// compare
kubelatch against the access gateways.
The platforms that put every server, database and cluster behind one door do more than kubelatch. This page says where the line is, so you can pick the right one; it names none of them, and it is reviewed on the date at the bottom.
// eight questions
Side by side.
The left column describes the category, not a product: each platform is different, so read it as “usually”. The right column is kubelatch, and every cell comes from its documentation.
| Question | An access platform | kubelatch |
|---|---|---|
| Scope | Many kinds of resources behind one door: servers, databases, Kubernetes, and often more. | Kubernetes only: the API servers of your clusters, managed or self-managed, through the standard Kubernetes API. |
| Install | Several components to deploy and keep running, or a hosted service. | One Go binary and a Postgres, installed with a Helm chart on a management cluster. Bring your own Postgres, or let the chart create one. |
| Sign-in | Single sign-on, usually with a choice of identity providers. | GitHub, through a GitHub App, with the two-factor your organization enforces and automatic offboarding; or local accounts. No other identity provider. |
| Identity on the cluster | It depends: some platforms act as the person, others reach the cluster with an identity of their own. | Always the real person, user:<login> (or bot:<name> for a bot), by impersonation, with only the groups of their active permissions. |
| Private clusters | Many ship an agent that connects out from the private network. | kubelatch has to reach each API server over https. There's no built-in relay: you use your own network (a VPN, peering or a network-level tunnel) and register the address kubelatch reaches. |
| Session recording, SSH, databases | Often part of the offer. | Not done. kubelatch records every request, with the command of each exec, not what the screen showed, and it reaches no server or database. |
| Where it runs | Hosted by the vendor, on your infrastructure, or both. | On your own management cluster. The license key is verified offline and there's no telemetry; the only call home is a daily version check, which you can turn off. It works air-gapped. |
| Pricing shape | It varies: per user, per resource, or by quote. | Free for 2 clusters and 5 people, with no time limit, and nothing Free has today will move to Pro. Pro is $15 per person per month, billed yearly, from 5 people; the price is public, and the 30-day trial needs no card. |
Sources: why a proxy, architecture, install, identity, private clusters, security model, editions and pricing.
// the line
What kubelatch does not do.
Said plainly, so you don't find out after installing it.
- Session recording. It records every request, and the command of each
exec, not what the screen showed. - SSH, databases, or anything that isn't the API server of a Kubernetes cluster.
- A relay for private clusters. kubelatch reaches them over your network, or not at all.
- Identity providers other than GitHub. Without GitHub there are local accounts, with no two-factor.
- Collecting each cluster's native audit log, or managing namespaces and quotas.
kubectl --as, or a rate limit per credential on the proxy.- An
exec, a port-forward, awatchor alogs -ffor an AI agent: a person does those with their own credential. - Replacing each cluster's native emergency access, which has to exist, and be tested.
The same list, with what each guarantee rests on, is in the security model.
// the step
If Kubernetes is what you need, try it.
If what you're after is access to Kubernetes with an owner, an expiry and a record behind every credential, kubelatch is that and nothing else. If you also want servers and databases behind the same door, an access platform is the better fit.
Also: kubelatch against the shared kubeconfig.
kubelatch is made by a small studio in Spain, one person. If a line on this page is wrong or out of date, write to hello@kubelatch.com and we'll fix it.
Reviewed on 12 October 2026.