Kubescape is an open-source Kubernetes security platform. It includes risk analysis, security compliance, and misconfiguration scanning. Targeted at the DevSecOps practitioner or platform engineer, it offers an easy-to-use CLI interface, flexible output formats, and automated scanning capabilities. It saves Kubernetes users and admins precious time, effort, and resources.
Kubescape scans clusters, YAML files, and Helm charts. It detects misconfigurations according to multiple frameworks (including&nbsp;<a href="https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo/?utm_source=github&amp;utm_medium=repository" target="_blank" rel="noopener">NSA-CISA</a>,&nbsp;<a href="https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/" target="_blank" rel="noopener">MITRE ATT&amp;CK </a>and the&nbsp;<a href="https://www.armosec.io/blog/cis-kubernetes-benchmark-framework-scanning-tools-comparison/?utm_source=github&amp;utm_medium=repository" target="_blank" rel="noopener">CIS Benchmark</a>).
Kubescape uses&nbsp;<a href="https://github.com/open-policy-agent/opa" target="_blank" rel="noopener">Open Policy Agent</a>&nbsp;to verify Kubernetes objects against&nbsp;<a href="https://github.com/kubescape/regolibrary" target="_blank" rel="noopener">a library of posture controls</a>. By default, the results are printed in a console but they can be exported to JSON and PDF.
Kubescape is running the following tests according to what is defined by Kubernetes Hardening Guidance by NSA and CISA.
<ul>
<li>Non-root containers</li>
<li>Immutable container filesystem</li>
<li>Privileged containers</li>
<li>hostPID, hostIPC privileges</li>
<li>hostNetwork access</li>
<li>allowedHostPaths field</li>
<li>Protecting pod service account tokens</li>
<li>Resource policies</li>
<li>Control plane hardening</li>
<li>Exposed dashboard</li>
<li>Allow privilege escalation</li>
<li>Applications credentials in configuration files</li>
<li>Cluster-admin binding</li>
<li>Exec into container</li>
<li>Dangerous capabilities</li>
<li>Insecure capabilities</li>
<li>Linux hardening</li>
</ul>

An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters.



Kubescape - An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters

Docker is a mini-Heroku, the smallest PaaS implementation you've ever seen. Dokku helps you build and manage the lifecycle of applications.

Dokku - A docker-powered PaaS that helps you build and manage the lifecycle of applications

Bytebase is a web-based, zero-config, dependency-free database schema change and version control management tool for developers and DBAs. It is for developers to collaborate on database schemas changes. It helps to construct a single pipeline to propagate the schema change across multiple environments. It can also store the schemas in VCS and trigger a new pipeline upon commit push. 
 
Developers first submit their SQL statement for DBA to review. After review is approved, the SQL statement will then be applied to the corresponding database. "Version controlled schema" aka "Database-as-code" is a practice to store the database schema in a version control system (VCS) just like how application code is stored. The database schema consists of a bunch of database migration scripts.

Bytebase is a web-based, zero-config, dependency-free database schema change and version control management tool for developers and DBAs. It is for developers to collaborate on database schemas changes. It helps to construct a single pipeline to propagate the schema change across multiple environments. It can also store the schemas in VCS and trigger a new pipeline upon commit push. 

ByteBase - Web-based, zero-config, dependency-free database schema change and version control tool for teams

Dev Lake brings all your DevOps data into one practical, personalized, extensible view. Ingest, analyze, and visualize data from an ever-growing list of developer tools, with our free and open source product. Dev Lake is most exciting for leaders and managers looking to make better sense of their development data, though it's useful for any developer looking to bring a more data-driven approach to their own practices. With Dev Lake you can ask your process any question, just connect and query.
 
Dev Lake provides understanding of software development lifecycle, digging workflow bottlenecks, Timely review of team performance, Rapid feedback, Agile adjustment. It helps to quickly build scenario-based data dashboards and drill down to analyze the root cause of problems.
 
