orka

module
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 21, 2026 License: MIT

README

Orka

Orka

Run AI agents on your Kubernetes cluster. The keys stay in the cluster.

Tests Release License

Getting started · Install · Docs · Contributing


Orka lets you hand a piece of work to an AI agent and get the result back, with Kubernetes doing what it is good at: running the work somewhere isolated, keeping a record of what happened, and cleaning up afterwards. You write a small YAML Task, Orka runs it in a Pod, and you read the answer from a REST API, a CLI, or the dashboard that comes built in.

Three kinds of work fit in a Task:

  • Ask a model. Orka's own AI worker talks to Anthropic, OpenAI, Azure OpenAI, or any compatible endpoint, with built-in tools such as web search and code execution.
  • Run a coding agent. Codex, Claude Code, GitHub Copilot CLI, or OpenCode, working on a real git repository and opening the pull request when it is done.
  • Run a command. Any container image, for the build and test steps agents ask for.

Model keys never leave the cluster. People and CI get a token; the platform team decides which models and providers are allowed.

[!IMPORTANT] Orka is experimental and under active development. APIs, CRDs, and behavior may change without notice between releases, and it is not yet recommended for production use. Feedback, bug reports, and feature ideas are very welcome — please open an issue.

[!NOTE] The organization and repositories are intended to be donated to a community-governed foundation at the appropriate time. Until then, the project is governed by Microsoft policy, and external contributors are required to sign the Microsoft Contributor License Agreement (CLA).

Try it in five minutes

You need a cluster, kubectl, and Helm. A local kind cluster is fine. No model API key yet.

helm repo add orka https://orka-agents.github.io/orka/charts
helm repo update orka
helm install orka orka/orka --namespace orka-system --create-namespace --wait --timeout 10m

That is the whole install. Now run something:

kubectl -n orka-system apply -f - <<'EOF'
apiVersion: core.orka.ai/v1alpha1
kind: Task
metadata:
  name: hello
spec:
  type: container
  command: ["sh", "-c", "echo hello from orka"]
EOF
kubectl -n orka-system get task hello --watch

When the phase reads Succeeded, Orka has run its first Task for you. From here, Getting started walks through connecting to the API, adding a model, and running your first AI Task and your first coding agent.

What people build with it

  • Pull request review on every PR. A repository monitor queues review Tasks as PRs arrive and posts the findings back.
  • "Just do it" chat. Describe what you want in plain language and an orchestrator creates and runs the Tasks, in the dashboard or over the API.
  • Agents on a schedule. Nightly dependency audits, security scans, or reports, with retries and notifications handled for you.
  • Your existing tools, safer. Point Cursor, Continue, or Claude Code at Orka's OpenAI- and Anthropic-compatible endpoints and stop handing out provider keys.

Why on Kubernetes

  • No keys on laptops. Provider credentials live in Secrets; people and CI get scoped tokens.
  • One place to govern. Models, providers, tools, and limits are set per Agent and per namespace.
  • Everything is a record. Tasks, sessions, artifacts, and the pull requests agents open are durable and auditable.
  • Scale with the cluster. Scheduling, retries, concurrency, and cron come from the control plane you already run.

Learn more

Join in

Questions, bug reports, and ideas are welcome in issues. If you want to contribute code, CONTRIBUTING.md has the setup and the review process, and SECURITY.md explains how to report a vulnerability privately.

