Boring where it counts, built to last.
You do not need any of this to use Autharie. It is here for the engineers and auditors who want to know what runs their sign in.
Standard pieces, assembled and looked after
Rules for agents, as blocks or as code
Who, under which conditions, what it may do and what it may never do: a rule is checked on every action. Build it with blocks, or let your tech team keep it as code. Every decision is recorded end to end.
It tries to refund an order: the conditions are true, but the rule never allows refunds. Blocked, and recorded.
Written in Rust
Ferriskey is written in Rust, and so is everything Autharie adds on top of it. A control plane that exposes the API, an operator that looks after instances, and the agent that runs in your cluster.
Fast and light
The control plane, the operator and the data plane agent are single binaries that start in milliseconds and use little memory.
Safer by construction
No garbage collector and no whole classes of memory bugs. For the service that decides who may sign in, that matters.
SQL checked at compile time
A query that does not match the schema fails the build instead of failing in production.
It is Kubernetes under there, and it shows
Every instance is a custom resource. If you already run clusters, nothing here is a surprise, and kubectl still works the way you expect.
Reconciled, not deployed once
An operator compares what the cluster has against what the resource asks for, continuously. Delete a pod and it comes back.
Console, API or manifest
The console has no private door. Everything it does goes through the same documented API, and the client is generated from it.
Written in Rust
The control plane, the operator and the data plane agent. Compile time checked SQL, and a binary that starts in milliseconds.
apiVersion: autharie.fr/v1alpha
kind: IdentityInstance
metadata:
name: acme-production
spec:
provider: ferriskey
version: "1.4.2"
hostname: id.acme.com
allowedCidrs:
- 203.0.113.0/24
database:
mode: managedCluster
managedCluster:
instances: 3
storage:
size: 50Gi
backup:
destinationPath: s3://acme-identity-archives
encryption: "kms:acme-identity"
ingress:
enabled: true
tls:
enabled: true
clusterIssuer: letsencrypt$ kubectl get identityinstances
NAME PROVIDER VERSION PHASE READY AGE
acme-production ferriskey 1.4.2 Running true 97d
acme-staging ferriskey 1.4.2 Running true 97d
internal-sso ferriskey 1.4.1 Upgrading false 41dhelm upgrade --install autharie-dataplane charts/autharie-dataplane \
--namespace autharie-system --create-namespace \
--set dataplane.id=dp_8f2a41 \
--set controlPlane.url=https://api.autharie.fr \
--set controlPlane.auth.clientId=$CLIENT_ID \
--set controlPlane.auth.clientSecret=$CLIENT_SECRETOur clusters, or a machine you already own
The same platform on either side of the line. Start on ours because it is quicker, move to yours when a policy says the database has to stay home.
Register a cluster with one chart
Install the agent on a k3s or Kubernetes cluster you already run. It announces itself, reports what it has, and starts accepting work.
The data stays where you put it
Accounts, sessions and the database live in your cluster. The control plane sends intent and reads status back. It never holds your users.
Regions you name yourself
A data plane belongs to a region you declare, and a deployment is placed where you say it goes.
Shared or reserved
A cluster can take work from anyone on the platform, or be reserved for a single organisation and nothing else.
Nothing here you cannot take with you
You are paying for the operating, not for access to the software.
Ferriskey
The identity provider is open source. You can read the code that handles your users’ sign in.
No lock in by design
The database is ordinary Postgres and archives land in object storage. Leaving means taking a dump and a container image.
Built in the open
Ferriskey is developed publicly. Fixes and ideas you contribute are available to everyone.
Put your first agent under control
Tell us which agents you run. We open your space, and you write your first rule in a few minutes.
We read every request ourselves and open spaces in small groups during the private beta.