Help us shape the future of Go! Take the 2026 Go Developer Survey

orka

module
v0.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 19, 2026 License: MIT

README

Orka

Orka

Run AI agents on your Kubernetes cluster. The keys stay in the cluster.

Tests Release License

Docs · Getting started · Live demo · Demo videos · Contributing


Orka lets you hand a piece of work to an AI agent and get the result back, with Kubernetes doing what it is good at: running the work somewhere isolated, keeping a record of what happened, and cleaning up afterwards. You write a small YAML Task, Orka runs it in a Pod, and you read the answer from a REST API, a CLI, or the dashboard that comes built in (try the demo, which runs in your browser on sample data).

Three kinds of work fit in a Task:

  • Ask a model. Orka's own AI worker talks to Anthropic, OpenAI, Azure OpenAI, or any compatible endpoint, with built-in tools such as web search and code execution.
  • Run a coding agent. Codex, Claude Code, GitHub Copilot CLI, or OpenCode, working on a real git repository and opening the pull request when it is done.
  • Run a command. Any container image, for the build and test steps agents ask for.

Model keys never leave the cluster. People and CI get a token; the platform team decides which models and providers are allowed.

[!IMPORTANT] Orka is experimental and under active development. APIs, CRDs, and behavior may change without notice between releases, and it is not yet recommended for production use. Feedback, bug reports, and feature ideas are very welcome — please open an issue.

[!NOTE] The organization and repositories are intended to be donated to a community-governed foundation at the appropriate time. Until then, the project is governed by Microsoft policy, and external contributors are required to sign the Microsoft Contributor License Agreement (CLA).

Try it in five minutes

You need a cluster, kubectl, and Helm. A local kind cluster is fine. No model API key yet.

helm repo add orka https://orka-agents.github.io/orka/charts
helm repo update orka
helm install orka orka/orka --namespace orka-system --create-namespace --wait --timeout 10m

That is the whole install. Now run something:

kubectl -n orka-system apply -f - <<'EOF'
apiVersion: core.orka.ai/v1alpha1
kind: Task
metadata:
  name: hello
spec:
  type: container
  command: ["sh", "-c", "echo hello from orka"]
EOF
kubectl -n orka-system get task hello --watch

When the phase reads Succeeded, Orka has run its first Task for you. From here, Getting started walks through connecting to the API, adding a model, and running your first AI Task and your first coding agent.

What people build with it

Why on Kubernetes

  • No keys on laptops. Provider credentials live in Secrets; people and CI get scoped tokens.
  • One place to govern. Models, providers, tools, and limits are set per Agent and per namespace.
  • Everything is a record. Tasks, sessions, artifacts, and the pull requests agents open are durable and auditable.
  • Scale with the cluster. Scheduling, retries, concurrency, and cron come from the control plane you already run.

Learn more

Join in

Questions, bug reports, and ideas are welcome in issues. If you want to contribute code, CONTRIBUTING.md has the setup and the review process, and SECURITY.md explains how to report a vulnerability privately.

License

MIT

Directories

Path Synopsis
api
gateway/v1alpha1
Package v1alpha1 contains API schema definitions for the gateway.orka.ai API group.
Package v1alpha1 contains API schema definitions for the gateway.orka.ai API group.
v1alpha1
Package v1alpha1 contains API Schema definitions for the core v1alpha1 API group.
Package v1alpha1 contains API Schema definitions for the core v1alpha1 API group.
cmd
build/helmify command
Modified from open-policy-agent/gatekeeper cmd/build/helmify at c9b67657102032a460a28e7f3b9c88ec0c193453.
Modified from open-policy-agent/gatekeeper cmd/build/helmify at c9b67657102032a460a28e7f3b9c88ec0c193453.
build/release command
Command release prepares, qualifies, and publishes one immutable Orka release candidate.
Command release prepares, qualifies, and publishes one immutable Orka release candidate.
cli command
orka-admission command
orka-admission serves the stateless, fail-closed admission boundary shared by isolated harness-v1 and harness-v2 installations.
orka-admission serves the stateless, fail-closed admission boundary shared by isolated harness-v1 and harness-v2 installations.
orka-gateway-e2e-worker command
Test-only deterministic native worker.
Test-only deterministic native worker.
examples
human-approval-v2/profile command
Command profile renders the immutable inputs for one approval demo runtime.
Command profile renders the immutable inputs for one approval demo runtime.
internal
acp
acp/toolbox
Package toolbox implements the untrusted-image toolbox copier and checks used by the ACP runtime Pod.
Package toolbox implements the untrusted-image toolbox copier and checks used by the ACP runtime Pod.
admission
Package admission contains Kubernetes admission handlers for Orka CRDs.
Package admission contains Kubernetes admission handlers for Orka CRDs.
agentcontext
Package agentcontext resolves explicit, non-secret Agent persona configuration.
Package agentcontext resolves explicit, non-secret Agent persona configuration.
agentruntimepolicy
Package agentruntimepolicy resolves registered external runtime policy for Task producers that must materialize the exact brokered tool request.
Package agentruntimepolicy resolves registered external runtime policy for Task producers that must materialize the exact brokered tool request.
aitools
Package aitools resolves the effective built-in and configured tool set exposed to AI workers and brokered agent runtimes.
Package aitools resolves the effective built-in and configured tool set exposed to AI workers and brokered agent runtimes.
api
codexstate
Package codexstate carries the supported SessionKit bundle between Orka and local Codex homes.
Package codexstate carries the supported SessionKit bundle between Orka and local Codex homes.
connectors
Package connectors validates ConnectorProvider and Connection resources and resolves their references.
Package connectors validates ConnectorProvider and Connection resources and resolves their references.
connectors/credential
Package credential resolves a person's linked-account access token for a tool call, refreshing it lazily with single-flight per Connection and writing rotated material back to custody.
Package credential resolves a person's linked-account access token for a tool call, refreshing it lazily with single-flight per Connection and writing rotated material back to custody.
envutil
Package envutil parses process environment variables with the canonical, fail-closed rules shared by the Orka binaries.
Package envutil parses process environment variables with the canonical, fail-closed rules shared by the Orka binaries.
executionmode
Package executionmode defines the immutable execution-plane identity shared by controllers and admission.
Package executionmode defines the immutable execution-plane identity shared by controllers and admission.
gateway/conformance
Package conformance probes and validates the orka.gateway.v1 adapter contract.
Package conformance probes and validates the orka.gateway.v1 adapter contract.
gateway/protocol
Package protocol defines the provider-neutral orka.gateway.v1 HTTP contract.
Package protocol defines the provider-neutral orka.gateway.v1 HTTP contract.
gateway/referenceadapter
Package referenceadapter provides a deterministic, provider-neutral orka.gateway.v1 implementation for conformance and end-to-end tests.
Package referenceadapter provides a deterministic, provider-neutral orka.gateway.v1 implementation for conformance and end-to-end tests.
gateway/workerclient
Package workerclient implements the native worker's task-bound gateway reply transport.
Package workerclient implements the native worker's task-bound gateway reply transport.
harness/ledger
Package ledger implements the durable harness v1 wrapper admission ledger.
Package ledger implements the durable harness v1 wrapper admission ledger.
harness/v2
Package v2 defines the portable orka.harness.v2 wire contract.
Package v2 defines the portable orka.harness.v2 wire contract.
harness/v2/conformance
Package conformance validates external orka.harness.v2 runtimes before an AgentRuntime becomes Ready.
Package conformance validates external orka.harness.v2 runtimes before an AgentRuntime becomes Ready.
llm
providerproxy
Package providerproxy holds the security-critical request/response filtering shared by Orka's provider-facing HTTP proxies: the standalone orka-provider-auth-proxy binary and the ACP supervisor's per-session provider proxy.
Package providerproxy holds the security-critical request/response filtering shared by Orka's provider-facing HTTP proxies: the standalone orka-provider-auth-proxy binary and the ACP supervisor's per-session provider proxy.
publisher
Package publisher implements the clean-room Git publication boundary.
Package publisher implements the clean-room Git publication boundary.
publisher/service
Package service exposes the clean-room Workspace/Publisher boundary around internal/publisher.
