README 未给出安装命令,需按官网 Quick Start 用 Dev Container 或 k3d 部署;CI 面为可选组件,默认依赖 Buildpacks 与 Argo Workflows;需先具备可用的 Kubernetes 集群

openchoreo
openchoreoApache-2.0活跃维护基于 Kubernetes 的内部开发者平台,把 CI/CD、GitOps、可观测性和 AI Agent 能力整合成一套自助式开发环境,让平台团队统一管理服务交付流程。
OpenChoreo is an internal developer platform for Kubernetes
README 未给出具体安装命令,仅指向 Quick Start Guide(Dev Container 方式)与 k3d 本地安装文档README 未说明
面向 Kubernetes 的开源内部开发者平台,把开发者意图翻译成平台资源
基于 Kubernetes 的内部开发者平台,把 CI/CD、GitOps、可观测性和 AI Agent 能力整合成一套自助式开发环境,让平台团队统一管理服务交付流程。
核心能力
- 用 Component、Endpoint 等高层抽象屏蔽 K8s 底层原语
- 提供 Backstage 驱动的开发者门户与 CLI 自助入口
- 内置 CI 与 GitOps,默认用 Buildpacks 和 Argo Workflows 构建
- 按控制面、数据面、可观测面、CI 面多平面架构拆分职责
- 用 Kubernetes CRD 定义 ComponentTypes、Traits 等平台黄金路径
容易踩的坑
- v1.4.0-m.2pre-release2026-11-06 · 2026-11-06 16:11 UTC
查看更新说明
What's Changed
- chore: bump version to 1.4.0-m.2 by @openchoreo-release-bot[bot] in https://github.com/openchoreo/openchoreo/pull/5281
- fix: look up notification channels in the alert's namespace (backport to release-v1.4.0-m.2) by @akila-i in https://github.com/openchoreo/openchoreo/pull/5291
- fix(controller): stop rejecting notification channel secrets that target another plane (backport to release-v1.4.0-m.2) by @akila-i in https://github.com/openchoreo/openchoreo/pull/5296
- fix: wait for notification channels before finalizing environments (backport to release-v1.4.0-m.2) by @chathuranga95 in https://github.com/openchoreo/openchoreo/pull/5298
- fix(controller): create notification channel namespace on the observability plane (backport to release-v1.4.0-m.2) by @akila-i in https://github.com/openchoreo/openchoreo/pull/5304
- feat: allow a sender display name on email notification channels (backport to release-v1.4.0-m.2) by @akila-i in https://github.com/openchoreo/openchoreo/pull/5308
- fix: delete plane namespaces with their control plane namespace (backport to release-v1.4.0-m.2) by @chathuranga95 in https://github.com/openchoreo/openchoreo/pull/5318
- fix(controller): stop RenderedRelease re-queuing on own status writes (backport to release-v1.4.0-m.2) by @Mirage20 in https://github.com/openchoreo/openchoreo/pull/5336
- fix(controller): match RenderedRelease live resources by identity (backport to release-v1.4.0-m.2) by @Mirage20 in https://github.com/openchoreo/openchoreo/pull/5337
- chore: remove unused secret reader role from the bundled OpenBao setup (backport to release-v1.4.0-m.2) by @mevan-karu in https://github.com/openchoreo/openchoreo/pull/5338
- chore(helm): pin observability modules to latest published versions on release-v1.4.0-m.2 by @rashadism in https://github.com/openchoreo/openchoreo/pull/5339
- fix: detect dead gateway connections and bound writes and backend requests (backport to release-v1.4.0-m.2) by @yashodthecreator in https://github.com/openchoreo/openchoreo/pull/5332
- chore: close gaps with the MCP 2026-07-28 spec (backport to release-v1.4.0-m.2) by @chathuranga95 in https://github.com/openchoreo/openchoreo/pull/5340
- fix(helm): pin argo workflows images to v4.0.15 for emudhra distrust (backport to release-v1.4.0-m.2) by @mevan-karu in https://github.com/openchoreo/openchoreo/pull/5341
- feat(controller): add opt-in referenced-config rollout (backport to release-v1.4.0-m.2) by @Mirage20 in https://github.com/openchoreo/openchoreo/pull/5345
- feat(controller): add flags for RenderedRelease requeue intervals (backport to release-v1.4.0-m.2) by @Mirage20 in https://github.com/openchoreo/openchoreo/pull/5346
- fix: raise cleanup timeout for project deletion in UI e2e by @rashadism in https://github.com/openchoreo/openchoreo/pull/5347
- fix: raise remaining project-deletion poll timeouts in UI e2e by @rashadism in https://github.com/openchoreo/openchoreo/pull/5355
Full Changelog: https://github.com/openchoreo/openchoreo/compare/v1.4.0-m.1...v1.4.0-m.2
- v1.4.0-m.1pre-release2026-10-29 · 2026-10-29 13:41 UTC
查看更新说明
What's Changed
