jtblin/kube2iam

Health v2 · maintenance only

Adoption not part of the score

2042 stars · 332 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

kube2iam is a Kubernetes daemonset that intercepts traffic to the EC2 metadata API and returns per-pod AWS IAM credentials based on pod annotations. It lets containers in a shared cluster assume distinct IAM roles instead of sharing the node's instance profile role.

Use cases

• give each pod its own AWS IAM role in a multi-tenant Kubernetes cluster
• avoid creating a union IAM role for all containers on a node
• redirect EC2 metadata API calls to a proxy that returns scoped temporary credentials
• manage AWS credentials for pods via Kubernetes annotations
• secure AWS access for containers without embedding static keys

When to choose

• running Kubernetes on AWS outside EKS where IRSA is unavailable
• you need per-pod IAM role isolation via annotations on legacy clusters

When to avoid

• using EKS — prefer AWS IAM roles for service accounts (IRSA), the official drop-in replacement
• clusters not running on AWS
• you want a maintained, modern solution — this project is in maintenance mode

Facets

service · maturity maintenance

auth security proxy middleware cloud-computing security go cloud aws-iam kubernetes ec2-metadata iam-roles pods credentials-proxy devops containers docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="jtblin/kube2iam")