# jtblin/kube2iam

kube2iam  provides different AWS IAM roles for pods running on Kubernetes

Repository: https://github.com/jtblin/kube2iam
Canonical: https://ross.abutalabs.com/products/kube2iam
Language: HTML
License: BSD-3-Clause
License Family: permissive
Topics: kubernetes, aws
Last push: 2026-05-08T11:59:36+00:00

## Health v2 (maintenance only)
Score: 85/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 81, release rhythm 82, longevity 100
- inputs: {"age_days": 3769, "days_push": 117, "days_rel": 121, "gap_med": 4, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2042, forks 332 (observed 2026-08-28T04:06:08.626913+00:00)

## What it is
kube2iam is a Kubernetes daemonset that intercepts traffic to the EC2 metadata API and returns per-pod AWS IAM credentials based on pod annotations. It lets containers in a shared cluster assume distinct IAM roles instead of sharing the node's instance profile role.

## Use cases
- give each pod its own AWS IAM role in a multi-tenant Kubernetes cluster
- avoid creating a union IAM role for all containers on a node
- redirect EC2 metadata API calls to a proxy that returns scoped temporary credentials
- manage AWS credentials for pods via Kubernetes annotations
- secure AWS access for containers without embedding static keys

## When to choose
- running Kubernetes on AWS outside EKS where IRSA is unavailable
- you need per-pod IAM role isolation via annotations on legacy clusters

## When to avoid
- using EKS — prefer AWS IAM roles for service accounts (IRSA), the official drop-in replacement
- clusters not running on AWS
- you want a maintained, modern solution — this project is in maintenance mode

## Facets
- artifact type: service
- maturity: maintenance
- function: auth, security, proxy, middleware
- domain: cloud-computing, security
- platform: go, cloud
- tags: aws-iam, kubernetes, ec2-metadata, iam-roles, pods, credentials-proxy, devops, containers, docker

## Member repositories
- jtblin/kube2iam (main) score 85

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:08.626913+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:58:18.008923+00:00, confidence not recorded.
  - readme: https://github.com/jtblin/kube2iam (fetched 2026-08-28T04:06:08.626913+00:00, sha de60706ff5b0)
- Data as of 2026-08-30T08:39:29.467469+00:00.