- ci: split publish workflow by @rashadism in https://github.com/openchoreo/openchoreo/pull/4812
- fix: record a real actor.id for service accounts in audit events by @mevan-karu in https://github.com/openchoreo/openchoreo/pull/4814
- fix(cli): fix occ auditlogs context scoping and ascending paging by @mevan-karu in https://github.com/openchoreo/openchoreo/pull/4831
- fix(helm): make readable_id_claim optional in the control plane schema by @mevan-karu in https://github.com/openchoreo/openchoreo/pull/4837
- fix(controller): validate component name against DNS-1035 at admission time by @Perera1325 in https://github.com/openchoreo/openchoreo/pull/3640
- fix: emit K8s event on autoDeploy webhook rejection (#3560) by @StereoSachiiii in https://github.com/openchoreo/openchoreo/pull/3924
- fix: stop observer MCP tools returning raw internal errors to callers by @LakshanSS in https://github.com/openchoreo/openchoreo/pull/4847
- feat(cli): add occ releasebinding tree to show a release binding's resource tree by @ChathurangaKCD in https://github.com/openchoreo/openchoreo/pull/4747
- fix(controller): add container ports so workloads can be targeted by name by @kavix in https://github.com/openchoreo/openchoreo/pull/4382
- fix(controller): emit delivery events for components with resource dependencies by @LakshanSS in https://github.com/openchoreo/openchoreo/pull/4849
- test: expect "access denied" from observer MCP authz denials by @LakshanSS in https://github.com/openchoreo/openchoreo/pull/4865
- fix(cli): keep sub-second precision in occ component logs --follow by @ravindudanthanarayana in https://github.com/openchoreo/openchoreo/pull/4840
- revert: 4382 add container ports so workloads can be targeted by name by @chathuranga95 in https://github.com/openchoreo/openchoreo/pull/4891
- fix: validate the namespace in delivery insights scope resolution by @LakshanSS in https://github.com/openchoreo/openchoreo/pull/4855
- feat(api): register portal-assistant:invoke and add chart roles validation test (#4683) by @kavix in https://github.com/openchoreo/openchoreo/pull/4722
- docs: fix logo visibility in dark mode by @chamals3n4 in https://github.com/openchoreo/openchoreo/pull/4780
- chore: migrate helm repo and container registry by @chathuranga95 in https://github.com/openchoreo/openchoreo/pull/4898
- fix: remove the two step observability-logs-opensearch helm chart installation in k3d install script by @nilushancosta in https://github.com/openchoreo/openchoreo/pull/4874
- chore: bump github.com/google/cel-go from 0.30.0 to 0.31.0 by @dependabot[bot] in https://github.com/openchoreo/openchoreo/pull/4476
- chore(deps): bump github.com/knadh/koanf/providers/confmap from 1.0.0 to 1.0.1 by @dependabot[bot] in https://github.com/openchoreo/openchoreo/pull/4475
- chore(deps): update fastapi requirement from >=0.139.2 to >=0.141.1 in /agents/common by @dependabot[bot] in https://github.com/openchoreo/openchoreo/pull/4530
- chore(deps): bump github.com/onsi/ginkgo/v2 from 2.32.0 to 2.33.0 by @dependabot[bot] in https://github.com/openchoreo/openchoreo/pull/4527
- chore(deps): bump github.com/getkin/kin-openapi from 0.145.0 to 0.149.0 by @dependabot[bot] in https://github.com/openchoreo/openchoreo/pull/4478
- chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by @dependabot[bot] in https://github.com/openchoreo/openchoreo/pull/4525
- chore(deps): bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in https://github.com/openchoreo/openchoreo/pull/4820
- chore(deps): bump github/codeql-action/upload-sarif from 4.37.5 to 4.38.1 by @dependabot[bot] in https://github.com/openchoreo/openchoreo/pull/4818
- chore(deps): update pyjwt[crypto] requirement from >=2.13.0 to >=2.14.0 in /agents/common by @dependabot[bot] in https://github.com/openchoreo/openchoreo/pull/4817
- chore(deps): bump github.com/knadh/koanf/providers/structs from 1.0.0 to 1.0.1 by @dependabot[bot] in https:
- v1.3.3最新正式版2026-10-29 · 2026-10-29 06:42 UTC
