Blog on Open Component Model

We did a Hackathon!

Mon, 03 Aug 2026 10:00:00 +0200

Hackathon @ SAP Innovation Center Potsdam

From 21.07.2026 to 24.07.2026 we attended an SAP Hackathon @ SAP Innovation Center in Potsdam. This is one of, if not the best, locations that SAP has around the globe. SAP was so nice to provide us with food, drinks and a lovely set of people to work together with on interesting projects in the IPCEI-CIS initiative.

Component Discovery - the Missing Kubernetes Primitive

Thu, 30 Jul 2026 10:00:00 +0200

The Manual Grind

Platforms like OpenControlPlane run service providers that install and manage services (Flux, Crossplane, Kro, …) on behalf of their users. Each service provider needs to know which versions of a service are available and where to fetch the corresponding artifacts from. Today, that means hardcoding OCI references (image URLs, chart registries, pull secrets) into provider configs, per version, per service:

Creating an OCM Component for a non-trivial Application

Thu, 30 Jul 2026 10:00:00 +0200

The Problem

Thalamus is a large project with many moving parts. At the time of this writing, it has 11 components that must be bundled together so the entire stack can be deployed as one.

Shipping SBOMs with Your Components

Tue, 28 Jul 2026 10:00:00 +0200

The Problem

OCM already tells you which artifacts a component delivers: its Software Bill of Delivery. But that does not answer the question a security team actually has: “which dependencies are bundled inside those artifacts, and am I affected by this vulnerability?” Knowing a component ships an OCI image and a CLI binary as a resource does not tell anything about the packages and libraries buried inside that resource.

Welcome Ilja Weis to the OCM Technical Steering Committee

Thu, 23 Jul 2026 12:00:00 +0200

We are glad to announce that Ilja Weis from BWI GmbH has been voted into the OCM Technical Steering Committee.

BWI, the IT service provider for the German Armed Forces, joined the NeoNephos Foundation as a Premier Member earlier this year. Since then, the collaboration has been active: BWI contributed ocm-kit to the OCM community repository, a Go library and CLI tool for working with OCM-based Helm values templates. The TSC accepted the contribution unanimously in April 2026.

OCM v2: A Fresh Foundation for Secure Software Delivery

Mon, 30 Mar 2026 10:00:00 +0200

We are excited to announce OCM v2 — a ground-up rebuild of the Open Component Model tooling stack. A new CLI, Kubernetes controllers, and Go library — designed from the start for modularity, security, and community contribution. The entire stack continues to implement the OCM Specification v2, ensuring full compatibility with the standard that defines how components, resources, and signatures are represented.

What changed between legacy and new OCM Controllers

Mon, 16 Mar 2026 10:00:00 +0100

A walkthrough of the major architectural changes between the legacy ocm-controller and the new ground-up rebuild.