Cloud-Native Landscape (CNCF)#
Reference of the major cloud-native projects, CNCF-graduated, incubating, sandbox, and key adjacent OSS that operators meet in production Kubernetes / cloud stacks.
For Kubernetes itself, see Orchestration. For service meshes, see Service Mesh. For GitOps delivery, see GitOps.
CNCF Graduated#
Project |
Notes |
|---|---|
Kubernetes |
orchestrator; the foundation. |
Prometheus |
time-series monitoring. |
Envoy |
L7 proxy / data plane. |
CoreDNS |
DNS server; Kubernetes default. |
containerd |
high-level container runtime. |
CRI-O |
OpenShift container runtime. |
etcd |
distributed key-value store; Kubernetes backend. |
Fluentd / Fluent Bit |
log collection / forwarding. |
Helm |
Kubernetes package manager. |
Istio |
service mesh. |
Linkerd |
service mesh. |
Cilium |
eBPF networking + service mesh. |
Argo (CD / Workflow |
s / Rollouts / Events) GitOps + workflow. |
Flux |
GitOps controller. |
Open Policy Agent ( OPA) |
policy engine. |
Falco |
runtime security; eBPF. |
Harbor |
registry. |
Vitess |
MySQL sharding / scale-out. |
TUF |
secure software update framework. |
Notary |
container content trust. |
TiKV |
distributed KV (CockroachDB-style). |
SPIFFE / SPIRE |
workload identity. |
Jaeger |
distributed tracing. |
OpenTelemetry |
observability framework (metrics / logs / traces / profiles). |
Rook |
storage operator (Ceph). |
NATS |
messaging system. |
CloudEvents |
event-spec. |
gRPC |
RPC framework. |
WasmEdge |
WebAssembly runtime. |
Buildpacks |
OCI image builds without Dockerfiles. |
Cert-Manager |
X.509 / ACME automation. |
Backstage |
developer portal (Spotify). |
Crossplane |
Kubernetes-native cloud provisioning. |
Karmada |
multi-cluster management. |
Kyverno |
policy engine (YAML-based). |
KubeVirt |
VMs on Kubernetes. |
KubeEdge |
edge K8s. |
Open Telemetry |
observability framework. |
Litmus |
chaos engineering. |
CNCF Incubating (selection)#
Project |
Notes |
|---|---|
Argo Rollouts |
progressive delivery. |
Crossplane |
cloud provisioning. |
Karmada |
multi-cluster. |
Kyverno |
policy. |
KubeEdge |
edge K8s. |
KubeVirt |
VMs in K8s. |
KEDA |
event-driven autoscaling. |
Knative |
serverless on K8s. |
Karpenter |
node provisioner (AWS-led). |
LongHorn |
cloud-native block storage. |
Strimzi |
Kafka operator. |
Tekton |
CI/CD pipelines. |
Buildpacks |
OCI image builds. |
OpenFeature |
feature flags. |
OpenKruise |
workload primitives. |
OpenServiceMesh |
archived 2023. |
Volcano |
batch scheduling on K8s. |
Cluster API |
K8s cluster lifecycle (declarative). |
Cluster API Provide |
r AWS / Azure / GCP / Metal3 / vSphere / etc. |
Antrea |
K8s CNI (Open vSwitch). |
Submariner |
K8s multi-cluster networking. |
SchemaHero |
DB schema migrations on K8s. |
in-toto |
supply-chain attestation. |
CNCF Sandbox / adjacent (selection)#
Project |
Notes |
|---|---|
Fortify NIST PQC |
PQ algorithms. |
KubeFlow |
ML platform on K8s. |
Pixie |
eBPF observability. |
Hubble (Cilium) |
network observability. |
Inspektor Gadget |
eBPF debugging. |
Pinniped |
K8s auth. |
External-DNS |
DNS sync from K8s. |
External-Secrets |
secret sync from cloud KMS to K8s. |
sealed-secrets |
encrypted secrets in Git. |
SOPS |
Mozilla; secret encryption tool. |
Headlamp |
K8s UI (Kinvolk). |
K9s |
K8s terminal UI. |
kubectx / kubens |
context switching. |
stern |
multi-pod log tail. |
kubevip |
VIP for K8s control plane. |
metallb |
bare-metal LB. |
ngrok / cloudflared |
/ tailscale / chisel tunnels. |
Ondat / OpenEBS / L |
ongHorn / Rook storage. |
Service mesh / traffic#
Project |
Notes |
|---|---|
Istio |
feature-leader; Ambient mode (no per-pod sidecar). |
Linkerd |
minimalist; Rust data plane. |
Cilium Service Mesh |
eBPF-only; no sidecar. |
Consul Connect |
HashiCorp; multi-platform. |
Kuma |
Kong-backed. |
AWS App Mesh |
AWS managed. |
GCP Anthos Service Mesh |
Istio-flavoured. |
Azure Open Service Mesh |
