Poros
Just-in-time access to Kubernetes, without standing privileges.
Kubernetes access usually outlasts the work that required it. Poros replaces permanent role bindings with explicit, time-bound grants.
Early alpha. The APIs are v1alpha1 and backward
compatibility is not guaranteed.
How it works
- Users request predefined access packages.
- Approval follows the policy on each package.
- The control plane signs every approved grant.
- An in-cluster agent creates and removes Kubernetes RBAC.
- PostgreSQL stores the audit trail and control-plane state.
Kubernetes remains the authorization boundary. The agent opens outbound connections to the control plane, so a managed cluster needs no inbound network path.
Components
| Component | Responsibility |
|---|---|
apiserver | Owns the API, persistence, audit records, enrollment, credentials, and signing keys. |
agent | Verifies grants and reconciles RBAC inside a managed cluster. |
proxy | Authenticates kubectl traffic and forwards it through agent tunnels. |
web | Server-rendered user and administrator interface. |
Security model
- Access grants carry issue and expiry times.
- The control plane signs grants with asymmetric keys, and agents verify before creating RBAC.
- Invalid or missing signatures fail closed.
- The proxy refuses access when it cannot record the request.
- The proxy carries stream payloads without inspecting or recording them.