Install

kslate is one binary, kslate, plus Postgres. The same binary runs as the API gateway, as the background worker, and as the command-line tool.

No container images are published yet, so this builds from source. You need Go 1.26 and Docker; Docker runs a throwaway Postgres.

For a cluster instead, see Running on Kubernetes.

1. Clone and run.

   git clone https://github.com/kslate-dev/kslate && cd kslate
   make run

   This builds bin/kslate, starts Postgres in a container, and serves examples/contexts.yaml on 127.0.0.1:8080. Metrics and the readiness check are on 127.0.0.1:9100.

   That file is the starter class. A class declares what a record may hold and who may write each field. This one is called incidents, and the first agent writes to two of its fields.

   make run also writes two API keys: diag-token for the diagnoser role, rem-token for the remediator.

2. Try a request.

   curl -H 'Authorization: Bearer diag-token' http://127.0.0.1:8080/v1/classes

   Output. A role sees only the classes it is named in, and the starter file holds one:

   {"classes":[{"name":"incidents"}]}

Press Ctrl-C to stop. The Postgres container is removed.

Serve your own class and your own keys

Two files you write, in the repository root. Neither is in the checkout, and serve exits if either is missing.

• contexts.yaml — the class. A YAML stream of SharedContext documents. Design a class has the shape. Copy examples/contexts.yaml to start. Its comments say what each field mode and each role does.
• keys.yaml — one token: name per line. The identity becomes apikey:<name> and must appear in a role’s identities list to read or write anything.

make build

# the class: copy the starter, or write your own
cp examples/contexts.yaml ./contexts.yaml

# the keys: one line per token. Both files are gitignored.
cat > keys.yaml <<'EOF'
diag-token: diagnoser
rem-token: remediator
EOF

./scripts/with-postgres.sh sh -c './bin/kslate serve \
  --policy ./contexts.yaml --identity apikey --apikeys ./keys.yaml \
  --postgres "$KSLATE_TEST_DSN" --listen 127.0.0.1:8080 --metrics-listen 127.0.0.1:9100'

Use one of the keys you just wrote. make run writes the same two tokens:

curl -H 'Authorization: Bearer diag-token' http://127.0.0.1:8080/v1/classes

{"classes":[{"name":"incidents"}]}

apikey:diagnoser is named in a role of incidents, so it sees that class. A copy of the starter with two classes in it would show both only if a role of each named this identity.

Two failures to expect:

To use your own Postgres, drop the wrapper script and pass your DSN to --postgres. kslate worker takes the same --policy and --postgres and expires old records.

The gateway serves plain HTTP unless you pass --tls-cert and --tls-key. See Honest limits.

Next: your first agent.