OpenKruise

Term 3 · Sep-Nov · 2 projects

• Build OpenSandbox-Compatible API Adapter Layer

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  OpenKruise Agents is a Kubernetes-native AI sandbox platform that currently exposes an E2B-compatible REST API over Kubernetes CRDs. OpenSandbox is another open-source sandbox platform with its own native API, distinct semantics (image-based creation, async pause, metadata patching, diagnostics), and a formal OpenAPI spec. Users who want to use OpenKruise Agents as the backend but need OpenSandbox API compatibility currently have no path. This project will build an OpenSandbox-compatible API adapter that reuses the existing orchestration layer without duplication, following the same adapter pattern proven by the E2B API. Additionally, the current in-sandbox execution layer is tightly coupled to the envd runtime. To support OpenSandbox's execd runtime as an alternative, the mentee will design a generic runtime provider interface abstracting command execution, file I/O, and runtime initialization, enabling per-sandbox selection between envd and execd. This abstraction also benefits any future runtime backend. Expected Outcome: - An OpenSandbox-compatible REST API layer coexisting with the existing E2B API in the same process - Full lifecycle coverage: sandbox CRUD, pause/resume, snapshots, metadata patching, diagnostics - Data model and state machine conversion between OpenSandbox and Kubernetes CRD semantics - A generic runtime provider interface with two implementations: envd (existing) and execd (OpenSandbox) - Per-sandbox runtime provider selection - Unit tests and a design proposal document

  • Go
  • Kubernetes
  • container runtimes
  • test-driven development

• Support identity provider based on keycloak etc.

  LFX Mentorship · Listed in the official cohort

  @zmbergSource IssueLFX portal

  * Description: OpenKruise Agents provides a Kubernetes-native platform for orchestrating AI agent sandboxes. With the recent merge of #648 (gateway-side JWT verification via OIDC) and #671 (TokenKind-based token issuance interface), the project now has the interfaces and scaffolding for standards-based token issuance and verification — but does not yet ship an open-source implementation that mints real signed tokens or propagates them into sandboxes. This project will implement a complete open-source token lifecycle: signed JWT access token issuance, signed ID token issuance, an OIDC discovery and JWKS endpoint so the gateway verifier can bootstrap, and ID token distribution into the sandbox runtime. The implementation should also support integration with open-source identity providers such as Keycloak and Dex, giving community users a fully open-source, end-to-end signed-token authentication path. The implementation will integrate with the existing token refresh controller and claim/clone flows without changing the API contract or CRD schema. * Expected Outcome: * An open-source IdentityProvider that signs real JWT access tokens with asymmetric keys, with key rotation support * An OIDC discovery and JWKS endpoint served by the sandbox-manager, eliminating the need for an external identity provider in community deployments * Signed ID token issuance integrated with the existing SecurityTokenRefreshReconciler for automatic refresh before expiry * A PropagateSecurityToken implementation that delivers the ID token into the sandbox runtime, with refresh-on-update and cleanup on sandbox lifecycle events * End-to-end tests covering the full token lifecycle from claim through gateway verification to ID token propagation and refresh * A design proposal and user-facing documentation * Recommended Skills: * Go programming (strong proficiency required) * Kubernetes (CRDs, controllers, controller-runtime, Secrets, RBAC) * JWT, OIDC, and JWKS concepts (token signing, claim design, key rotation) * Cryptography fundamentals (asymmetric keys, RSA/ECDSA, X.509) * Kubernetes operator patterns and reconciliation loops * E2E testing (Ginkgo, pytest)

  • Go
  • Kubernetes
  • OIDC
  • JWT

Term 2 · Jun-Aug · 3 projects

• Build Document Agent for OpenKruise Website

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  The OpenKruise ecosystem comprises multiple rapidly evolving projects, each with its own documentation, blogs, and resources scattered across repositories. Maintaining up-to-date, coherent documentation is challenging. This project aims to build an intelligent document agent for the OpenKruise website that automates the collection, synchronization, and quality evaluation of documentation, blog posts, and other technical resources. The agent will leverage modern context engineering techniques (skills, MCP, RAG, AGENTS.md) to ensure content freshness, consistency, and discoverability across the entire OpenKruise project portfolio.

