Repo brief: kumahq/kuma

Generated by RepoPilot · document generated 2026-09-17 · concise human review Evidence snapshot · analyzed 2026-09-17T03:11:44.188Z · commit 2dab9fc7871d

Verdict

Mixed — Open vulnerabilities flagged by OpenSSF Scorecard

• Last commit today
• 7 active contributors
• Apache-2.0 licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

Kuma is an Envoy-based multi-zone service mesh designed to run on Kubernetes, VMs, and any cloud environment. It provides L4-L7 service connectivity, discovery, security, observability, and traffic control across containerized and virtual workloads without requiring Envoy expertise from users. The core innovation is its native multi-zone support that automatically propagates policies and enables cross-cluster communication. Multi-component monorepo: app/cni/ contains the Kubernetes CNI plugin (with Linux/Darwin-specific logic in pkg/cni/) responsible for pod traffic interception; app/kuma-cp/ is the control plane with command routing and migration tools in cmd/. Testdata…

Start here

Open these first:

• app/kuma-cp/main.go — Entry point for the control plane component that orchestrates the Kuma service mesh.
• app/kuma-dp/main.go — Entry point for the data plane component that runs on each node and manages Envoy proxies.
• app/cni/cmd/kuma-cni/main.go — Entry point for the CNI plugin that handles transparent proxy injection in Kubernetes.
• app/kuma-dp/pkg/dataplane/envoy/bootstrap.yaml — Bootstrap configuration template for Envoy proxy initialization and startup.
• app/cni/pkg/install/main.go — Core installation logic for CNI plugin chain integration with existing network plugins.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Repository manifest (go.mod, Makefile) is not provided in the evidence. Before running any setup commands, verify the root directory for go.mod (Go module definition) and Makefile (build targets). Typical Go project…

Daily commands:

Makefile present (106KB) but full targets not visible. Inferred conventional workflow: make build or make test for verification. For dev: likely make run or direct go run ./app/kuma-cp/cmd for control plane, and…

…shortened for this brief.

Key cautions & unknowns

• Scorecard: known vulnerabilities detected (scored 0/10 by OpenSSF)
• Concentrated ownership — top contributor handles 67% of recent commits
• CNI chaining complexity: Kuma must inject into existing CNI plugins (Calico, Flannel, etc.) without corrupting their JSON configs; see app/cni/pkg/install/testdata/ golden files for expected transformations.…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.