PAGES
← all tools
◆ Non-Human & Agent Identity

kube2iam

0.15.0 open-source

kube2iam provides IAM credentials to containers running inside a Kubernetes cluster based on annotations.

source ↗ rss ↗ What is a cyber toolchain?

Summary

kube2iam is an open-source agent that gives Kubernetes pods AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. credentials by intercepting each node's EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. metadata API calls and returning temporary credentials for a role specified via pod annotation, rather than sharing one instance-profile role across every container on a node. It runs as a container with host networking on each worker, redirecting metadata traffic to itself and proxying everything else, so it is aimed at platform and infrastructure teams running self-managed Kubernetes on AWS. Its own README says that on EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., IAM roles for service accounts should be a drop-in replacement and is preferred, positioning kube2iam as the answer for clusters that predate or don't use that feature. First committed in 2016, it has drawn 86 contributors, with 40 commits in the past year showing it is still maintained.

kube2iam provides IAM credentials to containers running inside a Kubernetes cluster based on annotations.

How kube2iam helps

Which pods in my cluster are able to reach AWS resources they shouldn't be able to touch?

intercepts each node's EC2 metadata calls and only hands back credentials for the IAM role named on that pod's own annotation, so no container inherits the node's broader instance-profile role

Can I stop giving every container on a node the same AWS permissions?

replaces the shared instance-profile role with per-pod role assumption at the metadata-proxy layer, so a compromised or misconfigured container is scoped to its own annotated role instead of the node's union of roles

How do my containers get temporary AWS credentials without me distributing keys?

proxies all other EC2 metadata traffic transparently and, for credential requests, calls AWS itself to assume the annotated role and returns the temporary credentials in the same response shape the AWS SDK already expects

Which IAM role is actually in effect for a given pod right now?

reads the role directly from that pod's annotation at request time, so the answer to "what can this pod do in AWS" is whatever role string is attached to it, not whatever the node happens to carry

Do I need to keep running this once I move to EKS?

its own README says IAM roles for service accounts should be a drop-in replacement on EKS and is preferred, so the question resolves to no for clusters that can use that native feature

all 3 features, with the evidence for each →

Languages

Not documented

Features

3 capabilities · 2 backed by code, an API document or a real run

Built from kube2iam's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What kube2iam offers you

  • Command-line interface2
All capabilities 3 capabilities
IAM role assumption verified Assumes IAM roles for pods, with configurable session TTL, error-caching TTL, and support for ExternalId via pod annotation. 6 releases · 3 other sources · first seen Apr 2017

Also counts toward: Command-line interface

release

  • Adds support for AWS Instance Metadata Service version 2 (IMDSv2) 0.12.0 · May 2025 · source · release history
  • Adds the iam.amazonaws.com/external-id annotation to allow specifying an AWS External ID for STS role assumption 0.10.8 · Jul 2019 · source · release history
  • Allows use of STS regional endpoints 0.10.3 · Aug 2018 · source · release history
  • Adds regexp support for iam.enforce_namespace_whitelist to allow regex patterns in whitelist checks. 0.10.2 · Aug 2018 · source · release history
  • Allow full ARNs to be assumed, including cross-AWS account 0.3.3 · Apr 2017 · source · release history
  • Allow roles to be annotated with the base name or the full ARN 0.3.3 · Apr 2017 · source · release history

command line

  • --iam-role-error-ttl — TTL for caching assume role errors 0.15.0 · May 2026 · command-line history
  • --iam-external-id — Pod annotation key used to retrieve the IAM ExternalId 0.10.8 · Jul 2019 · command-line history
  • --iam-role-session-ttl — TTL for the assume role session 0.10.4 · Sep 2018 · command-line history
Kubernetes cluster integration verified Connects to a Kubernetes cluster using a kubeconfig path and maintains a local pod cache with configurable resync periods and duplicate-IP resolution against the API server. 1 release · 4 other sources · first seen Mar 2020

Also counts toward: Command-line interface

release

  • Adds --kubeconfig flag to point kube2iam to an external kubeconfig file for local development or custom environments. 0.15.0 · May 2026 · source · release history

command line

  • --kubeconfig — Path to kubeconfig 0.15.0 · May 2026 · command-line history
  • --cache-resync-period — Kubernetes caches resync period 0.10.9 · Mar 2020 · command-line history
  • --resolve-duplicate-cache-ips — Queries the k8s api server to find the source of truth when the pod cache contains multiple pods with the same IP 0.10.9 · Mar 2020 · command-line history

example

  • Run kube2iam locally using a specific kubeconfig file instead of the in-cluster service account. kube2iam --kubeconfig ~/.kube/config 0.15.0 · May 2026 · source
Dependency updates shipped Updates Go version to 1.14 and adds go mod support. 1 release · first seen Mar 2020

release

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for kube2iam, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail kube2iam puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

