Querdian

Querdian (query + guardian) is an Apache-2.0, Kubernetes-native reverse proxy that enforces label-based access control on read queries against Prometheus/Thanos (PromQL), Loki (LogQL) and Tempo (TraceQL). Policies are Kubernetes CRDs, queries are rewritten with real parsers, and everything fails closed: unknown endpoints, unknown users and unparseable queries are rejected.

Status: alpha, v0.1.2 is the latest release. It is not ready for production use: the policy API is v1alpha1 and may change incompatibly, and there are no production adopters yet. The proxy, the policy CRDs and the PromQL, LogQL and TraceQL enforcers are covered by unit, fuzz, envtest and container-based differential/equivalence suites (make e2e) against real Prometheus, Loki and Tempo. Read the release notes and the known limitations before you evaluate it. See also CHANGELOG.md and ROADMAP.md.

Install

helm install querdian oci://ghcr.io/querdian-dev/charts/querdian --version 0.1.2 \
  --namespace querdian --create-namespace -f my-values.yaml

• Helm chart: oci://ghcr.io/querdian-dev/charts/querdian, also on Artifact Hub; values in the chart README.
• Container image: ghcr.io/querdian-dev/querdian:0.1.2 (linux/amd64, linux/arm64).
• Binaries, checksums and SBOMs: the GitHub release.
• Everything is signed with cosign (keyless) and has build-provenance attestations; see Verify.

To see it working first, run the quickstart.

Inspired by evoila/janus.

See PLAN.md for the design and TASKS.md for the work breakdown.

The website (landing page and rendered documentation) is built from site/ and docs/ and published at https://querdian.dev, see site/README.md.

Documentation

• Quickstart on kind: a complete isolation demo (Keycloak, Grafana, Prometheus, Loki, Tempo, two teams, 24 h of demo history and four Grafana dashboards) on a laptop with one script.
• Policy guide: the CRDs, union semantics, tenants, denied labels and status conditions. Includes the requirement that the namespace label is set by your telemetry pipeline.
• Policy dashboard: optional read-only view of active policies and a query test bench.
• Operations: configuration reference, flags, limits, metrics, tracing, logging.
• Troubleshooting: decision reason codes and ready-made PromQL/TraceQL queries.
• Known limitations: strictness choices and unsupported syntax.
• Threat model and security policy.
• Releasing (maintainers), OpenSSF Best Practices checklist and the security self-assessment.
• Design notes: PromQL enforcement, endpoint inventory, .

Contributing and reporting

• Bugs and feature requests: open an issue at https://github.com/querdian-dev/querdian/issues. Please include the Querdian version or commit, the backend and its version, the request (with secrets removed), the response and the X-Trace-Id of the response.
• Contributions: see CONTRIBUTING.md (DCO sign-off and the clean-room rule apply).
• Security problems: do not open a public issue, follow SECURITY.md.
• Project governance: GOVERNANCE.md, MAINTAINERS.md, ADOPTERS.md, CODE_OF_CONDUCT.md.

Building

make build test lint

License

Apache-2.0, see LICENSE.