Among Clusters Open source · BYOC peering

Mesh clusters you don’t control.

Among Clusters is a Sovereign Cluster Peering control plane. Every Kubernetes cluster stays its own trust domain. The Hub distributes signed identities, trust bundles and explicit service advertisements; it never receives Kubernetes credentials and is not in the data path.

Read the trust modelExplore the code
Gateway transport (mTLS 1.3)QUIC
Peering resources7
OCI charts4
Credentials at the HubNone
Peering handshakeStep through the flow, or let it play.
Two independent trust domains. Dashed lines carry control messages only.

Trust model

Each cluster keeps its own keys.

Every cluster keeps its own API server, CA, RBAC, scheduler and lifecycle. Peering only distributes what is needed to authenticate and route an explicitly advertised service.

Distributed by the Hub

  • Signed identities · created and retained by an owner-side Agent
  • Trust bundles · installed only after both owners confirm digests
  • Gateway endpoints · for QUIC with mutual TLS 1.3
  • Service advertisements · selected L4/L7 services, bound to target peers

Never synchronized

  • Kubernetes credentials · the Hub never receives them
  • PodCIDRs and EndpointSlices · no Pod addresses cross the boundary
  • Remote API secrets · no kubeconfig distribution
  • Managed access · ManagedAccessGrant is separate, gated and off by default

Components

A control plane, an access contract, read-only views.

Four OCI charts are released independently. Images are configured by immutable sha256 digest.

01

Among Clusters

Hub for rendezvous, CRDs and audit, plus an owner-side Agent and a separate QUIC Gateway pod with no service-account token.

among-clusters →
02

ConnecTool

Provider-neutral contract for distributing AI tools through OIDC, ToolHive MCP workloads and plugin marketplaces. It stores no OAuth tokens.

connectool →
03

Headlamp inspection

Digest-checked, read-only plugin for peers, links, advertisements and evidence.

headlamp-birfucate →

Install

Bring your own cluster. Keep local authority.

The Gateway’s UDP listener stays off until a public endpoint and a confirmed peer-bundle Secret are configured.

  1. Install the Hub, or join an existing one.
  2. Install the signed Agent chart into its own namespace with digest-pinned images.
  3. Label a Service with peering.re8ch.com/advertise=true and its policy annotations.
Scenario matrix →
export.sh
# Export one Service to approved peers
kubectl label service orders peering.re8ch.com/advertise=true
kubectl annotate service orders \
  peering.re8ch.com/protocol=tcp \
  peering.re8ch.com/service-class=app.orders \
  peering.re8ch.com/policy-ref=orders-policy \
  peering.re8ch.com/target-peers=cluster-b \
  peering.re8ch.com/ttl-seconds=300

# Revoke by removing the label
kubectl label service orders peering.re8ch.com/advertise-

Open-source cloud family

Three contracts that compose.

AdvFab produces path evidence, Public Edge consumes it to answer DNS, and Among Clusters connects clusters without sharing their keys. RE8CH Cloud runs all three as a managed service.

AdvFab

Network evidence controller for Kubernetes.

Open source Public Edge

Health-aware public ingress and authoritative DNS.

Open source Among Clusters

Sovereign cluster peering for BYOC services.

Open source RE8CH Cloud

The managed cluster network built on these projects.

Managed

Built through reviewable outcomes.

Product, documentation, website and reliability work is tracked in GitHub. Private topology, credentials and raw telemetry never belong in the public roadmap.

RoadmapSecurity