Cloud-Native Landscape (CNCF)#

Reference of the major cloud-native projects, CNCF-graduated, incubating, sandbox, and key adjacent OSS that operators meet in production Kubernetes / cloud stacks.

For Kubernetes itself, see Orchestration. For service meshes, see Service Mesh. For GitOps delivery, see GitOps.

CNCF Graduated#

Project

Notes

Kubernetes

orchestrator; the foundation.

Prometheus

time-series monitoring.

Envoy

L7 proxy / data plane.

CoreDNS

DNS server; Kubernetes default.

containerd

high-level container runtime.

CRI-O

OpenShift container runtime.

etcd

distributed key-value store; Kubernetes backend.

Fluentd / Fluent Bit

log collection / forwarding.

Helm

Kubernetes package manager.

Istio

service mesh.

Linkerd

service mesh.

Cilium

eBPF networking + service mesh.

Argo (CD / Workflow

s / Rollouts / Events) GitOps + workflow.

Flux

GitOps controller.

Open Policy Agent ( OPA)

policy engine.

Falco

runtime security; eBPF.

Harbor

registry.

Vitess

MySQL sharding / scale-out.

TUF

secure software update framework.

Notary

container content trust.

TiKV

distributed KV (CockroachDB-style).

SPIFFE / SPIRE

workload identity.

Jaeger

distributed tracing.

OpenTelemetry

observability framework (metrics / logs / traces / profiles).

Rook

storage operator (Ceph).

NATS

messaging system.

CloudEvents

event-spec.

gRPC

RPC framework.

WasmEdge

WebAssembly runtime.

Buildpacks

OCI image builds without Dockerfiles.

Cert-Manager

X.509 / ACME automation.

Backstage

developer portal (Spotify).

Crossplane

Kubernetes-native cloud provisioning.

Karmada

multi-cluster management.

Kyverno

policy engine (YAML-based).

KubeVirt

VMs on Kubernetes.

KubeEdge

edge K8s.

Open Telemetry

observability framework.

Litmus

chaos engineering.

CNCF Incubating (selection)#

Project

Notes

Argo Rollouts

progressive delivery.

Crossplane

cloud provisioning.

Karmada

multi-cluster.

Kyverno

policy.

KubeEdge

edge K8s.

KubeVirt

VMs in K8s.

KEDA

event-driven autoscaling.

Knative

serverless on K8s.

Karpenter

node provisioner (AWS-led).

LongHorn

cloud-native block storage.

Strimzi

Kafka operator.

Tekton

CI/CD pipelines.

Buildpacks

OCI image builds.

OpenFeature

feature flags.

OpenKruise

workload primitives.

OpenServiceMesh

archived 2023.

Volcano

batch scheduling on K8s.

Cluster API

K8s cluster lifecycle (declarative).

Cluster API Provide

r AWS / Azure / GCP / Metal3 / vSphere / etc.

Antrea

K8s CNI (Open vSwitch).

Submariner

K8s multi-cluster networking.

SchemaHero

DB schema migrations on K8s.

in-toto

supply-chain attestation.

CNCF Sandbox / adjacent (selection)#

Project

Notes

Fortify NIST PQC

PQ algorithms.

KubeFlow

ML platform on K8s.

Pixie

eBPF observability.

Hubble (Cilium)

network observability.

Inspektor Gadget

eBPF debugging.

Pinniped

K8s auth.

External-DNS

DNS sync from K8s.

External-Secrets

secret sync from cloud KMS to K8s.

sealed-secrets

encrypted secrets in Git.

SOPS

Mozilla; secret encryption tool.

Headlamp

K8s UI (Kinvolk).

K9s

K8s terminal UI.

kubectx / kubens

context switching.

stern

multi-pod log tail.

kubevip

VIP for K8s control plane.

metallb

bare-metal LB.

ngrok / cloudflared

/ tailscale / chisel tunnels.

Ondat / OpenEBS / L

ongHorn / Rook storage.

Service mesh / traffic#

Project

Notes

Istio

feature-leader; Ambient mode (no per-pod sidecar).

Linkerd

minimalist; Rust data plane.

Cilium Service Mesh

eBPF-only; no sidecar.

Consul Connect

HashiCorp; multi-platform.

Kuma

Kong-backed.

AWS App Mesh

AWS managed.

GCP Anthos Service Mesh

Istio-flavoured.

