This project is a Kubernetes operator that implements a so-called health-check platform.

Canary checker is a monitoring tool that includes 35+ ready-to-use health checks for various Kubernetes workloads. It works as a K8s operator that has no dependencies and offers:

- checks for popular protocols (HTTP, DNS, ICMP, TCP), databases (SQL-based, MongoDB, Redis, Elasticsearch), infrastructure components (such as Kubernetes resources and EC2 instances), file systems (NFS, S3, SMB), and more;
- alert aggregation from Prometheus, AWS CloudWatch, and Dynatrace;
- integration testing support for JMeter, JUnit, K6, Newman and Playwright;
- Prometheus exporter replacement with custom metrics from the check’s results;
- built-in Web dashboard displaying existing checks and their stats.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 326 ⭐️

#tools #observability

Can luring random online attackers into your Kubernetes clusters be fun or even useful? At least, we have a tool to try it out with minimal effort.

Koney is a Kubernetes operator that implements so-called “deception policies” to discover and deter malicious users. Currently, it supports honeytokens as the only deception method by:

- creating fake “sensitive” files, such as /run/secrets/koney/service_token, in all selected Pods;
- monitoring the attempts to access them by collecting alerts from the Cilium’s Tetragon operator or via a smaller eBPF-powered file access monitoring tool (kivebpf);
- logging these events and, optionally, sending alerts to external systems (currently, it supports only Dynatrace).

Future project plans include adding other deceptive techniques (HTTP endpoints and payloads) and integrating the operator with Kyverno policies.

▶️ GitHub repo

Language: Go | License: AGPL 3.0 | 89 ⭐️

#tools #security

Upbound introduced Modelplane for AI inference

The company behind Crossplane, a CNCF project that graduated at the end of 2025, announced its new Open Source project called Modelplane. The CNCF's CTO already mentioned on LinkedIn that this project would be a great fit for CNCF.

Basically, Modelplane is a control plane for AI inference built on Crossplane, which allows you to run any model on any serving engine on any infrastructure. Here's its brief description from the official announcement:

Modelplane sits above your inference clusters and operates them as one inference platform, reconciling the whole fleet toward the state you declare. It does for the fleet what Kubernetes does for the cluster: platform teams and developers describe what they want as Kubernetes resources, and Modelplane composes the clusters, places the models, and exposes the endpoints to match.

Additional resources include the getting started documentation and the GitHub repo.

#news #tools #aiml

William Rizzo, a CNCF Ambassador and Global Field CTO at Mirantis, announced his project, KubeSwift, which provides Kubernetes-native VM orchestration on Cloud Hypervisor.

Here’s the idea behind KubeSwift: “KubeSwift runs virtual machines as Kubernetes workloads. You define a VM with a custom resource; controllers reconcile it into a Pod; inside that Pod, swiftletd launches a hypervisor.” (Cloud Hypervisor, on which this project relies, is a VMM (Virtual Machine Monitor) for cloud workloads written in Rust.)

While still being in the pre-1.0 state, KubeSwift already supports disk boot from cloud images and direct kernel boot from OCI artifacts, Multus and OVN-Kubernetes for networking, exposing guest ports as Kubernetes Services, GPU passthrough, disk snapshots, offline and live migrations, managing fleets of identical VMs, swiftctl CLI tool for lifecycle management and operations, and many other features.

▶️ GitHub repo

Language: Go | License: AGPL 3.0 | 18 ⭐️

#news #tools #virtualisation

Thought of running agents on Kubernetes more efficiently? Here’s a project from Google that you might find useful.

Agent Substrate is an experimental system for running agents and similar workloads on Kubernetes at scale, providing specialised scheduling and controls to improve scalability and reduce latency. It relies on Kubernetes Pods and Pod autoscaling (but not K8s control plane) and manages the lifecycle of "actors" (agents or similar apps): creating and destroying them, assigning them to Pods, and routing traffic to them. It handles OCI containers at the kernel level via gVisor, so it can work with apps that are built on any stack.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 912 ⭐️

#tools

Another kube-oidc-proxy fork is alive, featuring multi-issuer authentication to managed Kubernetes clusters.

This new project, created by Rafal Pieniazek, implements a reverse proxy that enables authentication from multiple OIDC issuers at once to your managed K8s clusters, such as EKS, GKE, and AKS. To achieve this, the proxy sits in front of the API server, validates the bearer token against required OIDC issuers, and maps the token's claims to a Kubernetes identity. Then, impersonated headers for the mapped user are added, so that existing RBAC stays authoritative.

P.S. This project originates from kube-oidc-proxy by Tremolo Security, which itself is an active fork of the eponymous project by Jetstack.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 17 ⭐️

#tools #security

We all know (and many of us use daily) k9s as a truly flagship CLI tool for Kubernetes. But what if someone were to reimagine it today?

Meet sofka, which reimplements a well-known tool using one generic object pipeline (instead of separate structs for each resource type) and Rust. It performs better and offers lots of features you might need, including:

- Powerful keyboard-based navigation with curated columns, custom views, drill-down navigation, horizontal scrolling, global fuzzy find, compact mode, and mouse support.
- Powerful metrics and health support, covering Pod health, live CPU and memory values, workload health at a glance, evidence-based explanation for unhealthy resources, hierarchical Xray view, watch notifications, and more.
- Extended diagnostic capabilities with incident bundles and snapshots capturing the current table view.
- Embedded Helm and GitOps integration.
- Various executable actions, such as file transfers, debugging containers and Pods, exploring PVC contents, and right-sizing requests.

What makes it different from k9s? Built-in Flux CD and Argo CD support, port-forwarding running in the background, bulk actions with multiselect, skins (12 are available), and more.

▶️ GitHub repo
 
Language: Rust | License: Apache 2.0 and MIT | 672 ⭐️

#tools #CLI

Skaffold ceases to exist

Skaffold is a CLI tool from Google designed for local development of Kubernetes applications. It has been around since 2018. According to the Slack announcement posted last month, the project won't be maintained anymore, and its GitHub repo will be archived starting January 15, 2027.

#tools #news

Agent Orca, a Kubernetes-native platform for managing AI agents

A few days ago, Matthew Fisher, solutions architect at NVIDIA, announced an Open Source project called Agent Orca. It's a platform for deploying, managing, and running AI agents in Kubernetes at scale. It allows you to use K8s resources to "declaratively define agents, route them to the correct LLM, equip them with tools, and execute them as one-off jobs or long-running services with checkpoints, cost tracking, guardrails, and RAG built in."

There's a quick-start manual for giving Agent Orca a try, seven demos, and quite extensive documentation for both developers and operators.

▶️ GitHub repo
 
Language: Go | License: Apache 2.0 | 61 ⭐️

#news #tools #aiml

Migrating virtual machines from your older infrastructure to Kubernetes? There's a helpful tool to facilitate this process.

Forklift was created specifically to migrate various virtual machines to KubeVirt. The project originated in Red Hat for its OpenShift Virtualization, but then it became a community effort for wider adoption. What it supports:

- migrating VMs from VMware vSphere, Open Virtual Appliances (OVAs), oVirt, OpenStack, Nutanix, Microsoft Hyper-V, and KubeVirt;
- warm migrations for VMware vSphere and oVirt (using CBT snapshots/incremental backup), hot migrations for KubeVirt (v4.20+);
- migrations to remote clusters;
- custom hooks to perform operations on VMs before and after migration;
- validation rules based on Open Policy Agent (OPA) to check VM migration suitability.

▶️ GitHub repo

Language: Go | License: Apache 2.0 | 198 ⭐️

#tools #virtualisation