Third-Party Licenses
KubeManta's shipped container images (kubemanta-agent, kubemanta-ui) bundle
the third-party open-source components listed below, each under its own license.
This file preserves the attribution those licenses require when the images are
distributed.
Scope — bundled vs. integrated vs. spawned. Three different relationships, with three different sets of obligations:
| Relationship | Meaning | Who licenses it |
|---|---|---|
| Bundled | Shipped inside a KubeManta image. We redistribute it. | Attributed here; obligations are ours |
| Spawned at runtime | Your cluster pulls the image from its upstream registry when you enable a feature. We never redistribute the bytes. | You, from the upstream project |
| Integrated | A separate program KubeManta talks to over the network (HTTP, iframe). | You run and license it yourself |
Not bundled: proprietary CLIs (e.g. @anthropic-ai/claude-code) are not
included in any image. Anything a user installs themselves in the terminal (via
npm install -g into their own home volume) is licensed to them directly by its
vendor, under that vendor's terms.
Regenerate the authoritative, version-pinned form with
scripts/gen-third-party-licenses.sh, which runspip-licenses+license-checkeragainst the real manifests and fails on any newly introduced strong-copyleft (GPL/AGPL/SSPL) dependency. Weak-copyleft components (LGPL, MPL, CC-BY) are called out explicitly below.
No GPL or AGPL code is linked into, or compiled into, any KubeManta
application binary. Verified against agent/requirements.txt (87 resolved
packages) and ui/package.json (96 resolved production packages). The only
copyleft in the application trees is LGPL and MPL, addressed below.
Base images & system tooling
Agent image — ubuntu:24.04
| Component | License |
|---|---|
| Ubuntu 24.04 (base OS) | Individual packages under GPL-2.0 / GPL-3.0 / LGPL / MIT / BSD — see Source offer below |
| Python 3.12 | PSF License (BSD-style) |
| Node.js 24 LTS | MIT (with bundled OpenSSL / V8 / etc. under their own permissive licenses) |
| kubectl | Apache-2.0 |
| Helm | Apache-2.0 |
| k9s | Apache-2.0 |
| libxml2 | MIT |
| libxmlsec1 / libxmlsec1-openssl / xmlsec1 | MIT |
| bash, coreutils, git, less, procps, net-tools | GPL-2.0 / GPL-3.0 — see Source offer below |
| curl, ca-certificates, jq, vim, dnsutils | curl (MIT/X derivative) · jq (MIT) · vim (Vim License, GPL-compatible charityware) · dnsutils (MPL-2.0) |
UI image — node:24-alpine
| Component | License |
|---|---|
| Alpine Linux (base OS) | musl libc (MIT) · busybox (GPL-2.0) · apk-tools (GPL-2.0) — see Source offer below |
| Node.js 24 LTS | MIT |
Agent — Python (agent/requirements.txt)
Direct dependencies. Transitive dependencies resolve to MIT / BSD / Apache-2.0 / PSF, except the MPL-2.0 components called out under Copyleft notes.
| Package | License |
|---|---|
| fastapi | MIT |
| uvicorn[standard] | BSD-3-Clause |
| kubernetes (client) | Apache-2.0 |
| httpx | BSD-3-Clause |
| python-multipart | Apache-2.0 |
| aiosqlite | MIT |
| openai | Apache-2.0 |
| bcrypt | Apache-2.0 |
| cryptography | Apache-2.0 OR BSD-3-Clause |
| boto3 | Apache-2.0 |
| google-cloud-compute | Apache-2.0 |
| azure-mgmt-network / azure-mgmt-resource / azure-identity | MIT |
| python3-saml | MIT |
| authlib | BSD-3-Clause |
| ldap3 | LGPL-3.0 — see Copyleft notes |
| fpdf2 | LGPL-3.0-only — see Copyleft notes |
| certifi (transitive) | MPL-2.0 — see Copyleft notes |
| tqdm (transitive) | MPL-2.0 AND MIT — see Copyleft notes |
Code adapted from other projects
Source that is not a dependency but was ported into KubeManta's own code.