What's Changed
- chore: update default observability module versions in installations by @nilushancosta in https://github.com/openchoreo/openchoreo/pull/5163
- fix: deny all ingress in CiliumNetworkPolicy for components without endpoints (backport to release-v1.3) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5193
- fix: remove the two step observability-logs-opensearch helm chart installation in k3d install script (backport to release-v1.3) by @LakshanSS in https://github.com/openchoreo/openchoreo/pull/5199
- fix: tell the DORA metrics tool about commit coverage (backport to release-v1.3) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5210
- feat: authenticate platform components with JWT client assertion (backport to release-v1.3) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5211
- revert: drop client assertion support from the workload publisher (backport to release-v1.3) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5212
- feat: support Azure workload identity for the AI agents' LLM calls (backport to release-v1.3) by @VajiraPrabuddhaka in https://github.com/openchoreo/openchoreo/pull/5213
- chore: bump version to 1.3.3 by @openchoreo-release-bot[bot] in https://github.com/openchoreo/openchoreo/pull/5215
- docs: update CHANGELOG for v1.3.3 release by @VajiraPrabuddhaka in https://github.com/openchoreo/openchoreo/pull/5219
- fix: clear kubelet ServiceMonitor auth for multi-cluster exporter e2e (backport to release-v1.3) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5222
- fix: set cluster identity on initial OpenSearch install (backport to release-v1.3) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5221
- docs: clear kubelet ServiceMonitor auth in the multi-cluster metrics exporter install (backport to release-v1.3) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5225
Full Changelog: https://github.com/openchoreo/openchoreo/compare/v1.3.2...v1.3.3
- v1.1.92026-10-23 · 2026-10-23 13:06 UTC
查看更新说明
What's Changed
- chore: bump distroless/static from
e2e927etod620678(backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5140 - chore: bump distroless/static from
1c2c046tod620678in /cmd/cluster-agent (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5141 - chore: bump distroless/static from
1c2c046tod620678in /cmd/cluster-gateway (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5142 - chore: bump distroless/static from
1c2c046tod620678in /cmd/event-forwarder (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5143 - chore: bump distroless/static from
1c2c046tod620678in /cmd/observer (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5144 - chore: bump distroless/static from
1c2c046tod620678in /cmd/openchoreo-api (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5145 - chore: bump alpine digest in occ and quick-start images (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5146
- chore: bump distroless/cc from
9b615fftob2e43dcin /agents/finops-agent (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5147 - chore: bump distroless/cc from
9b615fftob2e43dcin /agents/portal-assistant (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5148 - fix: move sre-agent runtime image to distroless/cc on Debian 13 (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5149
- chore: bump astral-sh/uv from
e37a03btod8e7328in /agents/portal-assistant (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5150 - chore: bump astral-sh/uv from
8e70ac2tod8e7328in /agents/finops-agent (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5151 - chore: bump astral-sh/uv from
8e70ac2tod8e7328in /agents/sre-agent (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5152 - chore: upgrade certifi package to 2026.10.19 (backport to release-v1.1) by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5153
- chore: bump alpine digest in the init-observability-opensearch image by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5155
