# kubementat

> kubementat takes a bare Kubernetes cluster and one config directory to a productive one:
> Tekton CI, Prometheus/Grafana, Loki/Alloy, Traefik/cert-manager, OpenBao and Polaris,
> applied by the kmt CLI. MIT-licensed, no vendor lock-in, Raspberry Pi to cloud.

Version 2.0.0 (branch `develop`, commit 41e29e0, 2026-11-11).

## Repository

- [README](https://github.com/Kubementat/kubementat#readme): full reference — what installs where and the kmt verbs
- [GitHub](https://github.com/Kubementat/kubementat)

## Platform (helm releases + Tekton)

- [Traefik](https://traefik.io/) — routing
- [cert-manager](https://cert-manager.io/) — certificates
- [Prometheus](https://prometheus.io/) — metrics
- [Blackbox exporter](https://github.com/prometheus/blackbox_exporter) — metrics
- [Helm exporter](https://shanestarcher.com/helm-charts/) — metrics
- [Grafana](https://grafana.com/grafana/) — dashboards
- [Loki](https://grafana.com/oss/loki/) — logs
- [Alloy](https://grafana.com/docs/alloy/) — logs
- [OpenBao](https://openbao.org/) — secrets
- [Polaris](https://www.fairwinds.com/polaris) — compliance
- [Tekton Pipelines](https://tekton.dev/) — with Triggers, the Dashboard and the resolvers

## Guides

- [Platform configuration](https://github.com/Kubementat/kubementat/blob/develop/docs/README_PLATFORM_CONFIG.md): The configuration directory: layers, keys, precedence, the spec of the tree.
- [Tekton CI](https://github.com/Kubementat/kubementat/blob/develop/docs/README_TEKTON.md): Tasks, pipelines, triggers, resolvers — how build-and-deploy runs.
- [Monitoring & logging](https://github.com/Kubementat/kubementat/blob/develop/docs/README_MONITORING_AND_LOGGING.md): Prometheus, Grafana, Loki, Alloy: what is wired to what and where it is exposed.
- [Git-Crypt](https://github.com/Kubementat/kubementat/blob/develop/docs/README_GIT_CRYPT.md): What it protects, where the key lives, which command failed when unlocking goes wrong.
- [Development flow](https://github.com/Kubementat/kubementat/blob/develop/docs/README_DEVELOPMENT_FLOW.md): The fork-own-customize way to run kubementat as your team's platform.
- [Additional tools](https://github.com/Kubementat/kubementat/blob/develop/docs/README_ADDITIONAL_TOOLS.md): What the platform does not apply via helmfile: namespaces and helpers.
- [E2E tests](https://github.com/Kubementat/kubementat/blob/develop/docs/README_E2E_TESTS.md): VM-based lanes that apply the product for real and assert it converged.

## CLI

- `kmt config`: init, set/unset, show, validate, add-environment, add-team
- `kmt environments`: list
- `kmt kubernetes`: analyze-deployment, cluster-capacity, create-ingress, create-secret-from-json, deployment-logs, deployment-ssh, pod-images, pvc-usage, service-account-token
- `kmt helm`: apply, latest-version
- `kmt tekton`: setup-pipelines, setup-triggers, run-pipeline, generate-deploy-pipeline, generate-pipeline-run, generate-triggers, setup-cleanup-job, cleanup-pipeline-runs, list, uninstall-pipelines
- `kmt component`: install, uninstall
- `kmt routing`: install, status
- `kmt tunnel`: grafana, openbao-ui, pod, tekton
- `kmt users`: create-team-account, create-team-account-read-only, delete-team-account, create-grafana-accounts, create-grafana-read-only-account
- cluster-level: `kmt install`, `kmt uninstall`, `kmt setup-secrets`, `kmt setup-docker-registry-access`, `kmt run-ci-container`

## Key ideas

- Configuration lives in a named directory (`--config-dir` or `$KUBEMENTAT_PLATFORM_CONFIG_DIR`), a git repo in its own right, prepared by `kmt config init`.
- Layers: team file > environment file > shipped default; `kmt config show` prints who answered each key.
- The helmfile and release index ship inside `kmt`; the version window answers for 2.x.
- No service mesh, no nginx-ingress. Traefik + cert-manager route, Tekton builds and deploys.
- git-crypt protects the credentials of the configuration directory; the symmetric key cannot be regenerated.