DevOps 路 CNCF Landscape category
Provisioning
9 CNCF project briefs in this category, newest first: Key Management, Automation & Configuration, Container Registry, Security & Compliance.
Key Management 2
- Athenz: Service Identity and Fine-Grained Authorization with X.509 CertificatesA platform that gives every workload a short-lived X.509 identity and decides, through roles and policies, which services may do what to which resources.
SPIRE: Workload Identity and Key Issuance with SPIFFEThe reference implementation of the SPIFFE standard, which attests workloads and issues them short-lived X.509 and JWT identities so services can authenticate each other without shared secrets.
Automation & Configuration 2
- Cloud Custodian: Governance as Code for AWS, Azure and Google CloudA rules engine that finds cloud resources matching YAML policies and acts on them, for security, compliance and cost control across accounts and providers.
OpenTofu: Open-Source Infrastructure as CodeA community-governed, Terraform-compatible tool that provisions cloud and platform infrastructure from declarative HCL, with client-side state encryption and ephemeral values.
Container Registry 2
- Dragonfly: Peer-to-Peer Distribution for Container Images and AI ModelsA peer-to-peer file distribution system that lets nodes share container image layers and large files with each other, cutting registry load and speeding up pulls at scale.
Harbor: An Enterprise-Grade Container and Artifact RegistryA self-hosted registry for container images and OCI artifacts with role-based access control, vulnerability scanning, image signing, replication and proxy caching.
Security & Compliance 3
- Falco: Runtime Threat Detection for Containers and KubernetesA runtime security engine that watches Linux system calls and cloud event streams, matches them against rules, and alerts in real time when a container or host behaves suspiciously.
- Kyverno: Kubernetes-Native Policy as CodeA policy engine that validates, mutates, generates and cleans up Kubernetes resources, and verifies image signatures, using policies written in YAML or CEL instead of a separate policy language.
cert-manager: Automated X.509 Certificates for KubernetesA Kubernetes controller that requests, issues and renews TLS certificates from Let's Encrypt, Vault, private CAs and cloud services, and stores them as Secrets that workloads and gateways can use.
No briefs match these filters.