Skip to main content

KubeVela

Application delivery platform implementing the Open Application Model on Kubernetes.

KubeVela is a CNCF project that implements the Open Application Model (OAM), providing a higher-level abstraction layer over raw Kubernetes resources. It lets platform teams define reusable ComponentDefinition and TraitDefinition building blocks, and lets app teams deploy via Application CRDs without dealing with raw Deployments, Services, or Ingresses. The controller and the VelaUX dashboard are installed on the talos cluster, but no workload is delivered through it today: there is not a single Application in Git, and apps ship as plain Kustomize overlays. Application delivery with KubeVela describes what is installed and what would have to happen before an app could move over.

Alternatives considered​

Self Hosted

ToolOpen SourceFull FeaturesNotes
Argo CD ApplicationSetYesYesGitOps-only; no OAM abstraction layer
KratixYesYesPlatform-as-a-product approach via Promises
Kustomize + FluxYesYesNo higher-level app abstraction; used alongside KubeVela here

Installation​

Architecture​

HelmRelease kubevela in namespace kubevela-system, chart vela-core from https://kubevela.github.io/charts, version pinned via Renovate. Admission webhook enabled with cert-manager integration. VelaUX dashboard enabled (1 replica, ClusterIP service, ingress disabled). Leader election enabled. Built-in component definitions (webservice, k8s-objects, etc.) enabled. Webhook caBundle drift is ignored via driftDetection.ignore for multiple webhook paths.

Security​

Pod securityContext: runAsNonRoot: true, runAsUser/Group/fsGroup: 1000, seccompProfile: RuntimeDefault. Container securityContext: allowPrivilegeEscalation: false, capabilities: drop: ALL. Admission webhook uses cert-manager for TLS. RBAC is cluster-wide (OAM controller needs to manage resources in any namespace).

Updates​

Managed by Renovate. The chart version is semver-pinned in the HelmRelease.

Usage​

Platform operators define ComponentDefinition and TraitDefinition resources to encapsulate Kubernetes patterns. Application owners create Application resources referencing those definitions to deploy workloads. The VelaUX dashboard provides a web UI for visualizing and managing applications. Traits such as ingress, scaling, and resource policies can be applied declaratively to components.

Cluster-specific deviations from the above live in the per-cluster README — see k8s/platform/kubevela/talos/README.md.

Cluster Deployment​

KubeVela — Talos cluster

Deviations from defaults​

  • vela-core image pinned by digest (kubevela-values.yaml) — verify-platform-images runs with verifyDigest: true, so the tag-only chart default is rejected at admission and Flux cannot reconcile the HelmRelease.
Kubernetes Metadata
Rendered manifests (kustomize build)
apiVersion: v1
data:
  values.yaml: |
    replicaCount: 1

    # vela-core is pinned by tag AND digest: the Kyverno policy
    # verify-platform-images checks the cosign signature with verifyDigest: true,
    # which rejects tag-only image references at admission — Flux's dry-run of the
    # Deployment fails and the HelmRelease cannot reconcile. The chart has no
    # digest value, so the digest rides in `tag`. Renovate's helm-values manager
    # parses `tag@digest`; the chart version is grouped into the same PR.
    image:
      repository: oamdev/vela-core
      tag: v1.11.0@sha256:95fa412c934e3c94c741a0fa3f89652eeda41728b63db1c7d76d6356cf8664f7
      pullPolicy: IfNotPresent

    resources:
      limits:
        cpu: 500m
        memory: 512Mi
      requests:
        cpu: 100m
        memory: 128Mi

    # No joined clusters — the cluster-gateway APIService only serves remote-cluster
    # management and its helm-hook-patched caBundle repeatedly wedged upgrades
    multicluster:
      enabled: false

    # Enable admission webhook (recommended)
    admissionWebhooks:
      enabled: true
      failurePolicy: Fail
      certManager:
        enabled: true

    # Enable leader election (important if scaling >1 replica later)
    leaderElection:
      enabled: true

    # Enable built-in definitions (webservice, k8s-objects, etc.)
    velaCore:
      builtinDefinition:
        enabled: true

    # Disable velaux dashboard (install separately if needed)
    velaux:
      enabled: true
      replicaCount: 1

      resources:
        limits:
          cpu: 300m
          memory: 256Mi
        requests:
          cpu: 50m
          memory: 128Mi

      service:
        type: ClusterIP

      ingress:
        enabled: false

    # Logging
    logLevel: info

    podSecurityContext:
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
      fsGroupChangePolicy: OnRootMismatch
      seccompProfile:
        type: RuntimeDefault

    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
kind: ConfigMap
metadata:
  name: kubevela-values-kgt4bhcfgd
  namespace: kubevela-system