  • Go
  • Kubernetes fundamentals (CRDs
  • controllers
  • RBAC)
  • Context Engineering techniques (skills
  • MCP
  • +4

• Dynamic Volume Mounting for JuiceFS and Ceph in OpenKruise Agents

  LFX Mentorship · Listed in the official cohort

  @BH4AWSSource IssueLFX portal

  Dynamic volume mounting enables data persistence and sharing for pooled sandbox pods without relying on CSI plugins. This capability is essential for Agent workloads such as OpenClaw and Hermes, which need to save workspace data and share skills across sandboxes. Currently, OpenKruise Agents lacks support for open-source storage solutions like JuiceFS and Ceph, limiting adoption in on-premises environments. This project aims to integrate these storage backends by implementing CSI-plugin sidecars compatible with the Agent runtime and modifying the sandbox controller to support generic CSI volume mounting.

  • Go
  • Kubernetes (CRDs
  • controllers
  • RBAC)
  • Familiarity with CSI plugins (particularly JuiceFS and Ceph)
  • E2E testing frameworks (Ginkgo)

• Lightweight and Continuous Load Testing for OpenKruise Agents Using Kwok

  LFX Mentorship · Listed in the official cohort

  @AiRanthemSource IssueLFX portal

  Rapid, large-scale sandbox provisioning is critical for agentic workloads. OpenKruise Agents has optimized this through techniques like pooling and efficient sandbox discovery. To prevent performance regressions, continuous testing at scale is essential. This project will build a lightweight, resource-efficient load testing framework using Kwok to evaluate OpenKruise Agents' performance at scale (e.g., 100,000 sandboxes). Additionally, it will establish an automated workflow to regularly execute load tests and report performance metrics, ensuring consistent validation of provisioning capabilities.

  • Go
  • Kubernetes (CRDs
  • controllers
  • RBAC)
  • Familiarity with Kwok for cluster simulation
  • GitHub Actions workflow development and shell scripting

Term 1 · Mar-May · 4 projects

• KruiseGame Cloud-Hosted Version Development

  LFX Mentorship · Listed in the official cohort

  @chrisliu1995Source IssueLFX portal

  OKG has attracted many large game companies to embrace cloud-native transformation. However, for many small and medium-sized game companies, they are not familiar with the container and Kubernetes ecosystem. Due to their smaller team sizes, they have relatively weak infrastructure management capabilities. To democratize cloud-native technology for more game companies, OKG plans to launch a cloud-hosted version. Users can deploy the runtime environment with one click and complete game service integration based on the official SDK. This will reduce the complexity of using infrastructure for game companies and adapt to multi-cloud environments.

  • Go
  • Kubernetes
  • Cloud Provider SDKs (AWS/Alibaba Cloud)
  • Infrastructure as Code (Terraform/Pulumi)

• OpenKruise: Progressive Configmap Inplace Reloading

  LFX Mentorship · Listed in the official cohort

  @ABNER-1Source IssueLFX portal

  Native kubernetes configmap can reload dynamically but lack progressive rollout capability. OpenKruise community had comes up with the design of new workload for configmap rolling update, and the initial implementation has been running in one end user environment. However the current implementation is not generic enough and had many limitations. The goal is to complete the implementation in a more generic way and to support many configuration reloading strategies.

  • Go
  • kubernetes operator development

• OpenKruise: Promote API Version to v1beta1 part 2

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  Many advance workloads in OpenKruise are widely used in production, however the API version of the workload is still in v1alpha1. The goal is to promote the API version of mostly used and mature workload to v1beta1 and optimize the CRD fields for better clarity. This is a follow-up of previous project, and target API is the advance operation and resilience policy.

  • Go
  • kubernetes operator development

• OpenKruise: Rolling update for agent sandbox warm pool

  LFX Mentorship · Listed in the official cohort

  @zmbergSource IssueLFX portal

  OpenKruise Agents is a new sub-project of OpenKruise for agent sandbox lifecycle management. Warm pool is a key technology of OpenKruise Agents to ensure the fast sandbox provision. However existing warm pool lacks rolling update capability which makes the warm pool hard to maintain. The goal is to design and implement the basic rolling update capability for SandboxSet, the CRD for sandbox warm pool.