Azure Open Service Mesh

AKS-only.

Container runtimes#

Runtime

Notes

containerd

the default high-level runtime; CNCF-graduated.

CRI-O

lightweight K8s-only.

Docker Engine

legacy in K8s; still standard for local dev.

Podman

Red Hat; daemonless rootless.

nerdctl

docker-compat CLI for containerd.

runc

reference low-level OCI runtime.

crun

C OCI runtime; faster startup.

runsc / gVisor

sandboxed runtime; user-space kernel.

kata-containers

VM-isolated runtime (Firecracker / QEMU).

youki

Rust runc reimplementation.

GitOps / progressive delivery#

Tool

Notes

Argo CD

dominant GitOps controller.

Flux v2

alternative GitOps.

Argo Rollouts

progressive delivery (canary, blue/green).

Flagger

progressive delivery (Flux-side).

Kargo

multi-stage promotion.

PipeCD

progressive delivery from CyberAgent.

CI / build#

Tool

Notes

Tekton

Kubernetes-native pipelines.

Argo Workflows

generic workflow engine.

Jenkins X

cloud-native Jenkins.

Drone

lightweight CI.

Concourse

pipeline-as-code.

GoCD

ThoughtWorks.

GitHub Actions

SaaS; broad market share.

GitLab CI

integrated with GitLab.

CircleCI

SaaS.

Buildkite

SaaS, agent-on-prem.

Earthly

build framework w/ container semantics.

Dagger

programmable CI in code (Go / Python / TS).

Kaniko

containerised image builds (no Docker daemon).

Buildpacks (CNB)

OCI image build w/o Dockerfile.

Observability stack#

Component

Notes

Prometheus

metrics collection.

Cortex / Mimir

horizontally-scalable Prometheus.

VictoriaMetrics

Prometheus-compat alt.

Thanos

Prometheus federation + long-term storage.

Loki (Grafana)

Prometheus-style log aggregation.

Tempo (Grafana)

distributed tracing backend.

Pyroscope (Grafana)

continuous profiling.

Jaeger

distributed tracing (CNCF).

Zipkin

older tracing.

OpenTelemetry

SDK + collector + protocol; the convergent standard.

Grafana

dashboard UI.

Kibana

Elastic UI.

Elastic Stack (ELK)

alt log stack.

OpenSearch

Elastic fork (AWS).

Fluentd / Fluent Bi

t log shipping.

Vector (Datadog)

log shipping in Rust.

Beats (Elastic)

log / metric shippers.

Telegraf (Influx)

metrics shipper.

Pixie

eBPF observability.

Datadog, New Relic,

Honeycomb, Splunk, Dynatrace, AppDynamics commercial.

Storage#

Project

Notes

Rook (Ceph)

CNCF; Ceph operator for K8s.

LongHorn

Rancher; cloud-native block.

OpenEBS

container-attached storage.

Portworx

commercial.

PureCSI / NetApp Tr ident

vendor CSI drivers.

MinIO

S3-compatible object store.

Velero

backup / DR for K8s.

Litmus

chaos.

Identity & policy#

Project

Notes

SPIFFE / SPIRE

workload identity.

Cert-Manager

X.509 automation.

Vault (Hashi)

secret + cert management.

External Secrets

sync from cloud secret managers.

Sealed Secrets

in-Git encrypted secrets.

SOPS

Mozilla; encrypted YAML / JSON.

OPA / Gatekeeper

policy engine.

Kyverno

YAML-native policy.

Pinniped

K8s auth.

Dex

OIDC IdP.

Keycloak

enterprise IAM.

Operator notes#

  • CNCF graduation is the strongest signal that a project has production-grade governance + adoption; “incubating” means broadly-used but moving fast; “sandbox” means experimental.

  • OpenTelemetry has converged most observability vendors on a single SDK + protocol; Prometheus / Jaeger / Zipkin remain backends.

  • Sidecar-less mesh, Istio Ambient + Cilium SM eliminate per-pod proxy overhead at the cost of feature trade-offs.

  • GitOps default, Argo CD has the largest install base; Flux is the modular alternative.

  • Bottlerocket / Talos / Flatcar, immutable container- optimized host OSes are the modern node default.

  • eBPF, Cilium / Falco / Pixie / Tetragon / Hubble all built on eBPF; replacing iptables / kube-proxy / IDS rules.

References#