Notifications¶
kubelatch warns each person before one of their permissions ends, so nobody loses access halfway through a task without seeing it coming. The warning reaches people where they work: in the output of kubectl, in their AI agent, in the bell and by e-mail. All of it works in Free.
When each warning arrives¶
The moments depend on how long the permission lasts, from when it was granted to when it ends:
| Where | A permission of 4 hours or more | A shorter one |
|---|---|---|
kubectl and any Kubernetes client |
The last hour | The last quarter of its duration |
| The person's AI agent | The last hour | The last quarter of its duration |
| The bell | The last 24 hours | The last 24 hours, so almost from the start |
| Sent | |
|---|---|
| A permission of more than two days | 24 hours before the end |
| A permission of two days or less | A quarter of its duration before the end: 2 hours before, for one of 8 hours |
Nothing warns about:
- a permission without an expiry date;
- a permission covered by another of the same role, cluster and scope that ends later or never. The warnings come only when the last of them is about to end.
When an administrator extends a group permission, its members are warned again in its new window.
In kubectl¶
In the warning window, every answer the cluster sends carries a Warning header. kubectl, helm and any client built on client-go print it on standard error:
Warning: kubelatch: your access to prod as developer on namespace apps ends in 42 min (14:05 UTC)
A request carries at most three of these warnings, for the permissions that end first. The line is always in English, as kubectl's own messages are. kubelatch's own refusals don't carry it, since they already say why.
In the AI agent¶
The tools of the MCP server add the same sentence at the end of their answer when a permission the agent uses on that cluster is in its window, so the agent can tell its person. When it is the agent's session that ends first, the sentence says so:
kubelatch: this agent session ends in 20 min (09:30 UTC); reconnect and consent again to carry on
In the bell¶
The bell in the top bar lists the person's permissions that end within 24 hours, with a link to Home, where they can see all their access. It shows them to everyone, administrators or not, and checks again every minute.
By e-mail¶
The e-mail needs e-mail set up on the server: the same Resend key that sends the invitations (E-mailed invitations). Without it, kubelatch sends nothing, and the other warnings keep working.
- Each permission sends one e-mail, to the address on the account, in the language the person chose in kubelatch (English if they never chose one). Bots never get e-mails.
- If Resend doesn't answer, or refuses the key, kubelatch tries again after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours, without ever sending the same e-mail twice. An e-mail Resend refuses for itself (a bad address, for instance) is not tried again; the server log says so in the line
notify: e-mail not sent. - If the permission ends, is revoked or changes its end before the e-mail goes out, the e-mail doesn't go.
Each person can turn these e-mails off in My account → Preferences → E-mail me before a permission expires. The bell and the kubectl warning stay on. The change is recorded in the audit as user.notifications.
kubelatch keeps a record of each e-mail for 8 days, whatever the edition, so it never sends the same one twice. It isn't part of the audit.