  • Go
  • kubernetes operator development

Term 3 · Sep-Nov · 4 projects

• Bring progressive delivery capability for native kubernetes DaemonSet

  LFX Mentorship · Listed in the official cohort

  @AiRanthemSource IssueLFX portal

  OpenKruise Rollout already support the progressive delivery of OpenKruise advance DaemonSet, however switching workload is not an option for many users. The goal is to utilize the OnDelete updateStrategy of native kubernetes workload, and trigger the pod upgrade by deleting desired number of pods per Rollout specification.

  • Go
  • kubernetes operator development

• Enhance Robustness and Usability of Kruise-Game

  LFX Mentorship · Listed in the official cohort

  @chrisliu1995Source IssueLFX portal

  kruise-game is being used by many game companies. It is imperative to build the stability of kruise-game components. With the rapid iteration of project functions, the current test coverage has not met expectations, so we need to add more UT and E2E use cases to ensure that there will be no problems with our basic functions. In addition, in a large-scale cluster environment, kruise-game also needs more indicators to reveal the performance of the current controller.

  • Go
  • Kubernetes

• Promote kruise api version from v1alphal1 to v1beta1

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  Many advance workloads in OpenKruise are widely used in production, however the API version of the workload is still in v1alpha1. The goal is to promote the API version of mostly used and mature workload to v1beta1 and optimize the CRD fields for better clarity.

  • Go
  • kubernetes operator development

• SidecarSet support setting sidecar resources adaptively

  LFX Mentorship · Listed in the official cohort

  @zmbergSource IssueLFX portal

  SidecarSet is an advance workload for sidecar container injection and upgrade. Currently the sidecar container resource must be set explicitely in the sidecar template, however in the cases of traffic proxy, log collection and device emulation etc, it is desirable to to set the resources according to resource of app container. The goal is to support the adaptively setting for sidecar resources and provide best practice for typical use cases.

  • Go
  • kubernetes operator development

Term 2 · Jun-Aug · 4 projects

• add best practice to use openkruise workload with Karmada etc

  LFX Mentorship · Listed in the official cohort

  @zmbergSource IssueLFX portal

  Karmada and OCM are popular multi-cluster orchestration system, OpenKruise advance workload had been integrated with these orchestration system by community users, this project aims to provide official guidelines for the usage of OpenKruise in Karmada and OCM.

  • Kuberntetes
  • technical document writing with markdown

• Build simple dashboard to view and operate OpenKruise workload

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  Currently, OpenKruise depends solely on the PaaS or CLI to listing OpenKruise workload display and operations. The lack of a general purpose Web-UI greatly hinder the adoption among developer users. This project is about to build a simple Web-UI that can list OpenKruise workload along with the native K8s workload, and support enhanced operation such as container restart or workload rollout. The Web-UI is preferably developed using UI extensions of existing PaaS e.g. Kubesphere and Rancher.

  • UX/UI(react)
  • JavaScript
  • Go
  • Kubesphere/Rancher development(prefered but not mandatory )

• OpenKruiseGame controlplane HA deployment support

  LFX Mentorship · Listed in the official cohort

  @chrisliu1995Source IssueLFX portal

  The Kruise Game Controller Manager currently stores cache information for network plugins in memory, resulting in its single-replica deployment. From a business stability architecture perspective, it is necessary to migrate the cache out of memory to enable Kruise Game to transition to a multi-replica deployment. Besides, the current webhook certificate is self-signed by the controller. When the number of copies is more than one, an unauthenticated error will occur, so this needs to be modified.

  • Go
  • Kubernetes

• Support progressDeadlineSeconds for Cloneset

  LFX Mentorship · Listed in the official cohort

  @ABNER-1Source IssueLFX portal

  CNCF - OpenKruise: progressDeadlineSeconds for CloneSet (2025 Term 2) This project aims to support progressDeadlineSeconds in CloneSet so as to provide information about whether the deployment is failed. The meaning of progressDeadlineSeconds is quite similar to the one in native kuberentes workload(deployment), but it need extra support for the time counting during CloneSet is paused due to partition restriction.

