It might be good to clarify your expected users.

Most Kubernetes users I have worked with integrated with some cloud provider auth or similar to grant permissions to Kubernetes resources.

I can see this being useful for smaller deployments or when such integrations are unavailable but it might be worth explaining that in the readme of the project.

Also, how do you see this working in the config as code / ‘gitops’ world? How does this work for clusters in different environments?

Thanks, this solves a very important problem in the k8s ecosystem.

For me personally, I've spent the weekends of the last two months learning ldap basics only to find out that k8s+ldap is another mess on its own.

This looks very cool. Is there a story for managing users associated with AWS IAM roles or users?

This is honestly pretty fantastic. How does this compare with things like Dex+Gangway?

so, can you compare this to the OPA? Are you integrating with the OPA?

Also, there was an old project called casbin which is used by ArgoCD.

In my system, I created an Account CRD and let an account controller do all the logic. This way you do not need another api server.