Janus. Multi-tenant observability without boundary leaks

Open source, built by us and free for everyone.

Every user sees exactly what they should and nothing more. Janus is evoila’s open source multi-tenant proxy for Prometheus, Loki and Tempo. It enforces label-based access control and query policies between your users and your observability stack, transparently at the gateway and without touching your backends.

Shared platforms leak. Janus holds the line.

Shared observability platforms are powerful until a developer queries metrics from a team they do not belong to, or a service account leaks logs across tenant boundaries. Janus sits between your users and your observability stack as a transparent security proxy. It validates identity, resolves policy and enforces label-level access before a single query reaches Prometheus, Loki or Tempo. It is open source, built on Spring WebFlux for reactive performance and designed to fit into an existing observability deployment without rebuilding the stack around it.

  • 3 backends: Prometheus, Loki & Tempo in one proxy
  • Zero trust: every query enforced, no exceptions
  • Open source: GNU AGPLv3.0, community-driven

Tech-Deep-Dive

How Janus enforces access before a query lands

Every inbound request passes through a three-stage pipeline inside Janus. First comes authentication. A JWT token or forwarded authentication header is validated and the caller identity is resolved. Second comes policy resolution. The access rules for that identity are loaded, including which label values the caller is allowed to read. Third comes query enforcement. The request is parsed, required label selectors are injected or validated and the rewritten request is sent to the relevant backend. The response then passes back transparently. To the calling tool, Janus stays invisible.

The runtime model is reactive and non-blocking because Janus is built on Spring WebFlux. That means no threads sit idle while backends respond, scaling stays straightforward and the proxy remains stateless under load. Access policies are loaded from a configuration source at startup and can be reloaded without downtime.

Explore Janus on GitHub


Access control built into every layer of the request

JWT & header authentication

Caller identity is resolved from JWT claims or forwarded authentication headers. This fits into existing OAuth2-based identity setups without needing a separate authentication model.

Label-based access policies

Policies define which label values a caller may read, for example namespace, service, pod, team or any custom label already used in the stack.

Automatic query rewriting

Required label selectors are injected into PromQL, LogQL and TraceQL queries before forwarding. Enforcement does not depend on client-side discipline.

Reactive, non-blocking core

Spring WebFlux powers a stateless, horizontally scalable proxy that adds sub-millisecond overhead to query paths under production load.

See the full observability stack

Supported backends: one proxy, full stack coverage

Janus enforces access policies across Prometheus, Loki and Tempo in one deployment. You do not need a separate proxy for every backend, separate policy models per tool or different enforcement logic across metrics, logs and traces. One gate is enough for the full stack.

What it means for your platform

Practical impact across your organisation

One platform, many teams

Run a single Prometheus, Loki, and Tempo deployment for your entire organization. Janus handles tenant isolation without requiring separate stacks per team.

Audit-ready access control

Every enforced and rejected query is attributable to an identity. Access policy violations are logged with full context, exactly what compliance audits require.

No backend changes required

Janus deploys in front of existing infrastructure. No scrape config changes, no log pipeline rework. Drop it into your stack and configure policies.

Open source, always

MIT licensed with no enterprise tier, no feature gating. Contributions welcome, the gate is open.

Want to talk about Janus in your stack?

Whether you want to understand how Janus fits into your observability platform, discuss multi-tenant access control or look at a real deployment scenario, get in touch with us. We will point you to the right expert.

Marco Di Martino

Marco Di Martino

Business Unit Lead – Cloud Native

FAQs

Commonly asked Questions about Janus

No. Janus deploys as a transparent proxy in front of your existing backends. No scrape configuration changes, no log pipeline rework, and no modifications to Prometheus, Loki, or Tempo are required. Configure your policies, point your clients at Janus, and enforcement begins immediately.

Policies are defined in a configuration source and loaded at startup. They specify which label values each caller identity is permitted to read — by namespace, service, pod, team, or any custom label in your stack. Policies can be reloaded without downtime or proxy restart.

Janus is released under the GNU AGPLv3.0 license. There is no enterprise tier and no feature gating. The full source code is available on GitHub under evoila/janus.

Where a query can be safely rewritten, Janus injects the required label selectors before forwarding it to the backend. If a query cannot be rewritten safely, it is rejected. Every rewrite or rejection is logged with identity context.

Yes. Janus loads policies from a configuration source at startup and supports live reloads. Policy updates take effect without proxy restart and without interrupting active query paths.