Introduction

Kleym

Kleym connects Gateway API Inference Extension (GAIE) InferencePool resources to SPIFFE workload identity for Kubernetes.

The in-cluster kleym-operator watches InferencePool workload intent, then compiles that intent into deterministic SPIFFE identities and materializes them as SPIRE Controller Manager ClusterSPIFFEID resources. The companion kleym CLI is a read-only inspection tool for the rendered identity state.

Overview

primary input: InferencePool
primary output: deterministic ClusterSPIFFEID resources
safety model: namespace, service account, pool, and identity-boundary selectors are mandatory; peer bindings must be structurally exclusive
fail-closed behavior: unsafe, conflicting, or duplicate claims retain no managed output, and output absence is confirmed before conflicts settle
enforcement assumption: cluster admission controls reserved identity-boundary labels and keeps them immutable for each Pod lifetime

Documentation Map

Operator docs

Install: local run, deployment, GitOps install, metrics, and validation commands
Concepts: GAIE pool input, service-account-scoped inference target identity, and selector safety
Architecture: end-to-end reconcile flow from binding intent to SPIRE registration resources
Demo: reference binding-to-ClusterSPIFFEID walkthrough
Examples: concrete manifests and expected reconciliation outcomes
Reference: API fields, conditions, managed resources, compatibility, dependencies, and GAIE compatibility
Troubleshooting: binding conditions, missing CRDs, and selector triage
Design: controller design notes and downstream handoff patterns

CLI docs

CLI: read-only inspection usage, results, report shape, findings, and exit codes

Reference and specs

Operator Spec: authoritative operator behavior and API contract
CLI Spec: authoritative read-only inspection CLI contract
Contributing: workflow, validation, and repository conventions

Project Links

Last updated on July 12, 2026