devhub

A Kubernetes self-service platform. Developers deploy databases, services, and IDE workspaces from a browser — no kubeconfig, no helm install, no kubectl.

👀 Quick look

demo.mp4

⭐ devhub features

Tenancy

• 🔒 One Environment per team. Maps 1:1 to a Better-Auth organization. Owner / admin / member roles, enforced at API and DB layers.
• 🧱 Namespace-scoped isolation. Each Environment gets its own Namespace, NetworkPolicy (egress-restricted), ResourceQuota, and LimitRange.
• 📊 Per-Environment quotas. Admins tune CPU/memory caps and per-pod defaults from /admin/environments/<name> — no kubectl needed.

Workloads

• 📦 AppTemplates. Four source types: built-in presets (postgres, mysql, mongodb, redis, nats, rabbitmq, elasticsearch, minio), custom container images, Helm charts (HTTP and OCI), or raw Kubernetes manifests.
• 🚀 AppInstances. One-click deploy from any template. Status updates flow back live; click into an instance to see logs, credentials, and connection strings.
• 🔌 Auto-exposure via Gateway API. Templates can opt their HTTP services into an HTTPRoute — one wildcard cert covers every tenant subdomain.

Workspaces

• 💻 vscode-server in-cluster. Per-user workspace pod with attached PVC, git repos cloned on first boot, optional SSH key for private repos.
• 🔗 Direct service DNS. From a workspace shell, psql -h postgres reaches the AppInstance's Postgres in the same namespace.

Admin

• 👥 User management. List, search, role-change, ban, delete — gated behind the platform admin role.
• 📜 Audit log. Every mutation (env.create, appInstance.delete, admin.user.ban, …) recorded with actor + resource + metadata.
• 🩺 Cluster overview. Counts and recent activity across all tenants on /admin.

Technical

• ⚡ Live updates. TanStack Query polls at 5s while anything is provisioning, 30s when idle.
• 📝 Streaming logs. Server-Sent Events from the Kubernetes pod log API straight into the browser.
• 🧩 Three-layer architecture. Next.js UI → Hono + tRPC API → Go operator. The UI never talks to the Kubernetes API directly.

📋 Requirements

• Kubernetes 1.28+ with the Gateway API standard-channel CRDs installed.
• A GatewayClass and Gateway you bring yourself (Traefik, Envoy Gateway, contour, Istio, …). devhub never creates the Gateway — TLS strategy stays where it already lives.
• Wildcard DNS + TLS for a base domain like *.apps.example.com.
• PostgreSQL. Bundled single-replica is fine for demos; bring an external Postgres (RDS, Cloud SQL, CloudNativePG) for anything real.

📚 Documentation

Want to learn how it works? See the devhub documentation — architecture, CRD reference, multi-tenancy, deploying, and the local-cluster onboarding walkthrough.

🚀 Deployments

• ☸️ Helm chart — OCI release at oci://ghcr.io/srkn0/charts/devhub. Three subcharts (operator, server, web) — toggle any of them off.
• 🛠️ Local kind cluster — one-script bootstrap; reach a working dashboard at https://app.apps.127-0-0-1.sslip.io in under 15 minutes.
• 🔁 DevSpace inner loop — devspace dev syncs source into a running pod with hot reload (air for Go, next dev for web).

🔐 Security model

devhub is a platform-engineering lab, not a hardened multi-tenant product. The operator provisions namespace, quota, limit-range, and egress-oriented tenant NetworkPolicies, and the chart can protect the operator metrics endpoint with a NetworkPolicy. Platform web/server/postgres pod-to-pod NetworkPolicies are not currently rendered by the chart. Treat that as an explicit hardening gap before using this outside a controlled lab cluster.