An open-source LLM inference and metering/billing platform built on Kubernetes.
Deploy Qwen, DeepSeek, LLaMA and more on multiple heterogeneous accelerators,
expose an OpenAI-compatible API, meter per token, and settle per API Key.
Everything an AI platform team needs to serve, meter, and bill LLM traffic.
Heterogeneous Compute
Unified management of multiple heterogeneous accelerator cards (vendor-agnostic). Node labeling, Device Plugins, and driver deployment are handled by each vendor's GPU Operator, with a live accelerator inventory and a model × engine × card-type compatibility matrix.
Control / Data Plane Split
Management APIs and inference APIs are served by separate gateways, so platform operations stay available while the inference path scales, upgrades, or degrades.
One-click Model Deployment
Deploy models from the console or API. The platform provisions inference workloads through a message queue and a Kubernetes controller — no hand-written YAML.
Inference Image Management
Register, version, and map engine images across the supported accelerator cards, with node-level pre-pulling to shorten cold starts.
OpenAI-compatible API
/v1/chat/completions, /v1/completions, and /v1/embeddings served by an Envoy-based gateway. Auth, metering, and routing run in Wasm plugins — inference traffic never passes through business processes.
Token Metering & Billing
Token usage (prompt / completion / cached / reasoning) is metered at the gateway, recorded as tamper-proof vouchers, and settled asynchronously per API Key.
Flexible Pricing
A model × card-type price matrix with separate input/output token rates, tiered pricing, and packages; balance (prepaid) and quota (postpaid) account modes.
Multi-tenancy
Organization/project isolation with full API Key lifecycle management. Keys are stored only as salted hashes.
SSO Federation
Pluggable identity providers — LDAP/LDAPS, OIDC/OAuth 2.0 (GitHub, Google, GitLab), SAML 2.0, and WeChat — with account binding, JIT provisioning, and attribute-to-role mapping.
Routing & Failover
Ordered routing policies over healthy deployments with bounded same-model failover and retryable-failure categories — no silent model or version substitution.
Autoscaling
Inference autoscaling with scale-to-zero, driven by live load signals so idle models cost nothing and busy ones scale out.
Observability & Tracing
Per-model latency / throughput / error dashboards, per-service CPU / memory / GPU metrics, and end-to-end request tracing with a TTFT / generation / total breakdown.
Prompt Tooling
A versioned prompt library, an interactive playground with side-by-side model comparison, and deterministic prompt evaluation for regression testing.
Batch Inference
Submit a JSONL batch of requests, process it asynchronously at a discounted rate, monitor progress, and download result / error files.
API Key Scoping & Limits
Per-key model scoping, request-rate limits, and org spend limits, so a leaked or over-broad key can never reach models it was not granted.
Data Governance
Audit logging and activity export, deployment history & audit, and GDPR-style data export of usage, billing, and request logs as JSON / CSV.
Distributed Inference Runtime
Choose the platform serving scheme — plain Kubernetes Deployments (default) or an AIBrix-managed distributed runtime — and inspect runtime component health and the models registered with the runtime.
External Model Providers
Register third-party providers (DeepSeek / OpenAI / OpenAI-compatible), probe connectivity with five states (ok / unauthorized / unreachable / error / unknown), curate upstream models, and publish them into the catalog — consumed through the same metered gateway.
Intelligent Model Routing
Routing groups expose virtual model names (e.g. auto-chat) over an ordered candidate list of real models, with weighted, cost-priority, and latency-priority strategies plus keyword intent rules — and a logged decision trail.
Cost Optimization
A deterministic, rule-based engine turns settled usage, price, and deployment data into ranked, quantified, dismissible savings recommendations, each linking straight to the page where the operator can act.
Service Quotas
Per-organization quotas on concurrent requests, inference services, batch jobs per day, and max output tokens per request — with tier presets, fail-closed enforcement, and an audited change history.
Multi-cluster Management
Register and manage inference clusters, view cluster health and workload placement, and route model deployments across clusters.
vGPU Slicing Pools
HAMI-based vGPU slicing: label nodes into slicing pools, define slice templates, and co-schedule multiple small inference jobs onto a single physical GPU with binpack or spread placement.
Fault Diagnosis & Auto-Recovery
Detect service, node, and accelerator failures, classify the root cause deterministically, and recover automatically (restart / reschedule) with operator-confirmed drain — every incident a timeline in the admin console.
Architecture
Control plane and data plane, separated by audience and network.
LAYER 01Access layer
REST API
/api/v1 control plane · /v1 data plane · OpenAPI 3.1
Traffic is split by audience: administrators enter through the Control Gateway (HTTP, generated from the Protobuf contract by grpc-gateway), while agents and SDKs call the Inference Gateway (Envoy + Wasm). Both are exposed through the cluster's north-south entry point (Envoy Gateway with TLS).
The two gateways are deployed as separate workloads, so control plane APIs and inference APIs scale, upgrade, and fail independently.
All 24 microservice gRPC servers run in a single Deployment — auth, tenancy, account, model, image, infer, runtime, routing, provider, metering, billing, batch, audit, webhook, notification, observability, tracing, resourcemetrics, accelerator, cluster, optimization, prompt, evaluation, and docs — handing work to the Controller through a message queue (Kafka / RabbitMQ).
Authentication, metering, and routing run in Wasm plugins at the Inference Gateway, so inference traffic never passes through business processes.
The Inference Gateway verifies every API Key by calling the auth module over gRPC, backed by a two-level cache (Wasm-local TTL cache, then Redis); on timeout or auth unavailability it fails closed.
Cluster networking: pods talk over the CNI network with ClusterIP Services and CoreDNS discovery, north-south traffic enters through Envoy Gateway with TLS, NetworkPolicies isolate the control plane, data plane, and tenant namespaces, and the inference data path can ride an optional RDMA fabric.
Inference services and the control plane share one Kubernetes cluster, isolated through Namespaces, node labels, and taints/tolerations.
Quick Start
One Helm chart deploys the whole stack on Kubernetes — control plane, consoles, and dependencies.
1
Clone the repository
git clone https://github.com/go-taas/go-taas.git
cd go-taas
2
Install with Helm
helm install taas deploy/helm/go-taas \
--namespace taas --create-namespace
With no overrides, the chart provisions in-cluster PostgreSQL, Redis, and RabbitMQ and wires their credentials to the control plane.
3
Open a console
kubectl --namespace taas port-forward svc/taas-server 9091:9091