# kubementat — complete reference for AI agents

Version 2.0.0 · branch `develop` · commit 41e29e0 (2026-11-11)
License: MIT · Repository: https://github.com/Kubementat/kubementat · Landing page: https://kubementat.denkfabrik.space

## What it is

kubementat is an opinionated Kubernetes automation framework. It automates installation and
setup of kubernetes environments and runs pipelines via Tekton CI, installing a complete
open-source standard toolset: monitoring (Prometheus, Grafana, blackbox and helm exporters),
logging (Loki, Alloy), routing (Traefik with cert-manager), a secret store (OpenBao) and a
compliance scan (Polaris). It installs no service mesh and no nginx-ingress.

## Configuration directory

Configured by an external directory prepared by `kmt config init`; named via `--config-dir`
or `$KUBEMENTAT_PLATFORM_CONFIG_DIR`, never located by proximity. Layers resolve
team > environment > shipped default. Credentials live in `*.encrypted.*` files under
git-crypt; the symmetric key cannot be regenerated or rotated.

## Releases applied (helmfile shipped inside kmt)

- Traefik (routing) — https://traefik.io/
- cert-manager (certificates) — https://cert-manager.io/
- Prometheus (metrics) — https://prometheus.io/
- Blackbox exporter (metrics) — https://github.com/prometheus/blackbox_exporter
- Helm exporter (metrics) — https://shanestarcher.com/helm-charts/
- Grafana (dashboards) — https://grafana.com/grafana/
- Loki (logs) — https://grafana.com/oss/loki/
- Alloy (logs) — https://grafana.com/docs/alloy/
- OpenBao (secrets) — https://openbao.org/
- Polaris (compliance) — https://www.fairwinds.com/polaris
- Tekton Pipelines (installed by `kmt tekton setup-pipelines`) with Triggers, Dashboard, resolvers

Namespaces created but not releases: `cluster-cronjobs`, `goldilocks`, `vpa` —
`kmt component install` refuses them for exactly that reason.

## CLI verbs

- kmt config: init, set/unset, show, validate, add-environment, add-team
- kmt environments: list
- kmt kubernetes: analyze-deployment, cluster-capacity, create-ingress, create-secret-from-json, deployment-logs, deployment-ssh, pod-images, pvc-usage, service-account-token
- kmt helm: apply, latest-version
- kmt tekton: setup-pipelines, setup-triggers, run-pipeline, generate-deploy-pipeline, generate-pipeline-run, generate-triggers, setup-cleanup-job, cleanup-pipeline-runs, list, uninstall-pipelines
- kmt component: install, uninstall
- kmt routing: install, status
- kmt tunnel: grafana, openbao-ui, pod, tekton
- kmt users: create-team-account, create-team-account-read-only, delete-team-account, create-grafana-accounts, create-grafana-read-only-account
- kmt install / kmt uninstall: apply or remove the whole platform
- kmt setup-secrets / kmt setup-docker-registry-access / kmt run-ci-container

## Quick start

```
uv tool install kubementat
kmt config init --environment dev --team dev1 \
    --gpg-email you@example.com --config-dir ~/kmt-config
kmt config set dev CLUSTER_KUBE_CONTEXT=<context> --config-dir ~/kmt-config
kmt install
kmt setup-secrets
```

## Guides

- README — full reference: https://github.com/Kubementat/kubementat/blob/develop/README.md — What installs where, the kmt verbs, the general goal.
- Platform configuration: https://github.com/Kubementat/kubementat/blob/develop/docs/README_PLATFORM_CONFIG.md — The configuration directory: layers, keys, precedence, the spec of the tree.
- Tekton CI: https://github.com/Kubementat/kubementat/blob/develop/docs/README_TEKTON.md — Tasks, pipelines, triggers, resolvers — how build-and-deploy runs.
- Monitoring & logging: https://github.com/Kubementat/kubementat/blob/develop/docs/README_MONITORING_AND_LOGGING.md — Prometheus, Grafana, Loki, Alloy: what is wired to what and where it is exposed.
- Git-Crypt: https://github.com/Kubementat/kubementat/blob/develop/docs/README_GIT_CRYPT.md — What it protects, where the key lives, which command failed when unlocking goes wrong.
- Development flow: https://github.com/Kubementat/kubementat/blob/develop/docs/README_DEVELOPMENT_FLOW.md — The fork-own-customize way to run kubementat as your team's platform.
- Additional tools: https://github.com/Kubementat/kubementat/blob/develop/docs/README_ADDITIONAL_TOOLS.md — What the platform does not apply via helmfile: namespaces and helpers.
- E2E tests: https://github.com/Kubementat/kubementat/blob/develop/docs/README_E2E_TESTS.md — VM-based lanes that apply the product for real and assert it converged.