{"id":51201065,"url":"https://github.com/runos-official/clusteragent","last_synced_at":"2026-06-28T00:30:25.021Z","repository":{"id":366150330,"uuid":"948362630","full_name":"runos-official/clusteragent","owner":"runos-official","description":"RunOS cluster agent: the in-cluster component that connects your Kubernetes cluster to the RunOS platform. Source-available (Elastic License 2.0).","archived":false,"fork":false,"pushed_at":"2026-06-20T13:23:55.000Z","size":198,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-06-20T14:33:18.377Z","etag":null,"topics":["cluster-agent","kubernetes","runos","source-available"],"latest_commit_sha":null,"homepage":"https://runos.com","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/runos-official.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-03-14T07:48:19.000Z","updated_at":"2026-06-20T11:25:22.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/runos-official/clusteragent","commit_stats":null,"previous_names":["runos-official/clusteragent"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/runos-official/clusteragent","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/runos-official%2Fclusteragent","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/runos-official%2Fclusteragent/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/runos-official%2Fclusteragent/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/runos-official%2Fclusteragent/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/runos-official","download_url":"https://codeload.github.com/runos-official/clusteragent/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/runos-official%2Fclusteragent/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34873663,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-27T02:00:06.362Z","response_time":126,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cluster-agent","kubernetes","runos","source-available"],"created_at":"2026-06-28T00:30:24.274Z","updated_at":"2026-06-28T00:30:25.016Z","avatar_url":"https://github.com/runos-official.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RunOS Cluster Agent\n\nThe cluster agent connects your Kubernetes cluster to the [RunOS](https://runos.com)\nplatform. It runs as a single pod inside your cluster, on your hardware, and is\nhow RunOS builds and ships your applications, manages their databases, and keeps\nyour cluster's TLS certificates valid.\n\nIt only ever dials **out** to the RunOS control plane over an encrypted,\nmutually-authenticated link, so there is no inbound port to open and nothing for\nthe platform to reach into. A cluster behind NAT or a firewall works without any\nexposed ingress.\n\n## What it does for you\n\n- **Builds and ships your apps.** Turns your source or a Git commit into a\n  container image and rolls it out, each build runs in its own throwaway\n  builder, so builds stay isolated.\n- **Runs database migrations** as one-off jobs, and runs SQL against your\n  databases (read-only by default).\n- **Keeps your TLS certificates issued and renewed** for your cluster's domain.\n- **Serves deploys** initiated from the RunOS CLI or console.\n\n## How it works\n\nThe cluster agent holds one long-lived, mutually-authenticated (mTLS) connection\nto the RunOS control plane. The control plane sends it instructions (\"build this\nimage\", \"run this migration\", \"issue this certificate\") and the agent carries\nthem out inside your cluster, then reports back. Everything happens over that one\nauthenticated, outbound link, the platform cannot reach your cluster any other\nway.\n\n```\n        mTLS link (agent dials out, no inbound port)\n  RunOS control plane  \u003c───────────────────────────►  cluster agent\n                                                       (in your cluster)\n```\n\nIf you want the full picture, the transport, the complete instruction set, and\nthe package layout, see [docs/architecture.md](docs/architecture.md).\n\n## Installing\n\nYou don't install the cluster agent by hand. RunOS deploys it into your cluster\n(one Deployment in the `runos` namespace) automatically when your cluster is\nfirst configured, and updates it for you. Operators managing the manifest\ndirectly can find the rendered Kubernetes manifest on each\n[GitHub release](https://github.com/runos-official/clusteragent/releases).\n\n## Security\n\nThe agent talks to the control plane over mutual TLS only, holds no inbound\nlistener for control traffic, and reads all credentials from Kubernetes Secrets\nat runtime (none are baked into the image). Released images carry a keyless\nSigstore build-provenance attestation, so you can verify any image came from\nthis repository's pipeline:\n\n```sh\ngh attestation verify oci://ghcr.io/runos-official/clusteragent:\u003cversion\u003e \\\n  --repo runos-official/clusteragent\n```\n\nBecause the agent acts on your cluster on the control plane's behalf, it runs\nwith broad in-cluster permissions. See [SECURITY.md](SECURITY.md) for the trust\nmodel, what that means for you, and how to report a vulnerability.\n\n## Documentation\n\n- [docs/architecture.md](docs/architecture.md) — how it works, in depth\n- [docs/cluster-operations.md](docs/cluster-operations.md) — operating the agent\n- [docs/certificate-management.md](docs/certificate-management.md) — certificates and DNS01\n- [SECURITY.md](SECURITY.md) — security model and reporting\n- [CONTRIBUTING.md](CONTRIBUTING.md) — building, testing, and releasing\n- [CHANGELOG.md](CHANGELOG.md) — release history\n\n## License\n\nThe RunOS cluster agent is **source-available** under the\n[Elastic License 2.0](LICENSE): the source is published for transparency and\nsecurity review, not as open source. Use is subject to the license terms. See\n[LICENSE](LICENSE) and [NOTICE](NOTICE). Copyright 2026 RunOS.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frunos-official%2Fclusteragent","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frunos-official%2Fclusteragent","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frunos-official%2Fclusteragent/lists"}