<div>What can be accomplished with Dev Lake?</div><div> </div><ol><li>Collect DevOps performance data for the whole process</li><li>Share abstraction layer with similar tools to output standardized performance data</li><li>Built-in 20+ performance metrics and drill-down analysis capability</li><li>Support custom SQL analysis and drag and drop to build scenario-based data views</li><li>Flexible architecture and plug-in design to support fast access to new data sources</li></ol>

Dev Lake brings all your DevOps data into one practical, personalized, extensible view. Ingest, analyze, and visualize data from an ever-growing list of developer tools, with our free and open source product. Dev Lake is most exciting for leaders and managers looking to make better sense of their development data, though it's useful for any developer looking to bring a more data-driven approach to their own practices. With Dev Lake you can ask your process any question, just connect and query.

Dev Lake -  Data lake for Dev

Deepfence ThreatMapper helps you to monitor and secure your running applications, in Cloud, Kubernetes, Docker, and Fargate Serverless. ThreatMapper scans your platforms and identifies pods, containers, applications, and infrastructure. Use ThreatMapper to discover the topology of your applications and attack surface. It obtains manifests of dependencies from running pods and containers, serverless apps, applications, and operating system. ThreatMapper matches these against vulnerability feeds to identify vulnerable components.
 
ThreatMapper discovers, annotates and displays the topology of your applications across multiple cloud environments. It ranks discovered vulnerabilities against CVSS and other severity scores, exploit method and proximity to attack surface, in order to identify which issues pose the greatest risk of exploit.

Deepfence ThreatMapper helps you to monitor and secure your running applications, in Cloud, Kubernetes, Docker, and Fargate Serverless. ThreatMapper scans your platforms and identifies pods, containers, applications, and infrastructure. Use ThreatMapper to discover the topology of your applications and attack surface. It obtains manifests of dependencies from running pods and containers, serverless apps, applications, and operating system. ThreatMapper matches these against vulnerability feeds to identify vulnerable components.

DeepFence - Identify vulnerabilities in running containers, images, hosts and repositories

Cabot is a free, open-source, self-hosted infrastructure monitoring platform that provides some of the best features of PagerDuty, Server Density, Pingdom and Nagios without their cost and complexity. 
 
It provides a web interface that allows you to monitor services (e.g. "Stage Redis server", "Production ElasticSearch cluster") and send telephone, sms or hipchat/email alerts to your on-duty team if those services start misbehaving or go down - all without writing a line of code. Best of all, you can use data that you're already pushing to Graphite/statsd to generate alerts, rather than implementing and maintaining a whole new system of data collectors.

Cabot is a free, open-source, self-hosted infrastructure monitoring platform that provides some of the best features of PagerDuty, Server Density, Pingdom and Nagios without their cost and complexity. 

Cabot - Self-hosted, easily-deployable monitoring and alerts service - like a lightweight PagerDuty

Pyroscope is an open source continuous profiling platform. It will help you Find performance issues in your code, Resolve issues with high CPU utilization, Understand the call tree of your application, Track changes over time. It can store years of profiling data from multiple applications. You can look at years of data at a time or zoom in on specific events. 

Pyroscope - Open Source Continuous Profiling Platform


Kubernetes has made it very easy to deploy applications to the cloud at a higher scale than ever, but the development practices have not evolved at the same speed as application deployment patterns. Today, most developers try to either run parts of the infrastructure locally, or just test these integrations directly in the cluster via CI jobs or the "docker build, docker push, kubectl apply" cycle. It works, but this workflow is painful and incredibly slow.

Okteto - A Tool for Cloud Native Developers

Apache APISIX is a dynamic, real-time, high-performance API gateway. APISIX provides rich traffic management features such as load balancing, dynamic upstream, canary release, circuit breaking, authentication, observability, and more. You can use Apache APISIX to handle traditional north-south traffic, as well as east-west traffic between services. It can also be used as a k8s ingress controller.
 
You can use Apache APISIX as a traffic entrance to process all business data, including dynamic routing, dynamic upstream, dynamic certificates, A/B testing, canary release, blue-green deployment, limit rate, defense against malicious attacks, metrics, monitoring alarms, service observability, service governance, etc.

Apache APISIX is a dynamic, real-time, high-performance API gateway. APISIX provides rich traffic management features such as load balancing, dynamic upstream, canary release, circuit breaking, authentication, observability, and more. You can use Apache APISIX to handle traditional north-south traffic, as well as east-west traffic between services. It can also be used as a k8s ingress controller.

Apache APISIX - Dynamic, real-time, high-performance API gateway

Educate and Empower software professionals in open source tools and technologies.

Projects