Launch HN: Infra (YC W21) – Open-source access management for Kubernetes

Thanks Nick! Brings back to our days together @ Docker :-)

> you typically have the budget for an enterprise license.

Not all enterprises are the same and not all companies with more than 100 engineers are ready to dedicate a significant amount of capital to yearly costs for access control. Especially when you can "Make do" with an open source solution and spend the cash on a product that is less replaceable or more necessary. I would also add that this is the Only open-source solution that I've seen that would actually support blanket oidc integration and more specifically with Google workspace etc. Most competitors like Teleport, cloudflare, etc have proper oidc integration for an idp locked behind a pay wall. (Would love to know of any that dont)

> isn't that the central proxy service?

Teleport offers authentication AND a proxy that will let you connect back to your services via their proxy. The certificates that get issued for those backend services are usable as long as you can talk to the service but the proxy acts as an identity aware proxy locked behind your idp or whatever authentication you are using with teleport. From what I can tell infra does not offer a proxy to connect you back to your network. You would host it somewhere and expect users to be able to directly route to infra.internal.company and k8s.internal.company

IMO the fact that they are actually offering a fully open source product without locking any features behind a pay wall makes them worth watching. Obviously they aren't at parity with Teleport, and they don't support SSH or other protocols currently but I expect they'll have a lot of support in the community.

> Especially when you can "Make do" with an open source solution and spend the cash on a product that is less replaceable or more necessary

Ah, but you're getting to the crux of my (hopefully constructive) criticism. Ultimately the goal here isn't to create a useful open-source project and offer it for free. The goal is to open a business (OP is YC W21). That means having a business model where you a) do expect teams to pay you, and b) the number of teams and the amount of money they are willing to pay, in aggregate, is higher than the costs to develop the product.

If offering SSO as part of the open-source core provides enough value that customers do not need to pay you, then your business will fail. And then the open-source project will, in all likelihood, fail, without commercial backing behind it.

If the revenue plan is to sell a managed SaaS tenant, then the price for that managed SaaS tenant must be competitive with established offerings. Which means that it must be competitive with Teleport's managed offering, Cloudflare Access, cloud vendor tie-ins (e.g. IAM authenticator), etc. This sector has enough offerings that it is competitive and the price is quickly getting commoditized. That is not a good strategy for a startup that is not showing a 10x better product than the competition.

I have spent _years_ trying to build things like this and only recently have made some headway. The problem with most solutions in the space is the inherent SPoF that comes with having them in the access path. As someone that has been woken up in the middle of the night to deal with outages within our access management systems, I _do not_ want the service that is in the path for an incident resolution to be a single point of failure that I then have to debug. Excited to see how this is built, and very excited to see where it goes.

Congrats Jeff, Michael and the whole Infra team!

I'm excited to see this space growing, it definitely needs attention and innovation. I've personally used several of the other systems mentioned in this thread, I think they all have strength and weaknesses, I do like the simplicity and thoughtfulness that went into Infra and I think the team is laser-focused on building a well thought solution with UX and operators overhead in mind.

I've been engaged with the project early on and had access to the team and to the product to try it and provide feedback, very impressed by how quickly the team iterates, their transparency and by their overall vision and how much the product have matured so quickly, obviously a huge supporter of them making Infra Open Source.

They were always open for feedback and taking action based on it, which I really appreciate!

Infra today is easy to install, integrate and already works seamlessly across 3 different K8s deployment methods in our sandbox/testing environments. We continue to work closely with Infra and consider expanding the install base soon.

I'm excited about what the team is building and strongly recommend anyone, regardless of team size to keep an eye and try it out.