8 entries

  1. May 20261
  3. May 20251
  5. March 20221
  7. March 20201
  9. July 20191
  11. August 20182
  14. April 20171

    8 entries

    1. 0.15.0 May 4, 2026 · release notes

      Adds --kubeconfig flag for external kubeconfig support and negative cache for AssumeRole failures

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.15.0 https://github.com/jtblin/kube2iam.git
# already have the repo? check out this version:
$ git checkout 0.15.0
      └──▷ USE IT
      Run kube2iam locally using a specific kubeconfig file instead of the in-cluster service account.
      shell 
      kube2iam --kubeconfig ~/.kube/config
      • Adds --kubeconfig flag to point kube2iam to an external kubeconfig file for local development or custom environments.

      1 detail in Everything

    2. 0.12.0 May 26, 2025 · release notes

      kube2iam 0.12.0 now supports IMDSv2 via aws-go-sdk-v2

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.12.0 https://github.com/jtblin/kube2iam.git
# already have the repo? check out this version:
$ git checkout 0.12.0
      • Adds support for AWS Instance Metadata Service version 2 (IMDSv2)
      • Switches underlying AWS SDK dependency to aws-go-sdk-v2

      2 details in Everything

    3. 0.11.0 Mar 1, 2022 · release notes

      kube2iam v0.11.0 adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Docker image support and a Helm chart with rolling update options.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.11.0 https://github.com/jtblin/kube2iam.git
# already have the repo? check out this version:
$ git checkout 0.11.0
      • Adds Helm chart maxUnavailable option for rolling updates

      1 detail in Everything

    4. 0.10.9 Mar 5, 2020 · release notes

      Adds --resolve-duplicate-cache-ips flag to handle pod IP conflicts in the cache.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.10.9 https://github.com/jtblin/kube2iam.git
# already have the repo? check out this version:
$ git checkout 0.10.9
      └──▷ USE IT
      Enable duplicate IP conflict resolution when running kube2iam.
      shell 
      kube2iam --resolve-duplicate-cache-ips
      • Updates client-go to k8s 1.17.3
      • Updates Go version to 1.14 and adds go mod support

      2 details in Everything

    5. 0.10.8 Jul 29, 2019 · release notes

      kube2iam 0.10.8 adds support for AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. External ID via optional annotation

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.10.8 https://github.com/jtblin/kube2iam.git
# already have the repo? check out this version:
$ git checkout 0.10.8
      • Adds the iam.amazonaws.com/external-id annotation to allow specifying an AWS External ID for STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. role assumption

      1 detail in Everything

    6. 0.10.3 Aug 30, 2018 · release notes

      kube2iam 0.10.3 adds Prometheus metrics support and regional STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. endpoint configuration

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.10.3 https://github.com/jtblin/kube2iam.git
# already have the repo? check out this version:
$ git checkout 0.10.3
      • Allows use of STS regional endpoints

      1 detail in Everything

    7. 0.10.2 Aug 17, 2018 · release notes

      Adds opt-in regexp support for namespace restrictions to broaden filtering scope

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.10.2 https://github.com/jtblin/kube2iam.git
# already have the repo? check out this version:
$ git checkout 0.10.2
      • Adds regexp support for iam.enforce_namespace_whitelist to allow regex patterns in whitelist checks.

      1 detail in Everything

    8. 0.3.3 Apr 24, 2017 · release notes

      kube2iam v0.3.3 allows roles annotated with full ARNs, enabling cross-account assumption.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.3.3 https://github.com/jtblin/kube2iam.git
# already have the repo? check out this version:
$ git checkout 0.3.3
      • Allow roles to be annotated with the base name or the full ARN
      • Allow full ARNs to be assumed, including cross-AWS account

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in jtblin/kube2iam, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 2 −4 vs prior 12 months
    2. Maintainers 1 +0 joined · −1 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 2.1 years first maintainer reply 139 days
    6. Open backlog 4 of 235 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 4
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 2,042
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback