OpenKubes
Platform v0.12.0 — Community Preview
A framework for building sovereign Kubernetes platform distributions.
OpenKubes owns the contracts, not the components.
Contracts-firstTalosCluster API CrossplaneBare Metal · Edge · CloudAI / GPU
github.com/openkubes/openkubes
1 / 10

The Problem with Platform Sprawl

⏱️

Days to provision

Manual steps, scripts, tribal knowledge. Cluster setup is slow and error-prone.

🔒

No self-service

Teams wait for ops to provision infrastructure. No API, no automation, no guardrails.

🧩

VMs and K8s in silos

Virtual machines and Kubernetes clusters managed separately with different tools.

❓

No verifiable guarantees

"Is the platform actually working?" — no deterministic, testable proof of readiness.

↓

✅ OpenKubes: capability contracts + deterministic gates

A cluster isn't "provisioned" until its contract test passes. make new CLUSTER=ok-ai TYPE=talos

2 / 10

How It Works — the capability chain

1

Capability

What every cluster must provide

→
2

Contract

Stable guarantees, fixed in an ADR

→
3

Impl. Profile

The reference implementation

→
4

Provider Values

Per-cluster configuration

→
5

Contract Test ✅

Readiness gate — pass/fail

# Provision a Talos workload cluster
make new CLUSTER=ok-ai TYPE=talos WORKERS=2
make bootstrap CLUSTER=ok-ai   → CAPI/CAPK + Talos, Cilium ✅
make install-storage CLUSTER=ok-ai
make install-observability CLUSTER=ok-ai   → contract gate green ✅
3 / 10

Platform Architecture

🧠 Management (ok-mgmt)

  • Talos mgmt cluster
  • Crossplane + provider-helm v0.19.0
  • Cluster API + CAPK v0.11.2
  • function-go-templating v0.9.0
  • cert-manager

⚙️ Infrastructure (host)

  • RKE2 host cluster
  • KubeVirt v1.8.1
  • CDI v1.60.0
  • MetalLB (LB IPs)
  • ok-storage (Longhorn v1)

☸️ Workload Zone

  • Talos K8s clusters
  • Cilium CNI
  • Observability (Prom/Grafana/OpenSearch)
  • AI / GPU (Ollama + Open WebUI)
  • local-path storage

📜 Capability Contracts

  • ok-linux — OS
  • ok-cluster — Lifecycle
  • ok-storage — Persistent Storage
  • ok-observability — ADR-018
  • ok-gitops — planned
Contract-first — 23 platform ADRs, three-way-reviewed, human-merged. XRDs: OpenWebUIClaim, KubeVirtClusterClaim.
4 / 10

Live Demo

From zero to a contract-verified cluster
ok-cluster/
❯ make new CLUSTER=ok-ai TYPE=talos WORKERS=2
[new] scaffolding Talos cluster 'ok-ai'...
ok-ai  rendered ✓

❯ make bootstrap CLUSTER=ok-ai
[bootstrap] CAPI/CAPK + Talos, installing Cilium...
ok-ai  3 nodes Ready ✓

❯ make install-observability CLUSTER=ok-ai
[observability] ok-observability-standard + contract test...
5/5 contract guarantees PASS ✅ gate green

❯ make register-cluster CLUSTER=ok-ai
[register] kubeconfig secret + ProviderConfig (ADR-013) ✅
✅

Talos control plane + workers

Immutable, API-driven

✅

Cilium CNI + MetalLB

Installed automatically, dedicated LB IP

✅

Observability contract PASS

Metrics, logs, dashboards, alerts

✅

Registered with ok-mgmt

Crossplane-ready (ADR-013)

✅

Air-gap capable

No management-cluster SPOF

✅

Clean teardown

Cluster, PVs, secrets — idempotent

5 / 10

Observability — the Contract Gate

1

Metrics

ServiceMonitor ingestion in Prometheus

·
2

Dashboards

Grafana pre-provisioned

·
3

Logs

Searchable in OpenSearch

·
4

Alerting

Delivered to a receiver

·
5

Autonomy

Air-gap, no SPOF

# Gated install — fails unless all five guarantees pass
make install-observability CLUSTER=ok-ai
→ 5/5 contract guarantees PASS ✅  (proven on ok-shared + ok-robotics)
ADR-Platform-018 · per-cluster Prometheus / Grafana / OpenSearch · delivered in v0.12.0 · "a cluster is not provisioned until its contract test passes"
6 / 10

Contract-first, human-merged

Three-way review — AI argues, humans decide.
AI may analyze, propose, implement, and argue.
Only humans approve and merge.

👤 Author

  • Anyone proposes on a branch
  • ADR or change
  • No direct write to main

🤖 Claude & GPT review

  • Internal consistency
  • Missing counter-arguments
  • Cross-ADR checks — advisory only

✅ Human merge

  • Maintainer holds context
  • Makes the final call
  • Branch protection enforced
Repository harness (OK-100, adopted): AGENTS.md + deterministic make verify / conformance / evidence — the sensors caught real defects and let an agent self-correct, while the ownership boundary held.
7 / 10

What's Next

v0.12.0 — Now ✅

Delivered

  • 23 platform ADRs (contract-first)
  • Talos + Cilium cluster lifecycle
  • Storage (Longhorn v1)
  • Observability + contract gate (ADR-018)
  • Gated make install-observability
  • Crossplane AI platform (Open WebUI)
  • Repo harness (verify/conformance/evidence)
Future

Vision

  • Immortal Platform — self-healing, RPO=0 (OK-30)
  • OpenKubes Anywhere — EKS/AKS/GKE (OK-24)
  • Robotics fleets — Open-RMF (ADR-019)
  • Bare metal — Metal3 (OK-19)
8 / 10

OpenKubes Anywhere

One platform. Any environment. Same contracts.

🏭 On-Premises

  • Bare Metal (Metal3, roadmap)
  • KubeVirt VMs
  • Air-gapped
  • Sovereign Cloud

☁️ Public Cloud

  • AWS EKS
  • Azure AKS
  • Google GKE (roadmap)
  • Same capability contracts

🤖 Industrial Edge

  • Factory sites
  • Open-RMF / ROS2
  • AI / GPU nodes
  • Constrained edge profile

🔧 Unified Ops

  • Same make interface
  • Same GitOps workflow
  • Same platform ADRs
  • Same Day-2 ops
Hybrid & multi-cloud on one contract set (OK-24) · "Git is the contract, Kubernetes is the enforcer."
9 / 10
OpenKubes

Get Started

Open Source · Apache 2.0 · Community Preview · v0.12.0
# Provision a Talos clustermake new CLUSTER=ok-ai TYPE=talos WORKERS=2
# Bootstrap + CNImake bootstrap CLUSTER=ok-ai
# Observability (gated contract test)make install-observability CLUSTER=ok-ai
⭐ github.com/openkubes/openkubes
Built with ❤️ by Kubernauts · kubernauts.de