Development Workspace Platform for Kubernetes. Give every developer on your team a real, persistent, browser- and SSH-reachable dev environment running on your own cluster, provisioned from a catalog you control.
Most "cloud dev environment" products ask you to run your code on somebody else's cluster and pay per seat. dwpk is different: it's an operator you run on your own Kubernetes, so your workspaces, your data, and your access control all stay where your infrastructure already lives.
A cluster admin picks which container images are on offer (a Python image, a Go image, whatever your team ships against) and how much CPU, memory, and GPU each person is allowed. From there, developers pick an image from the catalog, click create, and get a namespaced, quota-bound environment with a persistent home directory. They reach it over SSH, VS Code Remote-SSH, or a terminal in the browser, and sign in with whichever identity provider you already use: Entra ID, Google, GitLab, Keycloak, or GitHub.
There's no external database and no separate control plane to run. State lives in Kubernetes
objects, the same way Deployment and Service state does, so the platform inherits your
cluster's HA, backup, and RBAC story instead of inventing its own.
dwpk is three Go binaries sharing one API.
cmd/manager is a Kubebuilder operator. It reconciles
WorkspaceImage (catalog entries), UserSpace (one per person: namespace, quota, RBAC), and
Workspace (a running session, backed by a single-replica StatefulSet).
cmd/gateway is a stateless SSH gateway. It checks an incoming public key against the Workspace
that trusts it, then bridges the session in over pods/exec and pods/portforward. The workspace
image itself never runs sshd.
cmd/ui is the marketplace web UI: Go, templ, and htmx, with no SPA and
no JS build step. It runs OAuth2 login, then mints a short-lived Kubernetes token per request
through TokenRequest instead of holding standing cluster permissions of its own.
See Architecture for the complete design: the CRDs, the controller reconcile flows, the security model, and the rationale behind each of them.
git clone https://github.com/devops-ia/dwpk.git
cd dwpk
make install # CRDs into your current kubeconfig's cluster
go run ./cmd/manager & go run ./cmd/gateway # run locally against that kubeconfig
kubectl apply -k config/samples/ # a sample catalog entry, user, and workspaceThe full walkthrough, including cert-manager setup and connecting over SSH, is in Quick start.
The chart lives in a separate repo, devops-ia/helm-dwpk,
released independently of this one and published as an OCI artifact on ghcr.io:
helm upgrade --install dwpk oci://ghcr.io/devops-ia/helm-dwpk/dwpk \
--version <chart-version> \
-n dwpk-system \
--create-namespaceComponent images default to the ones this repo publishes on every release, so no image overrides
are needed unless you're running your own build. If you're turning on the UI, create the OAuth2
client secret first and point ui.oauth.existingSecret at it. Client secrets belong in a
Kubernetes Secret, not in values.yaml. The full install guide, including every provider's setup
and the raw-manifest alternative, is at
Installation.
make manifests generate # after touching api/v1alpha1 or a +kubebuilder marker
make lint-fix # gofmt + golangci-lint --fix
make test # unit tests plus envtest, against a real API servermake test covers internal/controller and internal/webhook with envtest, and
internal/gateway with both fake-client unit tests and an envtest integration suite — nothing in
this codebase mocks the Kubernetes API.
| Quick start | Zero to a running workspace |
| Installation | Helm and raw-manifest installs, OAuth2 setup |
| Architecture | Components, CRDs, reconcile flows |
| Administration | Managing the catalog and users |
| User guide | Using the marketplace UI |
| API reference | CRDs and the REST API |
| Troubleshooting | Common failures and fixes |
Read CONTRIBUTING.md before opening a pull request, api/v1alpha1
is a shared contract across the operator, the gateway, and the UI, and commit messages
follow Conventional Commits because
semantic-release reads them to cut versions.
Apache License 2.0, copyright DevOps IA. See LICENSE.