A multi-tenant Internal Developer Platform for AWS and Kubernetes. The catalog is a projection of reality, deploys are GitOps, and the hub holds zero tenant credentials.
Not a Backstage fork. Not a control-plane bolt-on. Inari is a purpose-built IDP: a hub-and-spoke control plane, a lightweight agent per cluster, and a catalog generated from what your clusters actually run.
A catalog that can't rot
Agents discover what each cluster actually has — CRDs, operators, Crossplane XRDs — so the catalog is a projection of reality, not a wiki page that goes stale.
Schema-driven deploys, GitOps underneath
The deploy wizard renders forms from OpenAPI schemas, then opens a PR to a platform-owned state repo. Tenant-local ArgoCD applies it; live status streams back.
Tenant-aware to the core
Keycloak Organizations, per-tenant SSO brokering, teams, and an RBAC matrix. Vend a whole Tenant Zone — AWS account, EKS cluster, baseline — in one governed flow.
Pull, never push
Agents connect outbound only. The control plane holds zero tenant credentials; AWS accounts onboard via OIDC web identity. No stored keys, ever.
Fleet management
ClusterSets, staged rollouts from canary to waves with health and approval gates, drift detection, and agent upgrade channels.
Policy & audit built in
One policy model enforced at request time, render time, and admission. Approvals inbox, time-boxed exemptions, and an immutable audit log of every action.
HOW IT WORKS
Hub-and-spoke. Pull, never push.
A central control plane hosts the API, console, catalog, fleet, and policy services. A lightweight agent in each tenant cluster connects outbound only — the platform never needs credentials to your cloud.
Hub-and-spoke control plane. Agents pull desired state; tenant-local ArgoCD applies it.
PRINCIPLES
Tenant-aware to the coreZero tenant credentials on the hubPull, never pushCatalog = projection of realitySmall kernel, everything else extensionApache-2.0, no open-core
SERVICES
Platform-Engineering-as-a-Service.
Inari is free and open source — run it yourself. Or let the team that built it deploy and operate it for you on a monthly retainer, with a clear handover story.
DAY 1
Deploy
Weeks 1–2: infrastructure audit, Inari deployment on your cloud, first clusters registered, first golden paths live.
DAY 2
Operate
Ongoing: monthly retainer for monitoring, upgrades, fleet rollouts, policy tuning, and incident response.
DAY 3
Evolve
Quota-based enhancements: new catalog packages, custom extensions, team training, and gradual handover.