credential broker for Kubernetes

Stop messing with Kubernetes credentials

kubelatch gives every person and every CI pipeline their own credential for your clusters, with tiered permissions, an expiry and a record of every request.

Read the docs Try it in 15 minutes
A shared admin kubeconfig, replaced by a credential per person: kubectl goes through kubelatch, every request is audited, and a revoked credential gets 401 at once. Watch the video (24 s, MP4)

// the problem

Nobody knows who holds the admin kubeconfig.

The usual setup is one admin kubeconfig passed around, or a ServiceAccount made by hand for each person. Nobody knows who uses it or when it expires. kubelatch puts an owner, an expiry and a record behind every credential.

Without kubelatch

admin.conf
# shared in #platform, copied to five laptops
users:
- name: kubernetes-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTi…
    client-key-data: LS0tLS1CRUdJTiBSU0Eg…
  • Nobody knows who has a copy.
  • It stays valid as long as its certificate: a year or more.
  • The API server sees kubernetes-admin for everyone.
  • Taking it back means rotating credentials on the whole cluster.

With kubelatch

credentials
owner          name            cluster   expires    last used
ana            laptop          prod-eu   in 12 d    2 min ago
luis           k9s             all       in 27 d    1 h ago
bot:shop-api   github-actions  prod-eu   in 58 min  just now
  • Every credential has an owner and a name.
  • It expires on its own, in days, not years.
  • Every request is recorded as that person.
  • Revoke it and the next kubectl gets 401.

// what you get

Access you can explain to an auditor.

A credential of your own

A klt_ token and its kubeconfig for each person or pipeline, with an expiry, revoked instantly. GitHub Actions workflows get theirs without storing a secret in GitHub.

kubeconfig · klt_3fQ9… · expires in 30 d

Tiered permissions

Six fixed tiers over a namespace or a whole cluster. kubelatch keeps each cluster's RBAC in sync, so nobody writes a RoleBinding by hand.

viewer · developer · debugger · secrets-reader · admin · cluster-admin

Inventory

Who each credential belongs to, which clusters it reaches, until when it is valid and when it was last used.

ana · laptop · 12 d left · used 2 min ago

Per-request audit

Every request to the API server with who, what, where and the result, including exec and port-forward.

ana exec web-7f9c (shop) 101

Any cluster

Managed or self-managed, it works the same: kubelatch only uses the standard Kubernetes API.

EKS · GKE · AKS · kubeadm · k3s · RKE2 · Talos

One binary and Postgres

A web UI, an API, the proxy and the RBAC reconciler in a single Go binary. Sign in with GitHub, or with local accounts.

kubelatch + postgres

// how it works

kubectl talks to kubelatch. kubelatch talks to your cluster as you.

  1. An admin grants a tier

    For example developer on the shop namespace of prod-eu, with an expiry if it should end.

  2. You sign in and get a kubeconfig

    Issue a credential in the web UI and use it with kubectl, k9s, Lens or Helm. Nothing to install.

  3. Every request goes through kubelatch

    It checks the token, forwards the request to the cluster impersonating you, and records it.

works with EKSGKEAKSkubeadmk3sRKE2Talos

Stop messing with Kubernetes credentials.

Read the docs Try it in 15 minutes