| Origin | License | Where |
|---|---|---|
kubectl pkg/describe, pkg/util/{rbac,qos,storage,deployment} and component-helpers resource — Copyright The Kubernetes Authors |
Apache-2.0 | agent/app/describe*.py: the kubectl describe text layouts, ported to Python so All Resources prints what kubectl prints |
Go standard library text/tabwriter (alignment algorithm) — Copyright The Go Authors |
BSD-3-Clause | agent/app/describe_fmt.py |
UI — JavaScript (ui/package.json)
| Package | License |
|---|---|
| next | MIT |
| react / react-dom | MIT |
| @monaco-editor/react / monaco-editor | MIT |
| monaco-yaml | MIT |
| @xterm/xterm | MIT |
| @xterm/addon-fit / @xterm/addon-web-links / @xterm/addon-webgl | MIT |
| react-force-graph-2d | MIT |
| http-proxy (+ eventemitter3, follow-redirects, requires-port) | MIT |
| @swc/helpers, detect-libc, sharp | Apache-2.0 |
| tslib | 0BSD |
| d3-ease, source-map-js | BSD-3-Clause |
| @img/sharp-libvips-linux-x64 / -linuxmusl-x64 | LGPL-3.0-or-later — see Copyleft notes |
| dompurify | MPL-2.0 OR Apache-2.0 — we elect Apache-2.0 |
| caniuse-lite | CC-BY-4.0 — attribution: © Browserslist contributors, https://github.com/browserslist/caniuse-lite |
Spawned at runtime (not bundled in any image)
Your cluster pulls these from their upstream registries only when you enable the corresponding feature. KubeManta redistributes none of them; each is governed by its own upstream license, and each tag is pinned by the chart (override for an allowed-repos mirror or an air-gapped registry).
| Component | Default image | License | Enabled by |
|---|---|---|---|
| Trivy | aquasec/trivy |
Apache-2.0 | Container self-scan (security.scanning) — its vulnerability DB is likewise Apache-2.0 |
| Prometheus | quay.io/prometheus/prometheus:v3.5.5 |
Apache-2.0 | Guided Prometheus deploy (/observability/prometheus/deploy) |
| kube-state-metrics | registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0 |
Apache-2.0 | Deployed alongside the guided Prometheus (metrics.prometheusDeploy.ksmImage to mirror it) |
| HAProxy | haproxy:3.2.25-alpine (pinned by digest) |
GPL-2.0-or-later — a separate process in its own container; KubeManta links none of its code | In-pod TLS sidecar (tlsSidecar.enabled) |
| netshoot | nicolaka/netshoot:v0.16 |
Apache-2.0 | Network Analyzer active probe (netAnalyzer.probeImage) |
| Litestream | litestream/litestream:0.3.13 |
Apache-2.0 | SQLite replication sidecar (litestream.enabled) |
| Python (preflight) | python:3.12-alpine |
PSF-2.0 + Alpine base (see above) | Preflight install hook |
| cert-manager | quay.io/jetstack/cert-manager-controller, quay.io/jetstack/cert-manager-webhook, quay.io/jetstack/cert-manager-cainjector, quay.io/jetstack/cert-manager-startupapicheck, quay.io/jetstack/cert-manager-acmesolver (all v1.21.2) |
Apache-2.0 | Optional cert-manager subchart (global.installCertManager) |
Integrated — external services KubeManta connects to
KubeManta communicates with these over the network (HTTP API or <iframe>
embed). They are separate programs, run and licensed by you. KubeManta
contains none of their code, links against none of their libraries, and
redistributes none of their binaries. Listed for procurement completeness.