Package service exposes the clean-room Workspace/Publisher boundary around internal/publisher.
safesymlink
Package safesymlink validates repository-relative symbolic-link graphs without following links on the host filesystem.
Package safesymlink validates repository-relative symbolic-link graphs without following links on the host filesystem.
store/kube
Package kube implements Kubernetes-authoritative ACP control records.
Package kube implements Kubernetes-authoritative ACP control records.
substratepb
Package ateapipb contains the unmodified upstream Agent Substrate control protocol, generated with an Orka-local Go import path.
Package ateapipb contains the unmodified upstream Agent Substrate control protocol, generated with an Orka-local Go import path.
tokenexchange
Package tokenexchange implements reusable RFC 8693 token exchange and RFC 7523 JWT bearer grants.
Package tokenexchange implements reusable RFC 8693 token exchange and RFC 7523 JWT bearer grants.
tracing/genai
Package genai contains the small hand-rolled subset of the OpenTelemetry GenAI semantic conventions Orka emits.
Package genai contains the small hand-rolled subset of the OpenTelemetry GenAI semantic conventions Orka emits.
transactiontoken
Package transactiontoken defines Orka's strict, vendor-neutral OAuth Transaction Token profile.
Package transactiontoken defines Orka's strict, vendor-neutral OAuth Transaction Token profile.
transactiontoken/testutil
Package testutil provides local standards-based transaction-token fixtures.
Package testutil provides local standards-based transaction-token fixtures.
uiembed
Package uiembed provides the embedded frontend assets.
Package uiembed provides the embedded frontend assets.
usage
Package usage builds cohort reports from retained counts and verified links.
Package usage builds cohort reports from retained counts and verified links.
workerenv
Package workerenv defines the process contract shared by the controller job builder and worker binaries.
Package workerenv defines the process contract shared by the controller job builder and worker binaries.
workspace
Package workspace defines Orka's internal durable-workspace execution boundary.
Package workspace defines Orka's internal durable-workspace execution boundary.
workspace/daemonprotocol
Package daemonprotocol preserves the legacy provider-routed client surface while the public DTOs live in orka-workspace/sdk/workspaceagent.
Package daemonprotocol preserves the legacy provider-routed client surface while the public DTOs live in orka-workspace/sdk/workspaceagent.
workspace/statusrules
Package statusrules owns provider-neutral Execution Workspace status safety rules shared by API, worker, and controller adapters.
Package statusrules owns provider-neutral Execution Workspace status safety rules shared by API, worker, and controller adapters.
workspacedelta
Package workspacedelta captures and compares bounded workspace trees and produces deterministic, publication-safe change artifacts.
Package workspacedelta captures and compares bounded workspace trees and produces deterministic, publication-safe change artifacts.
scripts
fixtures/remote-mcp-gateway command
Command remote-mcp-gateway is a LOCAL PROOF FIXTURE, not a production gateway.
Command remote-mcp-gateway is a LOCAL PROOF FIXTURE, not a production gateway.
fixtures/substrate-conformance command
Native provider conformance reads credentials only from projected files.
Native provider conformance reads credentials only from projected files.
test
fixtures/aimockauthority
Package aimockauthority supplies isolated, synthetic transaction authority for deployed authorization evals.
Package aimockauthority supplies isolated, synthetic transaction authority for deployed authorization evals.
fixtures/aimockcapture
Package aimockcapture is a test-only, in-memory capture proxy for aimock.
Package aimockcapture is a test-only, in-memory capture proxy for aimock.
fixtures/compatmodel
Package compatmodel supplies a deterministic OpenAI model for compatibility routing tests.
Package compatmodel supplies a deterministic OpenAI model for compatibility routing tests.
fixtures/connectors
Package connectorsfixture is the deterministic stand-in for everything the connectors E2E needs outside Orka: an OIDC issuer that signs in a person, an OAuth provider that consents, issues short-lived tokens, refreshes and revokes them, a resource API that only honours those tokens, and an OpenAI-compatible model that drives a read, an approval-gated write, and a second read.
Package connectorsfixture is the deterministic stand-in for everything the connectors E2E needs outside Orka: an OIDC issuer that signs in a person, an OAuth provider that consents, issues short-lived tokens, refreshes and revokes them, a resource API that only honours those tokens, and an OpenAI-compatible model that drives a read, an approval-gated write, and a second read.
fixtures/connectors/cmd command
The connectors E2E fixture binary: plain HTTP for the OIDC issuer, model, and state; TLS for the OAuth provider and resource API.
The connectors E2E fixture binary: plain HTTP for the OIDC issuer, model, and state; TLS for the OAuth provider and resource API.
fixtures/fakeforge
Package fakeforge serves the subset of GitHub the clean-room workspace publisher uses: real Git smart HTTP for clone, fetch, and push (via `git http-backend`), plus the REST endpoints for pull request reconciliation.
Package fakeforge serves the subset of GitHub the clean-room workspace publisher uses: real Git smart HTTP for clone, fetch, and push (via `git http-backend`), plus the REST endpoints for pull request reconciliation.
workers
acp/images command
Command artifact-tool performs the two deterministic supply-chain checks used by the ACP image definitions.
Command artifact-tool performs the two deterministic supply-chain checks used by the ACP image definitions.
ai command
general command

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL