Trusted builds made easy
A cloud-native software factory for building, testing, and releasing trusted software artifacts
Website • User Docs • Admin Docs • Architecture • Getting Started
What is Konflux?
Konflux is an open-source, Kubernetes-native CI/CD platform that manages the full software delivery lifecycle for software artifacts — with supply chain trust built in from the start. Built on Tekton and the Conforma policy framework, it brings together best-in-class open source projects into a single, integrated software factory. Managed by a Kubernetes operator, Konflux runs on Kind, OpenShift, and any conformant Kubernetes cluster.
Try Konflux
Want to see it in action? You can have a full Konflux instance running on a local Kind cluster in just a few minutes — no cloud account, no complex setup. Jump into the Local Deployment Guide and start building!
Key Features
| Feature | Description | |
|---|---|---|
| Build | Automated Pipelines | Triggers Tekton pipelines on every pull request and merge, producing signed container images with attached SBOMs |
| Test | Integration Testing | Runs integration test scenarios after each build, using pluggable pipelines and Conforma policies to gate releases |
| Release | Managed Releases | Orchestrates releases to target registries through declarative configuration |
| Trust | Supply Chain Trust | Every artifact is signed with cosign, attested with SLSA provenance, and policy-checked before release |
Ecosystem
Konflux integrates with leading open-source projects out of the box, while remaining flexible enough to work with your preferred tools:
- Pipelines — Tekton
- Builds — Buildah, Hermeto (prefetching content for network-isolated builds)
- Trust & Signing — Sigstore, Conforma
- Scanning & SBOMs — Clair, ClamAV, Trustify (SBOM storage & dependency analytics)
- Registry — Quay, Zot (or any OCI-compatible registry)
- Dependency Updates — Renovate (Mintmaker)
- Scheduling — Kueue (PipelineRun queuing & scheduling)
- Authentication — Dex (with support for OIDC, GitHub, LDAP, and more)
Contributing
We welcome contributions from the community! Whether it's bug reports, feature requests, documentation improvements, or code contributions — every bit helps.
- Read our Contributing Guide to get started
- Join us on Slack to chat with the community
- Check out our open issues for ways to contribute
- Report a bug or request a feature
- Found a security vulnerability? Please report it privately via GitHub's security advisories
Release Process
See RELEASE.md for the release process and versioning policy.
License
Konflux is licensed under the Apache License 2.0.