- chore: build with Go 1.26.10 for GO-2026-6809 (backport to release-v1.1) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5139
- chore: bump version to 1.1.9 by @openchoreo-release-bot[bot] in https://github.com/openchoreo/openchoreo/pull/5159
- docs: add v1.1.9 changelog entry by @JanakaSandaruwan in https://github.com/openchoreo/openchoreo/pull/5160
Full Changelog: https://github.com/openchoreo/openchoreo/compare/v1.1.8...v1.1.9
- chore: bump distroless/static from
- v1.2.82026-10-23 · 2026-10-23 09:12 UTC
查看更新说明
What's Changed
- refactor(cli): resolve workload descriptor file paths within the descriptor directory (backport to release-v1.2) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/4868
- chore: bump version to 1.2.8 by @openchoreo-release-bot[bot] in https://github.com/openchoreo/openchoreo/pull/4876
- chore: bump argo-workflows from 1.0.18 to 1.0.23 in /install/helm/openchoreo-workflow-plane (backport to release-v1.2) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5075
- fix: increase argo workflow controller CPU and RAM limits to fix workflow stuck issue (backport to release-v1.2) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5119
- chore: build with Go 1.26.10 for GO-2026-6809 (backport to release-v1.2) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5131
- chore: bump base images and certifi for eMudhra CA distrust (backport to release-v1.2) by @mevan-karu in https://github.com/openchoreo/openchoreo/pull/5133
- chore: bump alpine digest in occ and quick-start images (backport to release-v1.2) by @github-actions[bot] in https://github.com/openchoreo/openchoreo/pull/5132
- docs: add v1.2.8 changelog entry by @mevan-karu in https://github.com/openchoreo/openchoreo/pull/5135
Full Changelog: https://github.com/openchoreo/openchoreo/compare/v1.2.7...v1.2.8
用户点评
登录用户的真实使用记录,可按版本和硬件筛选还没有人点评。第一个说出真实体验的人最有价值。
Why OpenChoreo?
Kubernetes gives you powerful primitives like Namespaces, Deployments, CronJobs, Services, and NetworkPolicies, but they're too low-level for most developers. Platform engineers end up building the actual platform from scratch: defining higher-level abstractions, wiring together tools for delivery, security and observability, and maintaining all of it as an in-house product.
That means stitching together a developer portal, CI pipelines, GitOps workflows, an observability stack, and access controls and then owning the glue between them indefinitely. The result is a fragile, bespoke system that's expensive to maintain and hard to evolve.
Developers and platform engineers need different things from the same platform. Developers want a simple, self-service experience. Platform engineers want control over what's running underneath. Most DIY platforms end up optimizing for one side at the expense of the other.
What is OpenChoreo?
OpenChoreo, now a CNCF Sandbox project, takes a different approach. Instead of giving you a toolkit to assemble your own platform, it provides a complete, open-source developer platform for Kubernetes with abstractions that translate developer intent into platform reality. So platform engineers don't have to reinvent the wheel, and developers get a self-service experience that stays out of their way.
Under the hood, OpenChoreo brings together a Backstage-powered developer portal, built-in CI and GitOps, observability, RBAC, and analytics and all of them are organized across dedicated control, CI, data, and observability planes. Platform engineers get a production-ready foundation they can operate and extend, not scaffolding they'll eventually replace.
OpenChoreo was originally developed by WSO2, based on its experience building the SaaS internal developer platform formerly known as WSO2 Choreo (now WSO2 Developer Platform), bringing its core ideas to the open-source community. It's not a fork or an open-source dump; it's a complete rewrite based on what we learned from Choreo’s users over the years.
