Enterprise-grade (under construction) · Production-ready Apache-2.0 Go 1.26+

Token as a Service
for AI Agents & Applications

An open-source LLM inference and metering/billing platform built on Kubernetes. Deploy Qwen, DeepSeek, LLaMA and more on multiple heterogeneous accelerators, expose an OpenAI-compatible API, meter per token, and settle per API Key.

GitHub stars Latest release License

Features

Everything an AI platform team needs to serve, meter, and bill LLM traffic.

Heterogeneous Compute

Unified management of multiple heterogeneous accelerator cards (vendor-agnostic). Node labeling, Device Plugins, and driver deployment are handled by each vendor's GPU Operator, with a live accelerator inventory and a model × engine × card-type compatibility matrix.

Control / Data Plane Split

Management APIs and inference APIs are served by separate gateways, so platform operations stay available while the inference path scales, upgrades, or degrades.

One-click Model Deployment

Deploy models from the console or API. The platform provisions inference workloads through a message queue and a Kubernetes controller — no hand-written YAML.

Inference Image Management

Register, version, and map engine images across the supported accelerator cards, with node-level pre-pulling to shorten cold starts.

OpenAI-compatible API

/v1/chat/completions, /v1/completions, and /v1/embeddings served by an Envoy-based gateway. Auth, metering, and routing run in Wasm plugins — inference traffic never passes through business processes.

Token Metering & Billing

Token usage (prompt / completion / cached / reasoning) is metered at the gateway, recorded as tamper-proof vouchers, and settled asynchronously per API Key.

Flexible Pricing

A model × card-type price matrix with separate input/output token rates, tiered pricing, and packages; balance (prepaid) and quota (postpaid) account modes.

Multi-tenancy

Organization/project isolation with full API Key lifecycle management. Keys are stored only as salted hashes.

SSO Federation

Pluggable identity providers — LDAP/LDAPS, OIDC/OAuth 2.0 (GitHub, Google, GitLab), SAML 2.0, and WeChat — with account binding, JIT provisioning, and attribute-to-role mapping.

Routing & Failover

Ordered routing policies over healthy deployments with bounded same-model failover and retryable-failure categories — no silent model or version substitution.

Autoscaling

Inference autoscaling with scale-to-zero, driven by live load signals so idle models cost nothing and busy ones scale out.

Observability & Tracing

Per-model latency / throughput / error dashboards, per-service CPU / memory / GPU metrics, and end-to-end request tracing with a TTFT / generation / total breakdown.

Prompt Tooling

A versioned prompt library, an interactive playground with side-by-side model comparison, and deterministic prompt evaluation for regression testing.

Batch Inference

Submit a JSONL batch of requests, process it asynchronously at a discounted rate, monitor progress, and download result / error files.

API Key Scoping & Limits

Per-key model scoping, request-rate limits, and org spend limits, so a leaked or over-broad key can never reach models it was not granted.

Data Governance

Audit logging and activity export, deployment history & audit, and GDPR-style data export of usage, billing, and request logs as JSON / CSV.

Distributed Inference Runtime

Choose the platform serving scheme — plain Kubernetes Deployments (default) or an AIBrix-managed distributed runtime — and inspect runtime component health and the models registered with the runtime.

External Model Providers

Register third-party providers (DeepSeek / OpenAI / OpenAI-compatible), probe connectivity with five states (ok / unauthorized / unreachable / error / unknown), curate upstream models, and publish them into the catalog — consumed through the same metered gateway.

Intelligent Model Routing

Routing groups expose virtual model names (e.g. auto-chat) over an ordered candidate list of real models, with weighted, cost-priority, and latency-priority strategies plus keyword intent rules — and a logged decision trail.

Cost Optimization

A deterministic, rule-based engine turns settled usage, price, and deployment data into ranked, quantified, dismissible savings recommendations, each linking straight to the page where the operator can act.

Service Quotas

Per-organization quotas on concurrent requests, inference services, batch jobs per day, and max output tokens per request — with tier presets, fail-closed enforcement, and an audited change history.

Multi-cluster Management

Register and manage inference clusters, view cluster health and workload placement, and route model deployments across clusters.

vGPU Slicing Pools

HAMI-based vGPU slicing: label nodes into slicing pools, define slice templates, and co-schedule multiple small inference jobs onto a single physical GPU with binpack or spread placement.

Fault Diagnosis & Auto-Recovery

Detect service, node, and accelerator failures, classify the root cause deterministically, and recover automatically (restart / reschedule) with operator-confirmed drain — every incident a timeline in the admin console.

Architecture

Control plane and data plane, separated by audience and network.

