Free / OSS · Apache-2.0 · 4.9k GitHub stars

  VerdictThe CNCF way to pack many small GPU jobs onto shared cards — validate isolation per accelerator vendor.

  CatchIt is a scheduling layer for a GPU cluster you already run, not a model server — you still bring vLLM, Triton or whatever serves the model. How limits are enforced depends on each vendor’s device backend, so isolation and overcommit behaviour differ between NVIDIA and other accelerators; test the limits on your hardware before you rely on them.

• UnitermApache-2.0 terminal for 30+ protocols with an AI agent

  Free / OSS · Apache-2.0 · 874 GitHub stars

  VerdictOne app for nearly every remote protocol plus an agent — bring your own model key and keep approvals on.

  CatchThe AI agent needs your own API key and endpoint — nothing is bundled — and it runs real commands on the machines you are connected to, so review before approving. The WSL and Windows remote features are Windows-only. Young project. Vs tabby (a mature, extensible terminal with SSH and serial): Uniterm trades polish for far wider protocol coverage and an agent.

• llm-dApache-2.0 Kubernetes stack for distributed LLM inference

  Free / OSS · Apache-2.0 · 4.9k GitHub stars

  VerdictThe open, Kubernetes-native layer for multi-GPU LLM serving — free, but overkill below cluster scale.

  CatchOnly makes sense if you already run Kubernetes and accelerators at scale — for one model on one GPU, a model server alone is enough. The headline gains in the README (for example 3x throughput from prefix-cache-aware routing) come from partner and vendor deployments on high-end GPUs, so measure your own. Still pre-1.0. Vs NVIDIA Dynamo (same layer): llm-d is Kubernetes-native and multi-vendor under the CNCF; Dynamo is NVIDIA-led.

• KEDAApache-2.0 CNCF event-driven autoscaling for Kubernetes

  Free / OSS · Apache-2.0 · 10.6k GitHub stars

  VerdictThe standard way to autoscale Kubernetes on queues and events — if you are already on Kubernetes.

  CatchOnly useful if you already run a Kubernetes cluster. You write a ScaledObject or ScaledJob rule for each event source and tune thresholds yourself, and scale-from-zero adds cold-start latency for the first event.

• containerdApache-2.0 CNCF container runtime under Kubernetes

  Free / OSS · Apache-2.0 · 21.4k GitHub stars

  VerdictThe runtime you are probably already using — interact with it through Kubernetes, nerdctl or Docker.

  CatchIt is a low-level daemon, not a developer tool: you drive it through Kubernetes, nerdctl or Docker rather than directly, and its own ctr CLI is meant for debugging. Vs docker (the full developer experience on top): reach for containerd directly only when building platforms or nodes.

• etcdApache-2.0 Raft key-value store underneath Kubernetes

  Free / OSS · Apache-2.0 · 52.4k GitHub stars

  VerdictThe proven store for cluster coordination and config — keep it small and run it as a proper cluster.

  CatchIt is built for small, strongly consistent data, not as a message queue, cache or bulk store: values and total database size are meant to stay small, and every write goes through consensus. Production means running a cluster of three or five nodes on fast disks and handling backups, compaction and defragmentation yourself. For an app database, use Postgres; reach for etcd when you need coordination.

• CloudNativePGApache-2.0 Kubernetes operator for PostgreSQL clusters

  Free / OSS · Apache-2.0 · 9.5k GitHub stars

  VerdictThe best way to run Postgres on Kubernetes, if you must run Postgres on Kubernetes.

  CatchRunning stateful databases on Kubernetes is only a good idea if your team already runs Kubernetes well; storage class and node failures become database problems. Backups still need testing. Commercial support comes from third parties listed in the project.

More with this tag (7)

• Pixie — Apache-2.0 eBPF in-cluster observability for Kubernetes
• Odigos — Apache-2.0 distributed tracing without code changes
• HolmesGPT — Apache-2.0 CNCF AI agent for production incidents
• Kubetail — Apache-2.0 real-time log dashboard for Kubernetes workloads
• Versus Incident — MIT self-hosted incident platform with AI SRE agent
• kubernetes-mcp-server — Apache-2.0 MCP server that talks to the Kubernetes API directly
• Istio — Apache-2.0 CNCF service mesh for Kubernetes: mTLS, traffic routing and telemetry, with or without sidecars