W'xOps

Free plan APILinuxMacSelf-hostedWebWindows

What W'xOps is

W'xOps is a self-hosted internal developer portal for teams working with Kubernetes. It runs as a portal container on a hub Kubernetes cluster, and its searchable service catalog reads Backstage-compatible YAML from a gitops-infra repository without requiring a database or catalog server. Users share identity across clusters through Pinniped, while Kubernetes RBAC determines what they can see on spoke clusters.

The portal is designed to keep configuration changes on a reviewed path rather than writing directly to Kubernetes. Its scaffold wizard previews generated manifests, creates a service repository and deployment configuration, and opens a pull request. Lifecycle promotions are also handled through role-gated pull requests, with platform-team review at later stages. Darlane provides on-demand parallel debug deployments alongside live workloads, with role gating and copyable kubectl and mirrord commands.

W'xOps can write to Vault but cannot read secrets back or delete secret paths. It logs write actions as structured JSON to stdout. The catalog supports Component, API, Resource, System, Group, User, and Doc kinds, but not Location or Template kinds. The documentation includes a CLI and API reference and describes the project as open source from version 0.6.x. The maker says enterprise deployments receive case-by-case access to the portal image in a private registry; pricing is available on request.

Who it suits

W'xOps is for platform and development teams already running Kubernetes, particularly those that want portal data to remain within their infrastructure. It may suit teams seeking a self-service catalog, pull-request-based workflows, and controlled access across clusters.

What it does well

Searchable catalog uses Backstage-compatible YAML without a database or catalog server.
RBAC controls what users can see on spoke clusters.
Scaffolding previews manifests and opens a pull request.
Lifecycle promotions use role-gated pull requests.
Includes a CLI and API reference.

What to know first

Requires teams to run Kubernetes.
The maker says it lacks a broad third-party plugin ecosystem.
The portal image is in a private registry with case-by-case enterprise access.
Vault secret paths cannot be read back or deleted through the portal.

Limits

The catalog does not implement Location or Template kinds. The portal can write to Vault but cannot read secrets back or delete secret paths.

Getting started

Review the W'xOps deployment guide.
Arrange access to the portal image; enterprise access is granted case by case.
Deploy the portal container on a hub Kubernetes cluster.
Prepare the listed deployment components, including identity, GitOps, and Vault integrations as needed.
Use the wxops CLI or API reference alongside the portal.

Verdict

Choose W'xOps if your team already runs Kubernetes and wants self-service workflows routed through reviewed pull requests and GitOps sync. Look elsewhere if you do not plan to use Kubernetes or need a broad third-party plugin ecosystem.

Questions

Is W'xOps open source?

The documentation says W'xOps is open source from version 0.6.x and open for contributions.

How is pricing handled?

The pricing model is paid, with pricing on request. A free plan is also indicated.

Where does W'xOps run?

It is self-hosted as a portal container on a hub Kubernetes cluster.

What does the service catalog support?

It supports Component, API, Resource, System, Group, User, and Doc kinds. Location and Template kinds are not implemented.

How does it handle Kubernetes configuration changes?

The portal does not write directly to Kubernetes. Changes go through reviewed Gitea pull requests and ArgoCD sync.

Can W'xOps read Vault secrets?

No. It can write to Vault but cannot read secrets back or delete secret paths.

Facts from W'xOps's own pages

Audit: The documentation says write actions are logged as structured JSON to stdout, including scaffolding, Vault writes, and promotions. · docs.wxops.cloud, 8 Oct 2026
Availability: The deployment guide says the portal image is in a private registry and access is granted case by case for enterprise deployments. · docs.wxops.cloud, 8 Oct 2026
Catalog limits: The catalog supports Component, API, Resource, System, Group, User, and Doc kinds; Location and Template kinds are not implemented. · docs.wxops.cloud, 8 Oct 2026
CLI and API: The documentation provides a wxops command-line interface and an API reference. · docs.wxops.cloud, 8 Oct 2026
Cluster security: The portal does not write to Kubernetes; configuration changes go through Gitea pull requests and ArgoCD sync. · docs.wxops.cloud, 8 Oct 2026
Debugging: Darlane provides on-demand parallel debug deployments alongside live workloads, with role gating and copyable kubectl and mirrord commands. · docs.wxops.cloud, 8 Oct 2026
Deployment: W'xOps is described as a single Go binary with an embedded Next.js frontend and no database, cache, or message queue. · docs.wxops.cloud, 8 Oct 2026
Identity: W'xOps derives permissions from Pinniped group membership and uses Kubernetes RBAC to control what users can see on spoke clusters. · docs.wxops.cloud, 8 Oct 2026
Integrations: The documented platform ecosystem includes Gitea, ArgoCD, Crossplane, Vault, Pinniped, and Kubernetes. · docs.wxops.cloud, 8 Oct 2026
Intended users: The maker says W'xOps is suited to teams already running Kubernetes, especially those that need data to stay inside their infrastructure. · docs.wxops.cloud, 8 Oct 2026
Lifecycle promotion: Lifecycle promotion is PR-driven and role-gated, with platform team review for later stages. · docs.wxops.cloud, 8 Oct 2026
Limits: The maker says W'xOps is Kubernetes-native and may not suit teams without Kubernetes; it also notes that it lacks a broad third-party plugin ecosystem. · docs.wxops.cloud, 8 Oct 2026
Maker and location: The documentation footer identifies the W'xOps Platform Team and says the project is made in Vietnam; it does not state a headquarters or founding date. · docs.wxops.cloud, 8 Oct 2026
Multi-cluster access: The portal uses Pinniped for shared identity across Kubernetes clusters and derives access from Kubernetes RBAC. · docs.wxops.cloud, 8 Oct 2026
Notable limitation: The maker says W'xOps may not fit teams that need a broad third-party plugin ecosystem or do not plan to run Kubernetes. · docs.wxops.cloud, 8 Oct 2026
Open source: The documentation states that from version 0.6.x W'xOps is open source and open for contributions. · docs.wxops.cloud, 8 Oct 2026
Product: W'xOps describes itself as an internal developer portal for Kubernetes-native teams. · docs.wxops.cloud, 8 Oct 2026
Scaffolding: The scaffold wizard creates a service repository and deployment configuration through a workflow that previews generated manifests and opens a pull request. · docs.wxops.cloud, 8 Oct 2026
Secret handling: The maker says the portal does not read secrets, to avoid making it a secret exfiltration path. · docs.wxops.cloud, 8 Oct 2026
Secrets: The portal can write to Vault but cannot read secrets back or delete secret paths. · docs.wxops.cloud, 8 Oct 2026
Security design: The maker says the portal does not write directly to Kubernetes; configuration changes go through reviewed Gitea pull requests and GitOps sync. · docs.wxops.cloud, 8 Oct 2026
Service catalog: The searchable catalog reads Backstage-compatible YAML from a gitops-infra repository and requires no database or catalog server. · docs.wxops.cloud, 8 Oct 2026
What it does: W'xOps describes itself as an internal developer portal for Kubernetes-native teams. · docs.wxops.cloud, 8 Oct 2026

Where W'xOps stands on Freedom251

Internal Developer Portals#14 of 27