AKS-only. |
Container runtimes#
Runtime |
Notes |
|---|---|
containerd |
the default high-level runtime; CNCF-graduated. |
CRI-O |
lightweight K8s-only. |
Docker Engine |
legacy in K8s; still standard for local dev. |
Podman |
Red Hat; daemonless rootless. |
nerdctl |
docker-compat CLI for containerd. |
runc |
reference low-level OCI runtime. |
crun |
C OCI runtime; faster startup. |
runsc / gVisor |
sandboxed runtime; user-space kernel. |
kata-containers |
VM-isolated runtime (Firecracker / QEMU). |
youki |
Rust runc reimplementation. |
GitOps / progressive delivery#
Tool |
Notes |
|---|---|
Argo CD |
dominant GitOps controller. |
Flux v2 |
alternative GitOps. |
Argo Rollouts |
progressive delivery (canary, blue/green). |
Flagger |
progressive delivery (Flux-side). |
Kargo |
multi-stage promotion. |
PipeCD |
progressive delivery from CyberAgent. |
CI / build#
Tool |
Notes |
|---|---|
Tekton |
Kubernetes-native pipelines. |
Argo Workflows |
generic workflow engine. |
Jenkins X |
cloud-native Jenkins. |
Drone |
lightweight CI. |
Concourse |
pipeline-as-code. |
GoCD |
ThoughtWorks. |
GitHub Actions |
SaaS; broad market share. |
GitLab CI |
integrated with GitLab. |
CircleCI |
SaaS. |
Buildkite |
SaaS, agent-on-prem. |
Earthly |
build framework w/ container semantics. |
Dagger |
programmable CI in code (Go / Python / TS). |
Kaniko |
containerised image builds (no Docker daemon). |
Buildpacks (CNB) |
OCI image build w/o Dockerfile. |
Observability stack#
Component |
Notes |
|---|---|
Prometheus |
metrics collection. |
Cortex / Mimir |
horizontally-scalable Prometheus. |
VictoriaMetrics |
Prometheus-compat alt. |
Thanos |
Prometheus federation + long-term storage. |
Loki (Grafana) |
Prometheus-style log aggregation. |
Tempo (Grafana) |
distributed tracing backend. |
Pyroscope (Grafana) |
continuous profiling. |
Jaeger |
distributed tracing (CNCF). |
Zipkin |
older tracing. |
OpenTelemetry |
SDK + collector + protocol; the convergent standard. |
Grafana |
dashboard UI. |
Kibana |
Elastic UI. |
Elastic Stack (ELK) |
alt log stack. |
OpenSearch |
Elastic fork (AWS). |
Fluentd / Fluent Bi |
t log shipping. |
Vector (Datadog) |
log shipping in Rust. |
Beats (Elastic) |
log / metric shippers. |
Telegraf (Influx) |
metrics shipper. |
Pixie |
eBPF observability. |
Datadog, New Relic, |
Honeycomb, Splunk, Dynatrace, AppDynamics commercial. |
Storage#
Project |
Notes |
|---|---|
Rook (Ceph) |
CNCF; Ceph operator for K8s. |
LongHorn |
Rancher; cloud-native block. |
OpenEBS |
container-attached storage. |
Portworx |
commercial. |
PureCSI / NetApp Tr ident |
vendor CSI drivers. |
MinIO |
S3-compatible object store. |
Velero |
backup / DR for K8s. |
Litmus |
chaos. |
Identity & policy#
Project |
Notes |
|---|---|
SPIFFE / SPIRE |
workload identity. |
Cert-Manager |
X.509 automation. |
Vault (Hashi) |
secret + cert management. |
External Secrets |
sync from cloud secret managers. |
Sealed Secrets |
in-Git encrypted secrets. |
SOPS |
Mozilla; encrypted YAML / JSON. |
OPA / Gatekeeper |
policy engine. |
Kyverno |
YAML-native policy. |
Pinniped |
K8s auth. |
Dex |
OIDC IdP. |
Keycloak |
enterprise IAM. |
Operator notes#
CNCF graduation is the strongest signal that a project has production-grade governance + adoption; “incubating” means broadly-used but moving fast; “sandbox” means experimental.
OpenTelemetry has converged most observability vendors on a single SDK + protocol; Prometheus / Jaeger / Zipkin remain backends.
Sidecar-less mesh, Istio Ambient + Cilium SM eliminate per-pod proxy overhead at the cost of feature trade-offs.
GitOps default, Argo CD has the largest install base; Flux is the modular alternative.
Bottlerocket / Talos / Flatcar, immutable container- optimized host OSes are the modern node default.
eBPF, Cilium / Falco / Pixie / Tetragon / Hubble all built on eBPF; replacing iptables / kube-proxy / IDS rules.