License

MIT

Directories

Path Synopsis
api
acp.workspace/v1alpha1
Package v1alpha1 contains API schema definitions for the acp.workspace v1alpha1 API group.
Package v1alpha1 contains API schema definitions for the acp.workspace v1alpha1 API group.
fake.workspace/v1alpha1
Package v1alpha1 contains API schema definitions for the fake.workspace v1alpha1 API group.
Package v1alpha1 contains API schema definitions for the fake.workspace v1alpha1 API group.
gateway/v1alpha1
Package v1alpha1 contains API schema definitions for the gateway.orka.ai API group.
Package v1alpha1 contains API schema definitions for the gateway.orka.ai API group.
v1alpha1
Package v1alpha1 contains API Schema definitions for the core v1alpha1 API group.
Package v1alpha1 contains API Schema definitions for the core v1alpha1 API group.
workspace/v1alpha1
Package v1alpha1 contains API Schema definitions for the workspace v1alpha1 API group.
Package v1alpha1 contains API Schema definitions for the workspace v1alpha1 API group.
cmd
build/helmify command
Modified from open-policy-agent/gatekeeper cmd/build/helmify at c9b67657102032a460a28e7f3b9c88ec0c193453.
Modified from open-policy-agent/gatekeeper cmd/build/helmify at c9b67657102032a460a28e7f3b9c88ec0c193453.
build/release command
Command release prepares, qualifies, and publishes one immutable Orka release candidate.
Command release prepares, qualifies, and publishes one immutable Orka release candidate.
cli command
orka-admission command
orka-admission serves the stateless, fail-closed admission boundary shared by isolated harness-v1 and harness-v2 installations.
orka-admission serves the stateless, fail-closed admission boundary shared by isolated harness-v1 and harness-v2 installations.
internal
acp
admission
Package admission contains Kubernetes admission handlers for Orka CRDs.
Package admission contains Kubernetes admission handlers for Orka CRDs.
agentruntimepolicy
Package agentruntimepolicy resolves registered external runtime policy for Task producers that must materialize the exact brokered tool request.
Package agentruntimepolicy resolves registered external runtime policy for Task producers that must materialize the exact brokered tool request.
aitools
Package aitools resolves the effective built-in and configured tool set exposed to AI workers and brokered agent runtimes.
Package aitools resolves the effective built-in and configured tool set exposed to AI workers and brokered agent runtimes.
api
envutil
Package envutil parses process environment variables with the canonical, fail-closed rules shared by the Orka binaries.
Package envutil parses process environment variables with the canonical, fail-closed rules shared by the Orka binaries.
executionmode
Package executionmode defines the immutable execution-plane identity shared by controllers and admission.
Package executionmode defines the immutable execution-plane identity shared by controllers and admission.
gateway/conformance
Package conformance probes and validates the orka.gateway.v1 adapter contract.
Package conformance probes and validates the orka.gateway.v1 adapter contract.
gateway/protocol
Package protocol defines the provider-neutral orka.gateway.v1 HTTP contract.
Package protocol defines the provider-neutral orka.gateway.v1 HTTP contract.
gateway/referenceadapter
Package referenceadapter provides a deterministic, provider-neutral orka.gateway.v1 implementation for conformance and end-to-end tests.
Package referenceadapter provides a deterministic, provider-neutral orka.gateway.v1 implementation for conformance and end-to-end tests.
harness/ledger
Package ledger implements the durable harness v1 wrapper admission ledger.
Package ledger implements the durable harness v1 wrapper admission ledger.
harness/v2
Package v2 defines the portable orka.harness.v2 wire contract.
Package v2 defines the portable orka.harness.v2 wire contract.
harness/v2/conformance
Package conformance validates external orka.harness.v2 runtimes before an AgentRuntime becomes Ready.
Package conformance validates external orka.harness.v2 runtimes before an AgentRuntime becomes Ready.
llm
providerproxy
Package providerproxy holds the security-critical request/response filtering shared by Orka's provider-facing HTTP proxies: the standalone orka-provider-auth-proxy binary and the ACP supervisor's per-session provider proxy.
Package providerproxy holds the security-critical request/response filtering shared by Orka's provider-facing HTTP proxies: the standalone orka-provider-auth-proxy binary and the ACP supervisor's per-session provider proxy.
publisher
Package publisher implements the clean-room Git publication boundary.
Package publisher implements the clean-room Git publication boundary.
