Skip to content
GitHub

Kuben — a Kubernetes PaaS in a single binary

Kuben 1.0 is out · read the announcement

A PaaS for your Kubernetes,
in one binary.

Kuben turns any cluster into a platform your team can actually use. Push an image, get an isolated environment with HTTPS, autoscaling, logs and rollbacks. One binary, no external database, everything a Kubernetes resource.

Get startedView on GitHub
curl -fsSL https://kuben.teamtem.com/install.sh | sh

On a fresh Linux server, as root: installs k3s if needed, sets Kuben up as a service and prints the link to the setup page. Checksums are verified before anything is installed; the same command upgrades.

1
binary, no external services
≤ 26 MiB
release binary, UI included
64 Mi
memory requested by the pod
5
platforms, checksummed and attested
What you get

Everything a small platform team would build, already built.

Kuben creates the Deployments, Services, autoscalers and HTTPS routes for you and keeps them in sync. You keep the cluster, the data and the choice of tooling.

Isolated environments

Projects hold environments, environments hold apps. Every environment is its own namespace with resource quotas and a NetworkPolicy, so staging can never reach production.

Deploy any image

Point at a container image and get a zero-downtime rollout with readiness and startup probes, autoscaling, environment variables and write-only secrets.

Day-2 operations built in

Logs, restarts, numbered releases with one-click rollback, promotion between environments with a diff preview, persistent volumes and cron jobs.

Custom domains, automatic HTTPS

Gateway API routes plus cert-manager certificates. One listener per hostname, HTTP redirected to HTTPS, and a domain can belong to exactly one app.

Teams, tokens and an audit log

Four roles that form a strict ladder, API tokens capped at a role and scoped to a project or environment, and an append-only record of every change and every denial.

GitOps-friendly by design

Projects, environments, apps and releases are Kubernetes custom resources. kubectl, Argo CD and Flux work next to the UI, not against it.

How it works

Three steps from a cluster to a platform.

1

Install

One Helm release inside the cluster, or one binary on a server next to k3s. kuben doctor checks the prerequisites.

2

Model

Create a project and its environments, invite the team with roles, and mint a scoped API token for CI.

3

Ship

Deploy from the UI or PATCH the image from a pipeline. Kuben reconciles the workload, the route and the certificate.

Console or REST API
api · controller
Project · Environment · App · Release CRDs
Deployment · Service · HPA · HTTPRoute

The API reads from small in-memory projections, so it answers without talking to the API server. With PostgreSQL, several replicas serve the API and one of them, chosen through a Lease, runs the controllers. Read the concepts →

Secure by default

The boring parts are done properly.

Kuben's service account can manage every tenant namespace, so it is treated like an infrastructure controller: minimal image, minimal privileges, and a security model that is written down rather than implied.

Security model and its limits
  • Runs as a non-root user in a distroless image, with a read-only root filesystem and every capability dropped.
  • Session cookies are __Host- and Secure; API tokens are stored as SHA-256 hashes and compared in constant time.
  • Login throttling is shared by all replicas. Every mutation, denial and login is audited, never a request body.
  • Tenant namespaces enforce Pod Security “baseline”, forbid LoadBalancer and NodePort services and close ingress between environments.
  • Every release is checksummed, attested and scanned, and each binary carries its own dependency list for auditing in place.
One-click services

Databases and tools, with generated credentials.

Templates create the app, its volume and a <name>-credentials secret with a random password. Apps connect with DATABASE_URL=@db-credentials/url; no password ever appears in a spec, a release or the audit log.

PostgreSQL 17Redis 7MariaDB 11n8nUptime KumaVaultwardenGiteawhoamiAll templates →
Next

On the roadmap.

Git builds

Build from a repository with BuildKit, without an external CI.

Preview environments

A short-lived environment for every pull request.

Scale to zero

Idle apps stop; the first request wakes them.

Single sign-on

OIDC for teams that already have an identity provider.

Ready when your cluster is.

Apache-2.0. Built by Teamtem. Runs on k3s, kind, EKS, GKE and AKS.

Read the quickstart Star on GitHub
curl -fsSL https://kuben.teamtem.com/install.sh | sh

On a fresh Linux server, as root: installs k3s if needed, sets Kuben up as a service and prints the link to the setup page. Checksums are verified before anything is installed; the same command upgrades.