| Service | License | How KubeManta uses it |
|---|---|---|
| Grafana | AGPL-3.0 (OSS edition, v9+) | Embeds your Grafana's dashboard URLs in an <iframe>. No Grafana code is bundled, modified, or served by KubeManta, so AGPL §13 is not engaged. Grafana Labs' trademark policy governs use of the name and logo — KubeManta uses the name nominatively ("embed your Grafana dashboards") and claims no affiliation or endorsement. |
| Prometheus | Apache-2.0 | PromQL queries over HTTP |
| Alertmanager | Apache-2.0 | Receives inbound alert webhooks |
| trivy-operator | Apache-2.0 | Reads your operator's VulnerabilityReport / ConfigAuditReport CRDs |
| Kubernetes API server | Apache-2.0 | All cluster reads and writes |
| AWS / GCP / Azure APIs | Vendor terms | Cloud network topology, when credentials are configured |
Copyleft notes
Source offer — GPL / LGPL components of the base operating systems
The kubemanta-agent image is built on Ubuntu 24.04 and the kubemanta-ui
image on Alpine Linux (via node:24-alpine). Both base images contain
system utilities licensed under the GNU General Public License (v2 and v3)
and the GNU Lesser General Public License — for example bash, coreutils,
git, procps and net-tools on Ubuntu, and busybox and apk-tools on
Alpine.
KubeManta redistributes these binaries unmodified, as an aggregate alongside its own separately-licensed application. No KubeManta code is a derivative work of any GPL component; the application communicates with them only by executing them as separate programs.
Written offer. For any GPL- or LGPL-licensed component in these images, and for three (3) years from your receipt of the image, we will provide the complete corresponding machine-readable source code, on request, for no more than our cost of physically performing the distribution. Write to [email protected] naming the image tag and the component.
The identical source is also published continuously by the upstream distributors, which you may use instead:
- Ubuntu —
https://archive.ubuntu.com/ubuntu/pool/· or, from inside the running container:apt-get source <package> - Alpine —
https://git.alpinelinux.org/aports/· package sources viahttps://pkgs.alpinelinux.org/ - BusyBox —
https://busybox.net/downloads/
LGPL-3.0 — ldap3, fpdf2 (Python)
Licensed under the GNU Lesser General Public License v3.0. KubeManta uses
them as unmodified, dynamically imported Python dependencies. The LGPL
permits this in a commercial/closed application provided the LGPL component is
not modified and can be replaced by the user. To exercise that right, install
the exact versions pinned in agent/requirements.txt from PyPI:
- ldap3 — https://pypi.org/project/ldap3/ · source: https://github.com/cannatag/ldap3
- fpdf2 — https://pypi.org/project/fpdf2/ · source: https://github.com/py-pdf/fpdf2
LGPL-3.0-or-later — @img/sharp-libvips-* (UI)
The sharp image library (Apache-2.0) loads libvips, distributed as the
prebuilt native binaries @img/sharp-libvips-linux-x64 and
@img/sharp-libvips-linuxmusl-x64 under LGPL-3.0-or-later. These are
present in the UI build tree and are included in the runtime image whenever
Next.js traces its image optimizer into the standalone output.
libvips is used unmodified and is loaded dynamically as a shared object at
runtime, satisfying LGPL-3.0 §4 — you may replace it with your own build. To do
so, obtain the corresponding version from
https://github.com/libvips/libvips and replace the .so inside
node_modules/@img/.
MPL-2.0 — certifi, tqdm (Python), dompurify (UI)
The Mozilla Public License 2.0 is file-level copyleft: it attaches to the MPL-licensed files themselves, not to a larger work that merely uses them. KubeManta uses all three unmodified, so no MPL source disclosure is triggered beyond the upstream sources, available at:
- certifi — https://github.com/certifi/python-certifi
- tqdm — https://github.com/tqdm/tqdm (MPL-2.0 AND MIT)
- dompurify — https://github.com/cure53/DOMPurify (dual-licensed; we elect Apache-2.0)
CC-BY-4.0 — caniuse-lite (UI)
Browser-support data (not code) under Creative Commons Attribution 4.0, attributed above as the license requires. Consumed at build time by Browserslist.
Full license texts for every component are available in each project's
distribution (PyPI / npm) and repository, and inside the shipped images under
/usr/share/doc/*/copyright (agent) and node_modules/*/LICENSE (UI).
Questions about licensing or a source request: [email protected].