Add core CNCF and industry-standard tools to existing sections

[mxm0z]

This adds 20 widely-adopted tools that the list is currently missing. Every entry is either a CNCF graduated/incubating project or a de-facto industry standard — no vendor submissions, no new categories, and no changes to existing entries.

The gaps that stood out most: there was no Kubernetes package manager listed at all, no distributed tracing tool of any kind, and the Security section had only two entries.

One commit per category, per the contribution guidelines.

Automation & Orchestration

• Helm — the package manager for Kubernetes (github.com/helm/helm, CNCF graduated)
• Kustomize — template-free Kubernetes configuration customization (github.com/kubernetes-sigs/kustomize, Kubernetes SIG)
• OpenTofu — community-driven fork of Terraform (github.com/opentofu/opentofu, Linux Foundation)
• Crossplane — build control planes with Kubernetes APIs (github.com/crossplane/crossplane, CNCF graduated)

OpenTofu is placed directly after the existing Terraform entry since they're directly related.

Continuous Integration & Delivery (On-premises)

• Argo CD — declarative GitOps CD for Kubernetes (github.com/argoproj/argo-cd, CNCF graduated)

Only the Argo umbrella project was listed; Argo CD is the component most people mean when referencing GitOps CD, so it seemed worth calling out explicitly alongside the existing Flux entry.

Observability & Monitoring

• OpenTelemetry — vendor-neutral traces, metrics and logs (github.com/open-telemetry, CNCF incubating)
• Jaeger — end-to-end distributed tracing (github.com/jaegertracing/jaeger, CNCF graduated)
• Thanos — HA Prometheus with long-term storage (github.com/thanos-io/thanos, CNCF incubating) — Metrics sub-list
• VictoriaMetrics — time series database and monitoring (github.com/VictoriaMetrics/VictoriaMetrics) — Metrics sub-list

OpenTelemetry is the current standard for instrumentation, and the list previously had no tracing tools at all.

Security

• Trivy — vulnerability and misconfiguration scanner (github.com/aquasecurity/trivy)
• Falco — cloud native runtime security (github.com/falcosecurity/falco, CNCF graduated)
• Open Policy Agent — general-purpose policy engine (github.com/open-policy-agent/opa, CNCF graduated)
• Kyverno — policy engine for Kubernetes (github.com/kyverno/kyverno, CNCF incubating)
• Sigstore — artifact signing and provenance (github.com/sigstore, OpenSSF)
• Gitleaks — detect hardcoded secrets in git repos

This section had only checkov and IntoDNS.ai, so it was the largest single gap.

Applications Platforms

• Kind — local Kubernetes clusters using Docker nodes (github.com/kubernetes-sigs/kind, Kubernetes SIG)

Productivity Tools

• k9s — terminal UI for Kubernetes clusters (github.com/derailed/k9s)

Databases

• ClickHouse — column-oriented analytical database (github.com/ClickHouse/ClickHouse) — Non-relational
• Valkey — key/value datastore forked from Redis (github.com/valkey-io/valkey, Linux Foundation) — Key-Value

VPN

• WireGuard — fast, modern and secure VPN tunnel (www.wireguard.com)

WireGuard was previously only referenced inside the Firezone description.

---

Notes for review

• Helm placement is open to your preference. I put Helm and Kustomize in Automation & Orchestration because that section already holds the deploy/config tooling (Terraform, Pulumi, KubeVela, Score, Atlantis). The Package Management & System configuration section is arguably a better semantic fit for Helm, but its description is scoped to OS-level isolated package builds. Happy to move them if you'd rather.
• Deliberately not included: OpenBao and External Secrets Operator, since Add OpenBao and ESO to Secret Management #502 already proposes those.
• All descriptions follow the [RESOURCE](LINK) - DESCRIPTION. format and are under 80 characters.
• Verified all 20 new links return HTTP 200, and that mkdocs build still succeeds.
• No existing entries were modified and no new sections were added.