kubelatch is in public preview

kubelatch is in public preview as of today: you can install it, Free costs nothing and Pro has a waiting list. Before you try it, here is where it comes from (one admin kubeconfig for everyone), what I built over these months, and what "preview" means here: what already works and what it does not cover yet.

The problem on my desk

For years I've been handing out access to Kubernetes clusters to development teams, on EKS, GKE, AKS, DigitalOcean and the odd hand-built one. It always ended the same way. The admin kubeconfig the cluster comes with on day one gets passed around, or at best a ServiceAccount token bound to a Role whose name and location God only knows; it gets copied onto laptops and into CI secrets, and a few months later nobody knows how many copies exist. When something breaks, the cluster's audit log says kubernetes-admin, the same name for everyone. I told that story in full in Why kubelatch exists.

Then AI agents arrived, and the question got sharper. Claude Code or Cursor will work out why a pod is failing in ten minutes, but to do it they need to reach the cluster. Was I really going to paste my kubeconfig into an agent and hope for the best? Or worse, let it read my user's ~/.kube/config? It can do everything I can, and afterwards the audit log can't tell what I did from what it did.

What was already there

I looked at the options before writing a line. Client certificates are what every cluster hands you, and Kubernetes never revokes them: once issued, one is valid until it expires. OIDC on the API server would be the right answer, but managed clusters won't let you configure it. Each cloud's IAM works, with three providers and three separate inventories. None of the three behaved the same on every cluster without touching the API server.

The one piece that does is an impersonating proxy: a door in front of each API server that checks who is asking, records it and forwards the request to the cluster on that person's behalf. The cluster still authorizes every verb with its own RBAC; the proxy only tells it who is asking. The reasons, and the cost, are in Why a proxy.

Months of work

The proxy came first, along with a decision I've stuck to: one Go binary, Postgres, and little else. Then the reconciler that writes RBAC into each cluster so nobody edits a RoleBinding by hand, and the six system roles, from viewer to cluster-admin. Then credentials with a mandatory expiry, revoked from one screen, leaving the next kubectl with a 401.

With that running came CI: a GitHub Actions job swaps the OIDC token GitHub gives it for a one-hour credential, with no secret stored in the repository. And the part I'm most excited about, the MCP server: an agent works on your cluster as you, with fewer permissions than you have, for a few hours, and every change it wants to make waits for you to approve it with the diff in front of you. That one has its own entry, An AI agent on your cluster, without your kubeconfig.

Along the way came the Free and Pro editions, with Free's limits written into the license, the documentation in English and Spanish, the Helm chart and the release notes for each version. It has been months of work, and of running it on real clusters.

Who is behind it

kubelatch comes out of Picaporte Labs, a small studio in Spain, with the backing of Jaraxa Software, who already run it on their clusters, and heavily: the best test a product like this can get.

What preview means

kubelatch is already in production: Jaraxa Software uses it every day on their clusters. The preview is the step before general availability, while Pro opens for sale and the product reaches more teams. Before you install it, here's what to know:

• Only the latest version is supported, and versions ship often. Upgrading is changing the image; the database migrates itself at startup.
• kubelatch is not single sign-on and not a service mesh: it watches one door, the Kubernetes API. Keep a native emergency access to each cluster ready, because whatever comes in that way does not pass through kubelatch.
• Free is available today: 2 clusters, 5 people, unlimited agents and the last 24 hours of audit. Pro can't be bought yet; Pricing has the waiting list, and the first ten teams get 50% off the first year. If you're keen and don't want to wait, write to us at hola@picaportelabs.com.

Try it

The local tutorial gets kubelatch and a throwaway kind cluster running on your machine in about fifteen minutes; its step 14, optional, takes another five: you connect Claude Code to act as you and watch a delete wait for your approval.

And if you try it, tell me. I'm looking for teams that will use it with their agents and tell me what doesn't add up, and for partners who want to help it grow and put some miles on it. Write to me, or to hello@kubelatch.com.