Users and bots¶

In Usuarios (Users) you create people and bots, hand out the administrator role, and disable accounts. Here's every operation and what it triggers.

Before you start¶

• You're a kubelatch administrator.
• Accounts are only created from here or from the binary's CLI. There's no self-signup or email sending: you share the links over a secure channel.
• Logins are immutable and never reused, even after disabling the account. They're the identity clusters see: user:<login> for people and bot:<name> for bots.

Add a person¶

1. In Usuarios, leave Tipo (Type) as Persona (Person).
2. Fill in Login (lowercase letters, digits, ., _ or -, 1 to 63 characters), Nombre (Name) and Correo (Email). Check Administrador (Administrator) if it applies.
3. Click Crear e invitar (Create and invite).
4. Copy the link from the dialog and share it over a secure channel. It isn't shown again.

The link looks like <KUBELATCH_BASE_URL>/cuenta#kli_… and is valid for 72 hours. The token comes after the #, so it never reaches server or proxy logs. The /cuenta page clears it from the address bar as soon as it's read: if the person reloads, they'll see Enlace no válido (Invalid link) even though the original link still works.

What the person does with the link depends on the mode:

• Without GitHub: they set a password (12 to 128 characters, different from the login) and sign in.
• With GitHub: they click Vincular con GitHub y entrar (Link with GitHub and sign in) and authorize the App. They don't set any password. See GitHub login.

Afterwards, grant them permissions in Permisos (Permissions) (Grant permissions). They issue their credential in Inicio (Home) (Get a credential).

If the link is lost or expires, generate another one: Enlace de reset (Reset link; without GitHub) or Enlace de vinculación (Linking link; with GitHub). Generating a new one cancels that person's pending links.

Reset and linking links¶

Both come from the same button in the row, last 24 hours and are single use. Generating one immediately closes that person's sessions and cancels their pending links; it can't be generated for a disabled account:

Specific cases (forgotten password, locked account, changed GitHub account) are in Accounts and recovery.

Disable and enable¶

Deshabilitar (Disable) (person or bot), after confirming:

• Revokes all their credentials instantly: the next request gets a 401 and open exec or watch sessions are cut within 10 s.
• Closes their sessions and cancels their pending links.
• On the next reconciliation, removes them from the list of subjects the proxy can impersonate on each cluster.

Their permissions are kept, but don't count while they're disabled. Habilitar (Enable) puts them back on the clusters without granting anything again. It doesn't bring back credentials or links: you have to issue or generate new ones.

The interface won't let you disable yourself (the API will, unless you're the last administrator who can sign in). When someone leaves the company, disable them the same day. With GitHub, removing them from the organization is enough: see GitHub login.

Subjects are never deleted: disabling is how you retire them.

Administrators¶

The Admin column grants or removes the role. Removing it asks for confirmation. The interface won't let you change your own role (the API will, unless you're the last administrator who can sign in). An administrator sees the Clusters, Permisos, Credenciales (Credentials), CI, Auditoría (Audit) and Usuarios screens.

kubelatch prevents removing the role, disabling, unlinking from GitHub or unmarking as break-glass for the last administrator who can sign in, and responds 409. "Can sign in" means: with a password, or, with GitHub on, with a break-glass password or with GitHub linked.

Close sessions¶

Cerrar sesiones (Close sessions) closes all of that person's web sessions instantly. It doesn't revoke their credentials: for that, use Revocar (Revoke) in Credenciales or disable them.

Unlink GitHub¶

With GitHub on, Desvincular GitHub (Unlink GitHub) separates the account from its GitHub account and closes its sessions. Until it's linked again with a Enlace de vinculación, it can only sign in as a break-glass account.

Use it when someone linked the wrong GitHub account, or when linking returns github_taken (that GitHub account is already linked to someone else).

Bots¶

A bot is a subject with no password or session: it only has credentials. It's for CI, Argo CD and any automation.

1. In Usuarios, choose Tipo → Bot (CI, Argo CD…).
2. Put the name in Login (lowercase letters, digits and dashes, 1 to 63 characters) and, if you want, a descriptive Nombre.
3. Click Crear bot (Create bot).
4. Grant it permissions in Permisos, like any subject.

There are two ways to give it credentials:

• From GitHub Actions, with no secrets: a trust rule in CI (CI: trust rules).
• By hand: in Credenciales → Emitir para un sujeto (Issue for a subject), pick the bot, set Nombre, Duración (Duration) and, if you want, a Cluster, and click Emitir credencial (Issue credential). The token and the kubeconfig are shown only once. Every credential expires: for a bot, at most after 90 days (KUBELATCH_MAX_TTL_BOT).

Save the kubeconfig in the secret manager of whatever tool uses it and note its expiry on your calendar. Issuing a credential requires the bot to have at least one active permission.

A compromised bot: revoke its credentials in Credenciales or disable it, which revokes all of them and removes it from the clusters. Enlace de reset and Cerrar sesiones don't apply to bots.

Via the API¶

Everything above exists in the JSON API too, for example POST /api/subjects (with "kind":"bot" for a bot), POST /api/subjects/<id>/disable, /enable, /logout and /reset-link, and DELETE /api/subjects/<id>/github. The full list is in HTTP API.