How does OpenChoreo work?
OpenChoreo is built around a multi-plane architecture, where each plane handles a distinct concern and operates independently.
-
The Experience Plane is where developers, platform engineers, and SREs interact with the platform via a Backstage-powered OpenChoreo Portal, CLI, GitOps, or AI agents.
-
The Control Plane sits at the center of OpenChoreo. It takes developer intent and platform intent expressed through high-level abstractions like components, endpoints, dependencies, environments, pipelines, and namespaces and translates them into the underlying Kubernetes resources. It also reflects runtime reality back up, so what developers see always matches what's actually running.
-
The Data Plane is where your workloads run. It is where OpenChoreo enforces and guarantees the semantics of those high-level abstractions, such as isolation between projects, traffic policies, and security boundaries. These aren't just configurations; they're guaranteed by the platform.
-
The Observability Plane feeds the loop with metrics, logs, and tracing, all surfaced through the abstractions your developers already understand.
-
The optional CI Plane handles builds using cloud native Buildpacks and Argo Workflows by default.
At the center of this is a set of opinionated abstractions. Developers work with components (services, workers, cron jobs, and other types defined as component types), expose functionality through endpoints, and declare dependencies on other endpoints or resources. Platform engineers control what component types are available, what traits can be applied, and how workloads behave, through configuration, not custom code.
The result is a clear separation of concerns: developers express what they want to run, the control plane figures out how to run it, and platform engineers govern the boundaries.
Underpinning all of this is the Platform API. It is a set of Kubernetes CRDs that let platform engineers declaratively define the structure and behavior of the entire platform. Instead of writing custom controllers or glue scripts, you configure organizational boundaries, environments, data planes, deployment pipelines, and observability through familiar Kubernetes-native resources. The Platform API also includes programmable abstractions like ComponentTypes, Traits, and Workflows that let platform teams define golden paths for their developers, encapsulate best practices, and enforce organizational standards. Together, they enable OpenChoreo's approach to policy, security, and governance by design.
The diagram below illustrates some of the core concepts of the Platform API and how they relate to each other. It represents one possible platform topology, not a prescribed structure.
Getting Started
The easiest way to try OpenChoreo is by following the Quick Start Guide. It walks you through setting up OpenChoreo using a Dev Container, so you can start experimenting without affecting your local environment.
For a deeper understanding of OpenChoreo's architecture, see OpenChoreo Concepts.
Visit Installation Guide to learn more about installation methods.
Samples
Explore hands-on examples to help you configure and deploy your applications using OpenChoreo.
- Platform Configuration – Set up deployment pipelines and environments.
- Deploy from Source – Deploy services and web apps from source code.
- Deploy from Image – Deploy pre-built container images.
Check out the Samples Directory for more details.
Join the Community & Contribute
We’d love for you to be part of OpenChoreo’s journey! Whether you’re fixing a bug, improving documentation, or suggesting new features, every contribution counts.
- Contributor Guide – Learn how to get started.
- Report an Issue – Help us improve OpenChoreo.
- Join our Slack – Be part of the community.
We’re excited to have you onboard!
Roadmap
We maintain an OpenChoreo Roadmap as a GitHub project board to share what we’re building and when we expect to deliver it.
The roadmap is organized by calendar quarters, and each column represents a set of features or enhancements planned for that period. This allows contributors, adopters, and maintainers to understand what’s coming up and what’s already being worked on.
How It Works
- Quarterly columns: Group features by when we aim to deliver them (e.g., 2025 Q2 – Apr–Jun).
- Future column: Tracks ideas or initiatives we intend to explore but haven’t scheduled yet.
- Each card links to a GitHub issue with context and discussion.
- We continuously update the roadmap as priorities evolve, and completed features may remain in their quarter for historical visibility.
License
OpenChoreo is licensed under Apache 2.0. See the LICENSE file for full details.