Nothing permanent by default
A permission gets an end date and a credential always expires. Revoke a credential and the next kubectl gets a 401.
Today · Requests and approval: phase 2 · Pro
Built in Europe. It runs on a cluster of your own, and your credentials and your audit never leave your infrastructure.
// on the SSO you already have
It doesn’t replace your SSO. It completes it.
kubelatch registers with your identity provider as one more application, like Argo CD or Grafana, and adds what the cluster’s SSO lacks.
One door for everyone
One proxy in front of EKS, AKS, GKE or your own cluster, for people, CI pipelines and AI agents. Nothing runs inside.
Today · The groups your cluster already uses: phase 1 · Free
A name on every request
One audit row per request: who, where, which command and the result, written before it reaches the cluster.
Today · Export and the auditor’s report: phase 3 · Pro
works with
kubectlk9sLensHelmGitHub ActionsClaude CodeCursorMCP
// GitHub Actions
Your pipelines reach the cluster without a stored secret.
The job swaps its GitHub OIDC token for a kubelatch credential that lasts one hour. Nothing stored, nothing to rotate, every kubectl audited.
GitHub Actions jobid-token: write
signed OIDC token
kubelatchtrust rule · bot · audit
credential for 1 h
Your clusterKubernetes API
// Kubernetes in the age of AI
Let the agent work. Keep the keys.
Claude Code, Cursor or any MCP client works as you, read-only unless you grant more, for a few hours. Its writes wait for your approval, and you cut its access with one click.
// how it works
kubectl talks to kubelatch. kubelatch talks to your cluster as you.
kubectl, k9s, Helm, CIklt_ token
own credential
kubelatchproxy · RBAC · audit
acts as you
Your clustersKubernetes API
-
An admin grants a role
For example,
developerinshoponprod-eu, with an end date. -
You sign in and get a kubeconfig
With your SSO or with GitHub. kubectl, k9s, Lens and Helm work as before.
-
Every request goes through kubelatch
It checks the credential, acts on the cluster as you and records it.
The cluster sees you as user:ana, by impersonation, and decides with its own RBAC. Why a proxy
works with
EKSGKEAKSkubeadmk3sRKE2Talos
// what it is not
Not a VPN. Not a mesh. Not a second SSO.
One Go binary and a Postgres in front of the API server. Out of your workloads’ path, on the SSO you already have. What it doesn’t cover.
// proof
Four things you can check yourself.
Fifteen minutes on a disposable cluster
Grant a permission, use kubectl, read the audit and revoke, on your machine with kind. Try it locally
Frequent releases, with their notes
Every release on GitHub with its notes, and signed since 0.44. Releases
A security model that says what it doesn’t cover
What kubelatch guarantees, what each guarantee rests on, and what is left out. Security model
Nothing phones home
Key verified offline, no telemetry. One daily version check, which you can turn off. Security
// editions
Free for a small team. Pro when it grows.
Free: 2 clusters, 5 people and 24 hours of audit, with no key and no time limit. Pro: $15 per person per month, with unlimited clusters, audit kept and custom roles. The first 30 days are free.
- What Free has today stays in Free.
- A limit only stops a new sign-up; nothing that exists is cut.
- No telemetry, and the key is verified offline.
kubelatch is in public preview: what is missing is on the roadmap.
// questions
Already have SSO? Why not Teleport?
Straight answers, limits included, in the FAQ.