Kayra
v0.3Identity, tenancy and access control for your internal platform.
Kayra says who a caller is, which namespace — tenant — they act in, and what RBAC lets them do there. It keeps the catalog of the platform's APIs and which tenant is subscribed to which, and leaves each API to the team that owns it.
The problem
Why Kayra
- Every platform API re-implements authentication and “who may do what”.
- Tenants exist in each tool under a different name, joined by convention.
- Onboarding a team on a new API is a manual, undocumented sequence of steps.
Authentication
Bearer tokens from your OIDC identity provider, personal access tokens, and a portable kayra-cli to log in with.
RBAC
Group, Role, RoleBinding, cluster- and namespace-scoped, gated by real directory groups rather than a synced list.
Namespaces
The namespace is the tenant — not two things joined by a name.
API catalog
Register API groups and their owners; subscribe tenants to them; a reconciler turns subscriptions active.
Named after Kayra Han#
In Altai Turkic mythology, Kayra Han rose from the primordial waters, shaped the land and gave each of his sons a realm to govern. Kayra does the same for your platform: it creates namespaces, decides who rules what through RBAC, and leaves each API to the team that owns it.
Documentation
Find your way around
Getting started
Install Kayra, run it, bootstrap a token and create a tenant through to a running subscription.
Architecture 5
Overview · RBAC & auth · API registrations · Namespaces …
CLI
Reference for the kayra server binary and the portable kayra-cli client.
Packages 14
apiserver · authn · authz · clicontext …
Development
Build, test and documentation workflow for the Kayra repository, and its source layout.
Status
At a glance
- Version
- v0.3 — pre-1.0, APIs may change
- Storage
- etcd, or local files for development
- Binaries
kayra(server, reconciler) andkayra-cli(end users)- Built on
- lib
- License
- MIT
- Source
- github.com/infrapi/kayra
Contribute to Kayra
Issues, ideas and pull requests are welcome on GitHub.