  • Kubernetes
  • Go
  • operator development

Term 1 · Mar-May · 1 project

• Implement Fuzz testing for OpenKruise

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  Implement fuzz testing for OpenKruise using a suitale tool like oss-fuzz. Generate a comprehensive input set to guide the fuzz testing, and identify features that accept complex user inputs for testing. Document the entire process for repeatability in future versions and integrate the fuzz testing into CI pipeline.

  • Go
  • Kubernetes
  • Fuzz Testing Experience

Term 3 · Sep-Nov · 2 projects

• Game operation and maintenance API

  LFX Mentorship · Listed in the official cohort

  @ringtailSource IssueLFX portal

  kruise-game contains two CRDs GameServer and GameServerSet. Game servers can be managed by deploying or changing the corresponding CR. However, in actual production use, a release or operation and maintenance action is often a combination of a series of operations on CR. For example, set the GameServer image tag with ids 1, 7, and 10 to v0.3; adjust the update priority of GameServer with ids 5, 9, and 11 before updating the game server, etc. Therefore, a set of APIs with operation and maintenance semantics is needed, which users can directly use or integrate into their own operation and maintenance platform to facilitate operation and maintenance operations.

  • Go
  • Kubernetes
  • RESTful API

• Visualize Kruise Rollout progress with kubectl plugin

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  Kruise Rollout provide plugin-n-play progressive delivery for cloud native apps. The goal of this project is to develop a kubectl plugin so as to visualize rollout progress, e.g. the rollout steps, traffic status and involved pods. The kubectl plugin can leverage the existing kruise kubectl plugin project, and can use the Argo kubectl plugin as a reference.

  • Kubernetes
  • Go

Term 2 · Jun-Aug · 1 project

• Enhancement for Kruise-Game Dashboard

  LFX Mentorship · Listed in the official cohort

  @chrisliu1995Source IssueLFX portal

  The OpenKruiseGame Dashboard is presently in its basic form, and we aim to significantly expand its functionality going forward. We plan to introduce features such as the ability to filter game servers and perform batch updates on them.

  • Kubernetes
  • nodejs
  • javascript

Term 1 · Mar-May · 1 project

• Build simple Web-UI that can integration with exiting PaaS

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  Currently, OpenKruise depends solely on the PaaS or CLI to listing OpenKruise workload display and operations. The lack of a general purpose Web-UI greatly hinder the adoption among developer users. This project is about to build a simple Web-UI that can list OpenKruise workload along with the native K8s workload, and support enhanced operation such as container restart or workload rollout. The Web-UI can be served directly as a dashboard , or as an example of OpenKruise integration in PaaS.

  • UX/UI
  • JavaScript
  • GoLang (a plus but not mandatory)

Term 3 · Sep-Nov · 1 project

• Integrate Openkruise workload with ArgoCD and Helm

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  ArgoCD and Helm are popular tools to delivery k8s workload, yet currently only the k8s built-in workload are supported out-of-box for ArgoCD and Helm. OpenKruise provide advanced worklood that resemble with the built-in workload, users can use OpenKruise workload with ArgoCD and Helm, yet they cannot tell ArgoCD and Helm whether Openkruise workload is ready or not.

  • Lua
  • Docker
  • Kubernetes

Term 1 · Mar-May · 2 projects

• Bring progressive delivery to daemon workload

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  Kruise Rollout enable progressive delivery of various workload ranging from stateless workload such as Deployment to stateful workload such as StatefulSet or customized operators. This project aims to bring progress delivery capability to daemon workload, which is run on each node of a k8s cluster. The project involves implementing common API of progressive delivery for OpenKruise Advance DaemonSet, and integrate with the Kruise Rollout framework.

  • Go
  • Kubernetes

• Support customize arbitary fields of workload subset in UnitedDeployment

  LFX Mentorship · Listed in the official cohort

  @furykerrySource IssueLFX portal

  UnitedDeployment in OpenKruise enable users to manage a set of k8s workloads in whole while be able to customize the topology and replicas of each workload. This project extends the customization capability to arbitary workload fields by adding common patch fields, so that each subset of UnitedDeployment can have different metadata, container configuration etc.

  • Go
  • Kubernetes