publisher/service
Package service exposes the clean-room Workspace/Publisher boundary around internal/publisher.
Package service exposes the clean-room Workspace/Publisher boundary around internal/publisher.
safesymlink
Package safesymlink validates repository-relative symbolic-link graphs without following links on the host filesystem.
Package safesymlink validates repository-relative symbolic-link graphs without following links on the host filesystem.
store/kube
Package kube implements Kubernetes-authoritative ACP control records.
Package kube implements Kubernetes-authoritative ACP control records.
substratepb
Package ateapipb contains the unmodified upstream Agent Substrate control protocol, generated with an Orka-local Go import path.
Package ateapipb contains the unmodified upstream Agent Substrate control protocol, generated with an Orka-local Go import path.
tokenexchange
Package tokenexchange implements reusable RFC 8693 token exchange and RFC 7523 JWT bearer grants.
Package tokenexchange implements reusable RFC 8693 token exchange and RFC 7523 JWT bearer grants.
tracing/genai
Package genai contains the small hand-rolled subset of the OpenTelemetry GenAI semantic conventions Orka emits.
Package genai contains the small hand-rolled subset of the OpenTelemetry GenAI semantic conventions Orka emits.
transactiontoken
Package transactiontoken defines Orka's strict, vendor-neutral OAuth Transaction Token profile.
Package transactiontoken defines Orka's strict, vendor-neutral OAuth Transaction Token profile.
transactiontoken/testutil
Package testutil provides local standards-based transaction-token fixtures.
Package testutil provides local standards-based transaction-token fixtures.
uiembed
Package uiembed provides the embedded frontend assets.
Package uiembed provides the embedded frontend assets.
usage
Package usage builds cohort reports from retained counts and verified links.
Package usage builds cohort reports from retained counts and verified links.
workerenv
Package workerenv defines the process contract shared by the controller job builder and worker binaries.
Package workerenv defines the process contract shared by the controller job builder and worker binaries.
workspace
Package workspace defines Orka's internal durable-workspace execution boundary.
Package workspace defines Orka's internal durable-workspace execution boundary.
workspace/daemonprotocol
Package daemonprotocol preserves the legacy provider-routed client surface while the public DTOs live in pkg/workspaceagent.
Package daemonprotocol preserves the legacy provider-routed client surface while the public DTOs live in pkg/workspaceagent.
workspace/statusrules
Package statusrules owns provider-neutral Execution Workspace status safety rules shared by API, worker, and controller adapters.
Package statusrules owns provider-neutral Execution Workspace status safety rules shared by API, worker, and controller adapters.
workspacedelta
Package workspacedelta captures and compares bounded workspace trees and produces deterministic, publication-safe change artifacts.
Package workspacedelta captures and compares bounded workspace trees and produces deterministic, publication-safe change artifacts.
pkg
workspaceagent
Package workspaceagent defines the stable workspace.orka.ai/v1 data-plane protocol and its transport-safe HTTP client.
Package workspaceagent defines the stable workspace.orka.ai/v1 data-plane protocol and its transport-safe HTTP client.
workspaceprovider
Package workspaceprovider contains the stable, provider-neutral contract used by out-of-tree Execution Workspace adapters.
Package workspaceprovider contains the stable, provider-neutral contract used by out-of-tree Execution Workspace adapters.
workspaceprovider/conformance
Package conformance provides a reusable provider-neutral lifecycle suite for out-of-tree workspace adapter drivers.
Package conformance provides a reusable provider-neutral lifecycle suite for out-of-tree workspace adapter drivers.
scripts
fixtures/substrate-conformance command
Native provider conformance reads credentials only from projected files.
Native provider conformance reads credentials only from projected files.
test
fixtures/compatmodel
Package compatmodel supplies a deterministic OpenAI model for compatibility routing tests.
Package compatmodel supplies a deterministic OpenAI model for compatibility routing tests.
workers
acp/images command
Command artifact-tool performs the two deterministic supply-chain checks used by the ACP image definitions.
Command artifact-tool performs the two deterministic supply-chain checks used by the ACP image definitions.
ai command
general command

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL