Charmed OpenFGA Operator

May 24, 2025 ยท View on GitHub

CharmHub Badge Juju License

Continuous Integration Status pre-commit Conventional Commits

Description

This repository contains a Juju Charm for deploying OpenFGA on Kubernetes.

Usage

Bootstrap a microk8s controller using juju and create a new Juju model:

juju add-model openfga

Basic Usage

To deploy a single unit of OpenFGA using its default configuration.

juju deploy openfga-k8s --channel edge
juju deploy postgresql-k8s --channel edge
juju integrate postgresql-k8s:database openfga-k8s

openfga interface

Current charm provides a library for the openfga integration interface. Your application should define an interface in charmcraft.yaml:

requires:
  openfga:
    interface: openfga

Then run

charmcraft fetch-lib charms.openfga_k8s.v1.openfga

Please read usage documentation about openfga library for more information about how to enable openfga interface in your application.

Integrations to new applications are supported via the openfga interface. To create an integration:

juju integrate openfga-k8s <application>

To remove an integration:

juju remove-relation openfga-k8s <application>

tls-certificates interface

The Charmed OpenFGA Operator supports TLS encryption. To enable TLS:

juju deploy self-signed-certificates-operator --channel=latest/stable
juju integrate openfga-k8s tls-certificates-operator

Note: The self-signed certificate is not recommended for production.

Observability

This OpenFGA operator integrates with Canonical Observability Stack (COS) bundle. It comes with a Grafana dashboard and Loki and Prometheus alert rules for basic common scenarios. To integrate with the COS bundle, after you deploy it, you can run:

juju integrate openfga-k8s:grafana-dashboard grafana:grafana-dashboard
juju integrate openfga-k8s:metrics-endpoint prometheus:metrics-endpoint
juju integrate loki:logging openfga-k8s:logging

Security

Please see SECURITY.md for guidelines on reporting security issues.

Contributing

Please see the Juju SDK docs for guidelines on enhancements to this charm following best practice guidelines, and CONTRIBUTING.md for developer guidance.

License

The OpenFGA k8s charm is distributed under the Apache Software License, version 2.0. It installs/operates/depends on OpenFGA, which is licensed under the Apache Software License, version 2.0.