credential broker for Kubernetes

Stop messing with Kubernetes credentials

kubelatch gives every person, every CI pipeline and every AI agent their own credential for your clusters, with tiered permissions, an expiry and a record of every request.

Read the docs Try it in 15 minutes

Free for up to 2 clusters and 5 people. Pro from $15 per person per month.

A shared admin kubeconfig, replaced by one credential for each person, pipeline and AI agent: every request is audited under its name, the agent's delete is refused with 403, and once revoked its next call gets 401. Watch the video (26 s, MP4)

// the problem

Nobody knows who holds the admin kubeconfig.

The usual setup is one admin kubeconfig passed around, or a ServiceAccount made by hand for each person. Nobody knows who uses it or when it expires. kubelatch puts an owner, an expiry and a record behind every credential.

Without kubelatch

admin.conf
# shared in #platform, copied to five laptops
users:
- name: kubernetes-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTi…
    client-key-data: LS0tLS1CRUdJTiBSU0Eg…
  • Nobody knows who has a copy.
  • It stays valid as long as its certificate: a year or more.
  • The API server sees kubernetes-admin for everyone.
  • Taking it back means rotating credentials on the whole cluster.

With kubelatch

credentials
owner          name            cluster   expires    last used
ana            laptop          prod-eu   in 12 d    2 min ago
luis           k9s             all       in 27 d    1 h ago
bot:shop-api   github-actions  prod-eu   in 58 min  just now
  • Every credential has an owner and a name.
  • It expires on its own, in days, not years.
  • Every request is recorded as that person.
  • Revoke it and the next kubectl gets 401.

// what you get

Access you can explain to an auditor.

A credential of your own

A klt_ token and its kubeconfig for each person or pipeline, with an expiry, revoked instantly. GitHub Actions workflows get theirs without storing a secret in GitHub.

kubeconfig · klt_3fQ9… · expires in 30 d

Tiered permissions

Six fixed tiers over a namespace or a whole cluster. kubelatch keeps each cluster's RBAC in sync, so nobody writes a RoleBinding by hand.

viewer · developer · debugger · secrets-reader · admin · cluster-admin

Inventory

Who each credential belongs to, which clusters it reaches, until when it is valid and when it was last used.

ana · laptop · 12 d left · used 2 min ago

Per-request audit

Every request to the API server with who, what, where and the result, including exec and port-forward.

ana exec web-7f9c (shop) 101

Any cluster

Managed or self-managed, it works the same: kubelatch only uses the standard Kubernetes API.

EKS · GKE · AKS · kubeadm · k3s · RKE2 · Talos

One binary and Postgres

A web UI, an API, the proxy and the RBAC reconciler in a single Go binary. Sign in with GitHub, or with local accounts.

kubelatch + postgres

// for AI agents

Let AI agents in, within limits you set.

Claude Code, Cursor or any MCP client works on your clusters through kubelatch’s MCP server, as you and with only the permissions you choose. Its writes can wait for your approval, every call is in the audit, and you cut it off with one click.

How it works Connect yours
A frame of the video: the same coding agent twice, with the admin kubeconfig and through kubelatch’s MCP server, the latter waiting for a person to approve a delete.

// how it works

kubectl talks to kubelatch. kubelatch talks to your cluster as you.

  1. An admin grants a tier

    For example developer on the shop namespace of prod-eu, with an expiry if it should end.

  2. You sign in and get a kubeconfig

    Issue a credential in the web UI and use it with kubectl, k9s, Lens or Helm. Nothing to install.

  3. Every request goes through kubelatch

    It checks the token, forwards the request to the cluster impersonating you, and records it.

works with EKSGKEAKSkubeadmk3sRKE2Talos

Stop messing with Kubernetes credentials.

Read the docs Try it in 15 minutes