An AI agent on your cluster, without your kubeconfig

To find out why a pod is failing, your agent has to reach the cluster, and the usual ways to let it in are poor. Here’s how kubelatch lets it in: as you, with less than you have, for a few hours, with its changes waiting for you. And where it stops.

Two bad options

Say you’re developer on shop and you ask your agent “find out why the web pod is failing”. Without kubelatch, you have two options.

You can give it your kubeconfig. It works at once, and the agent can then do everything you can, for as long as your credential lasts. The audit shows only you, so afterwards it can’t tell what you did from what the agent did.

Or you can ask an administrator for a bot. Someone decides what it may do, creates it and issues it a credential that can last up to 90 days. That suits a team’s agent, not a ten-minute task on your laptop.

Delegated: the agent works as you, within your limits

kubelatch adds a third way, with the gesture of “Sign in with Google”: you don’t hand over your password, you give a limited permission you can take back.

You add kubelatch’s MCP server to your agent once. Cursor and any other MCP client connect to the same address; for Claude Code it’s one line:

claude mcp add --transport http kubelatch https://kubelatch.example.com/mcp

The first time, you authenticate kubelatch’s MCP server in your client (in Claude Code, from /mcp), and your browser opens on kubelatch by itself (if you’re not signed in there, you sign in and come back) with the question “Let Claude Code act as you?”. For each permission you hold, you choose what the agent gets: nothing, read only (viewer) or the same role. It comes set to read only, and an agent never inherits cluster-admin. Then you pick the duration, 8 hours to start with unless your administrators changed it, and there’s the “Writes need my approval” switch, which is on by default.

From then on the cluster sees you, user:<your login>, but only with the permissions you gave the agent. What its role doesn’t allow, the cluster refuses with a 403, even if you could do it yourself. The audit shows its requests as yours, through the agent. If it needs more, it asks with request_access, and you decide (the ceiling of a delegated agent).

Writes wait for you

Give the agent a role that writes, such as your developer, keep “Writes need my approval” on, and every change it wants waits for you. kubelatch first sends the change to the cluster as a dry run; if the cluster refuses it, the agent gets that answer and nothing is held.

Otherwise you get a page titled with the change in a sentence, with the object as it is now against what the cluster says it will become. Secret values stay hidden there. You click Approve or Deny, and confirm. Once approved, the write runs once, exactly as you saw it. Claude Code offers to open that page for you; other clients hand you the link. A write waits 15 minutes.

For a task with several changes, the agent can ask for a role for a while instead, say developer on shop for 30 minutes: one approval, and its writes there stop asking one by one. Only a role you hold, never cluster-admin, 8 hours at most. Read-only work asks nothing (what it will ask you to approve).

The cut

A delegated session ends by itself when its time runs out. Before that, open it in Agents and click Cut: its tokens are revoked, its pending approvals are closed and the permissions you gave it end. Its next call fails, and connecting it again asks you again.

Some cuts happen without you. If one of your own permissions is revoked or expires, the agent loses what came from it at once: it never outlives your access. And Agents shows every session, on whose behalf, with what and until when (cut it off).

No kubectl or kubeconfig on the laptop

To me, this is Kubernetes in the age of AI: the agent talks to kubelatch over MCP, you authorize it once per session in the browser, and for the work it does there’s no kubectl and no kubeconfig on your machine. Your own kubeconfig wouldn’t even work there: kubelatch’s MCP endpoint doesn’t accept a person’s credentials. With Claude Code, kubelatch’s plugin adds a hook that refuses kubectl, helm and k9s commands that reach a cluster, and tells the agent which tool to use instead.

The catch: the agent does what the MCP tools do (list, read, describe, logs, events, rollout status, CPU and memory use, apply, delete, scale, restart a rollout, read a Secret, ask for access), and there’s no exec, no port-forward, no watch and no logs -f, so for those a person still uses kubectl, with their own credential.

What this does not solve

kubelatch bounds what the agent does through kubelatch, and no more:

• What it reads can give it orders. Logs and object fields may carry text written to steer a model. kubelatch doesn’t filter it; the ceiling and the approvals limit the harm.
• Hidden isn’t forbidden. Secret values come hidden in what the agent lists and reads, but read_secret returns them to any agent whose role can read Secrets, each read on record. A Secret stays a secret only if the role says so (viewer can’t read them). A value read stays in the agent’s context and its model provider’s history; cutting the session doesn’t take it back. ConfigMaps and logs aren’t hidden at all.
• Approvals assume a person clicks. An agent that controls your browser could approve its own requests.
• Other ways in. If the agent finds another way to a cluster on your machine (a kubeconfig, a kubelatch login session, a cloud CLI), it can use it, and kubelatch doesn’t see it. The hook is a guardrail for a well-meaning agent, not a boundary: it can be bypassed, and only Claude Code has it. Working this way you don’t need a kubeconfig, so keep any you have out of its reach.

The list is in what it does not cover and in the security model.

Try it

The local tutorial sets up kubelatch and a disposable cluster on your machine in about 15 minutes. Its optional step 14 connects Claude Code as you in about five more, and has you watch a deletion wait for your approval. Free includes AI agents with no limit, on 2 clusters and for 5 people (pricing). kubelatch is made by a one-person studio in Spain; if something I describe here doesn’t match what you see, write to me.