Dependencies
This document provides a comprehensive inventory of the primary third-party and open-source software dependencies used across the Vibrant Infrastructure platform. It covers infrastructure provisioning tools, container orchestration, networking, security, CI/CD, database components, and observability.
Dependency Inventory
| Dependency | Repository Link | License | License Notes | Relationship (Child / Parent) |
|---|---|---|---|---|
| K3s | k3s-io/k3s | Apache-2.0 | Permissive, lightweight Kubernetes distribution | Parent of: Cilium, Envoy Gateway, OpenBao, cert-manager, External Secrets Operator, Harbor, Forgejo, Velero, kube-prometheus-stack, Loki, Fluent Bit, Keycloak, PostgREST, pg-eventsrv. Child of: Linux Host OS, OpenTofu (which provisions the Linode instances). |
| Cilium | cilium/cilium | Apache-2.0 | eBPF-based high-performance networking, routing, and security | Child of: Linux Kernel (requires eBPF support), K3s (disables default Flannel and kube-proxy). |
| Envoy Gateway | envoyproxy/gateway | Apache-2.0 | CNCF-managed native Gateway API implementation | Child of: K3s / Kubernetes. Parent of: HTTPRoute resources routing ingress traffic for core services (Harbor, Forgejo, Keycloak, OpenBao). |
| OpenBao | openbao/openbao | MPL-2.0 | Mozilla Public License; modifications must preserve notices and be provided under MPL terms | Child of: K3s / Kubernetes. Co-exists with: Azure Key Vault (which serves as bootstrap/recovery storage). |
| OpenTofu | opentofu/opentofu | MPL-2.0 | Open-source fork of Terraform for infrastructure provisioning | Parent of: Live infrastructure stacks (VPC, clusters, databases). |
| Terragrunt | gruntwork-io/terragrunt | BSL-1.1 | Business Source License; non-compete on production use, transitions to Apache-2.0 after 4 years | Parent of: Live infrastructure stacks (wraps OpenTofu to keep configurations DRY). |
| Harbor | goharbor/harbor | Apache-2.0 | CNCF-graduated enterprise registry | Child of: K3s / Kubernetes. |
Debian trixie-slim base image |
docker-library/official-images | Multiple | Mirrored into Harbor from docker.io/library/debian@sha256:28de0877c2189802884ccd20f15ee41c203573bd87bb6b883f5f46362d24c5c2 via images/base-images.yaml; Harbor agents project/IAM is a separate dependency. |
Parent of: vibrant-agents cloud image builds. Child of: Harbor mirror automation. |
| Forgejo | forgejo/forgejo | GPL-3.0-or-later | Copyleft license, self-hosted Git platform | Child of: K3s / Kubernetes, PostgreSQL (database). |
| Keycloak | keycloak/keycloak | Apache-2.0 | Identity and access management | Child of: K3s / Kubernetes, PostgreSQL (database). |
| PostgreSQL | postgres/postgres | PostgreSQL License | Highly permissive, BSD/MIT-like relational database | Child of: database-server / database-instance modules. Parent of: Database backends for Forgejo, Keycloak, PostgREST, and pg-eventsrv. |
| PostgREST | PostgREST/postgrest | MIT | Instantly maps PostgreSQL schemas to RESTful APIs | Child of: K3s / Kubernetes, PostgreSQL. |
| cert-manager | cert-manager/cert-manager | Apache-2.0 | Automated certificate management | Child of: K3s / Kubernetes. |
| External Secrets Operator | external-secrets/external-secrets | Apache-2.0 | Integrates external secret managers (e.g. Azure Key Vault, OpenBao) | Child of: K3s / Kubernetes. |
| Velero | vmware-tanzu/velero | Apache-2.0 | Disaster recovery and backup for Kubernetes resources | Child of: K3s / Kubernetes, S3-compatible storage (Cloudflare R2). |
| kube-prometheus-stack | prometheus-operator/kube-prometheus-stack | Apache-2.0 | Prometheus operator and Grafana monitoring suite | Child of: K3s / Kubernetes. |
| Loki | grafana/loki | AGPL-3.0 | AGPL copyleft log aggregation system | Child of: K3s / Kubernetes. |
| Fluent Bit | fluent/fluent-bit | Apache-2.0 | High-performance log processor and forwarder | Child of: K3s / Kubernetes. |
| Tailscale | tailscale/tailscale | BSD-3-Clause (client) | Client is open-source; coordination server is proprietary | Child of: K3s / Kubernetes (Tailscale ingress). |
| Cloudflared | cloudflare/cloudflared | Apache-2.0 | Cloudflare Tunnel daemon for secure routing | Child of: K3s / Kubernetes. |