kairos-io/kairos

The immutable Linux meta-distribution for edge Kubernetes.

With Kairos you can build immutable, bootable Kubernetes and OS images for your edge devices as easily as writing a Dockerfile. Optional P2P mesh with distributed ledger automates node bootstrapping and coordination. Updating nodes is as easy as CI/CD: push a new image to your container registry and let secure, risk-free A/B atomic upgrades do the rest. Kairos is part of the Secure Edge-Native Architecture (SENA) to securely run workloads at the Edge (whitepaper).

Kairos (formerly c3os) is an open-source project which brings Edge, cloud, and bare metal lifecycle OS management into the same design principles with a unified Cloud Native API.

At-a-glance:

• Community Driven
• Open Source
• 🔒 Linux immutable, meta-distribution
• 🔑 Secure
• 🐳 Container-based
• 🐧 Distribution agnostic

Kairos can be used to:

• Easily spin-up a Kubernetes cluster, with the Linux distribution of your choice 🐧
• Create your Immutable infrastructure, no more infrastructure drift! 🔒
• Manage the cluster lifecycle with Kubernetes—from building to provisioning, and upgrading 🚀
• Create a multiple—node, a single cluster that spans up across regions 🌍

For comprehensive docs, tutorials, and examples see our documentation.

Kairos is a monorepo. The device-runtime binaries, the SDK, and the image initializer all live in one source tree, share a single go.mod at the root, and ship on one release tag.

• cmd/kairos/ -- the multi-call kairos binary. Dispatches on argv[0] to immucore, kairos-agent, or kcrypt-discovery-challenger, so one binary is deployed and the historical names point at it via symlinks.
• cmd/kcrypt-challenger/ -- the in-cluster kcrypt-challenger server. Not linked into the multi-call binary (different deps and lifecycle); ships as its own container image.
• agent/ -- kairos-agent source (was kairos-io/kairos-agent).
• immucore/ -- immucore source (was kairos-io/immucore).
• kcrypt/discovery/ -- device-side kcrypt discovery (was kairos-io/kcrypt-discovery-challenger).
• kcrypt/challenger/ -- in-cluster kcrypt-challenger package (was kairos-io/kcrypt-challenger).
• sdk/ -- Kairos SDK, importable externally at github.com/kairos-io/kairos/v4/sdk (was kairos-io/kairos-sdk).
• kairos-init/ -- image initializer that installs the multi-call binary plus symlinks into a base image (was kairos-io/kairos-init).
• installer/ -- interactive terminal-UI installer embedded by kairos-init at /system/installer/kairos-installer and invoked by kairos-agent interactive-install (was kairos-io/kairos-installer).
• provider/ -- the p2p/mesh provider, embedded by kairos-init at /system/providers/agent-provider-kairos in standard images. Both an agent bus plugin and the CLI behind kairos provider <cmd> (was kairos-io/provider-kairos, which shipped the same commands a second time as a standalone kairosctl binary).
• tests/ -- monorepo end-to-end test suite.

Each absorbed subdirectory keeps a thin main.go at its root, so go build ./agent, go build ./immucore, and go build ./kcrypt/cmd/discovery still produce standalone binaries from any commit; consumers that are not ready for the multi-call binary can pin one of those.

The historical repos (kairos-agent, immucore, kcrypt-discovery-challenger, kcrypt-challenger, kairos-sdk, kairos-init, kairos-installer, provider-kairos, kairos-factory-action, linting-composite-action) are archived. Their tagged releases remain resolvable so pre-migration pins keep working; post-migration fixes land here and ship on the monorepo release tag.

Absorbed reusable workflows live at .github/workflows/ of the repo root (GitHub does not accept reusable workflows in subdirectories), so they do not follow the subdir pattern the runtime components did:

• kairos-factory-action -> .github/workflows/reusable-factory.yaml
• linting-composite-action -> .github/workflows/reusable-linting.yaml and, for the composite-action shape, linting-composite-action/action.yml

External consumers rewrite their uses: lines from the archived-repo path to the monorepo path (kairos-io/kairos-factory-action/... -> kairos-io/kairos/.github/workflows/reusable-factory.yaml, same for linting) and repin at a monorepo ref (SHA, master, or a Kairos release tag).

Check the Roadmap for a high-level view of what features are coming to Kairos.

Or go to the Project Board to check what the team is working on right now!

To stay up-to-date, check out the Kairos Blog. You will find also release announcements and deep-dive into Kairos features!

You can find us at:

• Cloud Native Slack #kairos channel
• #kairos-io at matrix.org
• IRC #kairos in libera.chat
• GitHub Discussions

The 🤝 community repository contains information about how to get involved, Code of conduct, Maintainers, Contribution guidelines, including also links to our weekly meeting notes, roadmap, and more.

The kairos-community organization holds community supported and experimental projects, kept apart from the maintained kairos-io ones: bundles, Helm charts, meta-kairos for Yocto, openamt and hadron-desktop. Anyone can contribute there.

Looking for something to work on? Browse Kairos issues that need a hand on CLOTributor.

The Kairos project governance can be found in the community repository.

Note: Kairos adopts the CNCF Code of conduct - please make sure to read the CNCF Code of Conduct document.

Project Office Hours is an opportunity for attendees to meet the maintainers of the project, learn more about the project, ask questions, and learn about new features and upcoming updates.

Add to Google Calendar

Kairos is a Cloud Native Computing Foundation (CNCF) Sandbox project and was contributed by Spectrocloud.