Isolated environments
Projects hold environments, environments hold apps. Every environment is its own namespace with resource quotas and a NetworkPolicy, so staging can never reach production.
Kuben — a Kubernetes PaaS in a single binary
Kuben 1.0 is out · read the announcementA PaaS for your Kubernetes,
A PaaS for your Kubernetes,
in one binary.
Kuben turns any cluster into a platform your team can actually use. Push an image, get an isolated environment with HTTPS, autoscaling, logs and rollbacks. One Rust binary, no external database, everything a Kubernetes resource.
helm install kuben oci://ghcr.io/teamtem-dev/charts/kuben --namespace kuben-system --create-namespace1
binary, no external services
≤ 26 MiB
release binary, UI included
64 Mi
memory requested by the pod
5
platforms, checksummed and attested
What you get
Everything a small platform team would build, already built.
Kuben creates the Deployments, Services, autoscalers and HTTPS routes for you and keeps them in sync. You keep the cluster, the data and the choice of tooling.
Deploy any image
Point at a container image and get a zero-downtime rollout with readiness and startup probes, autoscaling, environment variables and write-only secrets.
Day-2 operations built in
Logs, restarts, numbered releases with one-click rollback, promotion between environments with a diff preview, persistent volumes and cron jobs.
Custom domains, automatic HTTPS
Gateway API routes plus cert-manager certificates. One listener per hostname, HTTP redirected to HTTPS, and a domain can belong to exactly one app.
Teams, tokens and an audit log
Four roles that form a strict ladder, API tokens capped at a role and scoped to a project or environment, and an append-only record of every change and every denial.
GitOps-friendly by design
Projects, environments, apps and releases are Kubernetes custom resources. kubectl, Argo CD and Flux work next to the UI, not against it.
How it works
Three steps from a cluster to a platform.
1
Install
One Helm release inside the cluster, or one binary on a server next to k3s. kuben doctor checks the prerequisites.
2
Model
Create a project and its environments, invite the team with roles, and mint a scoped API token for CI.
3
Ship
Deploy from the UI or PATCH the image from a pipeline. Kuben reconciles the workload, the route and the certificate.
Console or REST API
kubenapi · controller
Project · Environment · App · Release CRDs
Deployment · Service · HPA · HTTPRoute
The API reads from small in-memory projections, so it answers without talking to the API server. With PostgreSQL, several replicas serve the API and one of them, chosen through a Lease, runs the controllers. Read the concepts →
Secure by default
The boring parts are done properly.
Kuben's service account can manage every tenant namespace, so it is treated like an infrastructure controller: minimal image, minimal privileges, and a security model that is written down rather than implied.
Security model and its limits- Runs as a non-root user in a distroless image, with a read-only root filesystem and every capability dropped.
- Session cookies are __Host- and Secure; API tokens are stored as SHA-256 hashes and compared in constant time.
- Login throttling is shared by all replicas. Every mutation, denial and login is audited, never a request body.
- Tenant namespaces enforce Pod Security “baseline”, forbid LoadBalancer and NodePort services and close ingress between environments.
- Every release is checksummed, attested and scanned, and each binary carries its own dependency list for auditing in place.
One-click services
Databases and tools, with generated credentials.
Templates create the app, its volume and a <name>-credentials secret with a random password. Apps connect with DATABASE_URL=@db-credentials/url; no password ever appears in a spec, a release or the audit log.
Next
On the roadmap.
Git builds
Build from a repository with BuildKit, without an external CI.
Preview environments
A short-lived environment for every pull request.
Scale to zero
Idle apps stop; the first request wakes them.
Single sign-on
OIDC for teams that already have an identity provider.
Ready when your cluster is.
Apache-2.0. Built in Rust by Teamtem. Runs on k3s, kind, EKS, GKE and AKS.
curl -fsSL https://raw.githubusercontent.com/Teamtem-dev/kuben/main/install.sh | bash