LAYER 01Access layer
REST API
/api/v1 control plane · /v1 data plane · OpenAPI 3.1
Console
Web console · OIDC login · Guided deployment
SDK
Python / Go / Node · SSE streaming · Automatic retries
CLI / Skill
taas CLI · Agent Skill · GitOps
HTTPS · SSE · OIDC · API Key▼Split by traffic type
LAYER 02Gateway layer
TaaS Gateway (control plane)
TLS · AuthN · RBAC · Rate limiting · Audit · Request validation · Routing to TaaS Server
Aibrix Gateway + TaaS Plugin (data plane)
OpenAI API · Model routing · Token-aware load balancing · Same-model failover · Metering · Trace
Control flow: REST / gRPC▼Data flow: OpenAI /v1 · SSE
LAYER 03K8s cluster
① Control plane + middleware
TaaS Server
Stateless business service: tenants, models, deployments, keys, pricing, metering, billing, quotas, audit
TaaS Controller
K8s Operator: CRD reconcile, workload orchestration, status and rollback
TaaS Console
Console service: static assets, BFF aggregation, guided flows (no direct database access)
PostgreSQL (CNPG)
Source of truth: tenants, models, deployments, prices, usage ledger, audit
Redis
Cache, rate-limit counters, quota reservations, distributed locks, routing table
RabbitMQ
Deployment jobs, metering ingestion, settlement, batch processing, notifications; retries + DLQ
② Third-party dependencies · Helm Chart
Aibrix
Distributed runtime, KV cache
HAMI
Heterogeneous accelerator management, device plugin, scheduling
Volcano
Gang scheduling, queues and fair sharing
GPU / NPU Operator
Drivers, device plugin, topology and health
Observability stack
Prometheus / OTel / Loki
③ Compute nodes · inference engines
vLLM
PagedAttention · Continuous batching
SGLang
RadixAttention · Structured output · Parallelism
TensorRT-LLM / MindIE
NVIDIA / Ascend native inference stack
In-house / other engines
Integrated by image, unified OpenAI protocol
  • Traffic is split by audience: administrators enter through the Control Gateway (HTTP, generated from the Protobuf contract by grpc-gateway), while agents and SDKs call the Inference Gateway (Envoy + Wasm). Both are exposed through the cluster's north-south entry point (Envoy Gateway with TLS).
  • The two gateways are deployed as separate workloads, so control plane APIs and inference APIs scale, upgrade, and fail independently.
  • All 24 microservice gRPC servers run in a single Deployment — auth, tenancy, account, model, image, infer, runtime, routing, provider, metering, billing, batch, audit, webhook, notification, observability, tracing, resourcemetrics, accelerator, cluster, optimization, prompt, evaluation, and docs — handing work to the Controller through a message queue (Kafka / RabbitMQ).
  • Authentication, metering, and routing run in Wasm plugins at the Inference Gateway, so inference traffic never passes through business processes.
  • The Inference Gateway verifies every API Key by calling the auth module over gRPC, backed by a two-level cache (Wasm-local TTL cache, then Redis); on timeout or auth unavailability it fails closed.
  • Cluster networking: pods talk over the CNI network with ClusterIP Services and CoreDNS discovery, north-south traffic enters through Envoy Gateway with TLS, NetworkPolicies isolate the control plane, data plane, and tenant namespaces, and the inference data path can ride an optional RDMA fabric.
  • Inference services and the control plane share one Kubernetes cluster, isolated through Namespaces, node labels, and taints/tolerations.

Quick Start

One Helm chart deploys the whole stack on Kubernetes — control plane, consoles, and dependencies.

1

Clone the repository

git clone https://github.com/go-taas/go-taas.git
cd go-taas
2

Install with Helm

helm install taas deploy/helm/go-taas \
  --namespace taas --create-namespace

With no overrides, the chart provisions in-cluster PostgreSQL, Redis, and RabbitMQ and wires their credentials to the control plane.

3

Open a console

kubectl --namespace taas port-forward svc/taas-server 9091:9091

End-user console: http://127.0.0.1:9091/ · Admin console: http://127.0.0.1:9091/admin

Each console has its own session. End-user APIs live under /api/v1/*; management APIs live under /api/v1/admin/*.

Ports

  • 9091 — HTTP/JSON + console
  • 9090 — gRPC
  • 9092 — metrics / healthz

More commands

make helm-lint      # lint the chart
make helm-template  # render templates
helm uninstall taas # remove the release

For sizing, external PostgreSQL / Redis / RabbitMQ, and TLS, see the chart values: deploy/helm/go-taas/values.yaml.

Usage

Any OpenAI SDK works out of the box — just point it at your TaaS host.

Python · OpenAI SDK

from openai import OpenAI

client = OpenAI(
    base_url="https://<your-taas-host>/v1",
    api_key="sk-xxxxxxxx",
)

resp = client.chat.completions.create(
    model="qwen2.5-7b",
    messages=[{"role": "user", "content": "Hello!"}],
)
print(resp.choices[0].message.content)

cURL

curl https://<your-taas-host>/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer sk-xxxxxxxx" \
  -d '{
    "model": "qwen2.5-7b",
    "messages": [{"role": "user", "content": "Hello!"}]
  }'

Build the open token infrastructure with us

Contributions of all kinds are welcome — code, documentation, bug reports, and feature ideas.

Built with Go and Kubernetes

Standing on the shoulders of the Kubernetes, AIBrix, Volcano, and HAMi communities.