cosmos.dev

What It Is

Cosmos is an OpenShift/Kubernetes Operators Catalog that offers multiple Operators focused on platform governance, security, GitOps, and cluster hygiene. Based on the available content, it is not a single tool but a collection of automated control components for platform teams, aiming to improve cluster compliance, auditability, and resource efficiency without adding heavy manual processes.

Core Features and Ecosystem

Karma generates dynamic trust scores by collecting signals from deployments, tests, scans, incidents, and more. It then applies different platform constraints to teams based on trust tiers, with enforcement handled through OpenShift-native Validating Admission Policies. Metadata Tagger provides declarative tagging policies and supports populating dynamic values from namespaces, ConfigMaps, or external APIs. URO is used to discover orphaned resources such as Secrets, ConfigMaps, PVCs, Services, and more than 20 other resource types, while reducing the risk of accidental deletion through grace periods, safety scores, and optional S3 backups.

On the security and workflow side, Breakglass provides time-limited, auditable emergency privilege escalation. It supports automatic or manual approval, multiple approvers, automatic RBAC creation, expiry cleanup, and audit log export to S3, Elasticsearch, Loki, or webhooks. Clotho handles change approvals, deployment windows, and manifest archiving. Scribe syncs runtime cluster changes back to Git, supporting GitHub, GitLab, Bitbucket, and Gitea, as well as YAML patches, Kustomize patches, or full resource output. IVO covers image discovery, registry allowlists, tag blocklists, digest and signature requirements, and integrates with Trivy, Grype, and Clair.

Pricing and Delivery

The available content does not disclose pricing, subscription tiers, licensing, whether it is open source, or whether commercial support SLAs are available. Although the product format is an Operator Catalog and is clearly intended for deployment in Kubernetes/OpenShift clusters, the public content does not clearly state whether it is fully self-hosted, how it is installed, or whether it depends on any cloud-hosted services.

Pros, Cons, and Who It Is For

Its main strength is broad coverage of platform governance scenarios, with extensive use of Kubernetes/OpenShift-native mechanisms. It is well suited to existing OpenShift platform teams, SREs, DevOps teams, and compliance or security teams. The downside is that the public information still reads more like a product catalog: it lacks architecture details, compatible versions, performance limits, installation examples, permission model specifics, and pricing. Before procurement or production rollout, teams should further validate the documentation and support capabilities.

Access from China and Alternatives

Access from mainland China, payment methods, and localized support are not mentioned in the available content, so the access status can only be considered unknown. If alternatives or complementary tools are needed, options such as Kyverno, OPA Gatekeeper, Argo CD, Flux, Trivy Operator, Kubecost, and Rancher Fleet can be evaluated by use case, though these typically cover only part of Cosmos’s capabilities.