Skip to main content

Kubernetes declares.
Kairon orchestrates.

Real VMs on Kubernetes — without KubeVirt. A Machine is desired state in the API. kairon-controller places it. kairon-node turns that into FluxVM — QEMU, Cloud Hypervisor, Firecracker, or the FluxVM hypervisor — on real KVM. No per-VM wrapper Pod, no libvirt, no guessed hypervisor migration endpoints.

Get StartedView on GitHub

Why Kairon

KubeVirt-style stacks run each VM inside a virt-launcher Pod wrapping libvirt — a large Go/operator surface with scheduling extras bolted onto the Pod scheduler. Kairon takes a different, smaller path: a node agent talks directly to FluxVM's REST API, with Kairon's own least-loaded placement deciding where a Machine lands.

Runtime code is Go standard library only — no client-go, no generated deep call stacks, no vendored operator framework. kairon-controller and kairon-node are each small enough to read in an afternoon. And when a live migration commit becomes genuinely ambiguous, Kairon names that state (NeedsRecovery) and waits for an operator's attested decision, rather than risking split-brain.

Machine CRD, full lifecycle

MachineSet, instance types, PVC/CSI boot, image import, DRA→VFIO, hotplug, pause/halt, sandboxes — one CRD family, not a virt-launcher Pod.

Real placement, not a stub

Ready, capable-labeled nodes; least-loaded with deterministic tie-break; hard affinity and topologySpreadConstraints.

Secure live migration handshake

TLS 1.3 mTLS prepare → transfer → commit, no user-supplied tcp: URIs, and NeedsRecovery when a commit is genuinely ambiguous.

Network Fabric

Rich spec.network, MachineNetworkPolicy, NetworkSecurityGroup, and Service Fabric VIP membership through to the FluxVM eBPF edge.

kaironctl & dashboard

Full CLI (and kubectl kairon plugin) plus optional kairon-ui with SSO, VNC, and the NeedsRecovery recovery workflow.

Go standard library only

No client-go, no generated deep call stacks — kairon-controller and kairon-node stay small enough to audit. Opt-in OIDC/CSI are the only exceptions.

Open, and honest about its limits

Apache-2.0. v0.6.0 ships admission webhooks, dashboard SSO, MachineSet, pause/halt, snapshot schedules, and more — cold relocation, snapshots, DRA bridging, the secure live control plane, and a real FluxVM migration adapter are tested. Real two-host live migration has not yet been exercised against real hardware in this repo's own CI. Production gaps stay listed, not glossed over.

Read status & production gaps →
CI statusApache 2.0 licensev0.6.0

Need production support or SLAs?

Kairon's core is Apache-2.0 and free to run in personal, lab, and commercial production use at no charge. Zyvor Enterprise adds production support, SLAs, and additional products for teams that need them.

Contact sales@zyvor.dev