Glossary¶

The terms this documentation uses, in alphabetical order, with a link to where they're explained.

Term	What it is
Administrator (role)	Person with the administrator role in kubelatch: manages clusters, permissions, accounts and trust rules. Not to be confused with the `admin` tier. See Users and bots.
Audit log	kubelatch's two logs: `audit_events` (one row per proxy request) and `control_events` (control plane actions and login attempts). See Security model.
Audit-ID	Unique identifier (UUIDv7) kubelatch assigns to every proxy request. It goes in the response, in the audit row, and in the request to the cluster, which uses it as its `auditID`. See The journey of a request.
Bootstrap	Manifest kubelatch generates for each cluster: creates the `kubelatch-system` namespace and the proxy's and reconciler's ServiceAccounts. See Register a cluster.
Bot	Subject for automation: no password or session, only credentials. Appears in the cluster as `bot:<name>`. See Users and bots.
Break-glass account	Account that can sign in with a password even while GitHub login is active. Only set from the CLI, and has no two-factor. See Identity.
CI exchange	Exchange of a GitHub Actions job's OIDC token for a short-lived bot credential, at `/v1/ci/github-actions/token`. See Credentials for GitHub Actions.
Cluster	A Kubernetes cluster registered in kubelatch, with an id (slug) that's part of the proxy URL: `/clusters/<id>`. See Register a cluster.
Control plane	kubelatch's JSON API and web interface. See Architecture.
Credential	A `klt_…` token plus the kubeconfig that uses it. Has an owner, an expiry, a last use, and can be revoked. See Get a credential.
Disable	Cut off a subject's access: closes sessions, revokes credentials, and removes it from the clusters. Keeps its permissions in case it's re-enabled. See Identity.
GitHub App	Your GitHub organization's application that people use to sign in to kubelatch and that enables automatic offboarding. See GitHub login.
Group `kubelatch:…`	Group the proxy impersonates for each active permission: `kubelatch:ns:<namespace>:<tier>` or `kubelatch:cluster:<tier>`. The cluster's bindings point to these groups. See Tiers.
Impersonation	Kubernetes mechanism by which one identity (the proxy's ServiceAccount) acts on behalf of another, using `Impersonate-*` headers. See Why a proxy.
Invitation link	One-time link (`<base>/cuenta#kli_…`, 72 h) a new person uses to set their password or link GitHub. See Identity.
kubeconfig	kubectl's configuration file. kubelatch's has one context per cluster, all with `server: https://<kubelatch>/clusters/<id>` and the same token. See kubectl, k9s, Lens and Helm.
Link	Associate a kubelatch account with a GitHub account's numeric id. See Identity.
Linking link	One-time link (24 h) an admin generates to link an existing account with GitHub. Without GitHub, or on a break-glass account, the same button is called Enlace de reset (Reset link) and sets a new password. See Identity.
Management cluster	The cluster kubelatch runs on. It can be one of the clusters it manages. See Install.
Member sync	Hourly pass that disables accounts whose owner is no longer a member of the GitHub organization. See Identity.
Native audit log	The audit log of the cluster itself or its cloud provider. A second source, correlated by `Audit-ID`. See Security model.
Permission (grant)	Subject + cluster + tier + scope, with an optional expiry (required for `cluster-admin`). Active as long as it's not revoked or expired. See Grant permissions.
Person	Human subject: signs in to the interface and requests credentials. Appears in the cluster as `user:<login>`. See Identity.
Protected namespace	Namespace that admits no permission of any tier: `kube-system`, `kube-public`, `kube-node-lease`, `kubelatch-system`, and those in `KUBELATCH_PROTECTED_NAMESPACES`. See Tiers.
Proxy	The part of kubelatch that receives requests from kubectl and CI at `/clusters/<id>/…` and forwards them to the cluster with impersonation, acting as the subject. See The journey of a request.
Proxy's ServiceAccount	`kubelatch-proxy`, the identity the proxy uses to talk to each cluster; it can only impersonate. See Architecture.
PSA (Pod Security Admission)	Kubernetes control that limits which pods can be created in a namespace based on its `pod-security.kubernetes.io/enforce` label. `developer`, `debugger` and `admin` require `baseline` or `restricted`. See Tiers.
Reconciler	The part of kubelatch that keeps each cluster's tier ClusterRoles, bindings, and the list of who the proxy can impersonate up to date. Runs when a permission changes, on request, and every 10 minutes. See Architecture.
Reconciler's ServiceAccount	`kubelatch-reconciler`, the identity the reconciler uses to write RBAC in each cluster. See Architecture.
`resourceNames`	List of names an RBAC rule is limited to. The proxy's ServiceAccount can only impersonate the users and groups on that list. See Security model.
Retention	How long the audit log is kept before the periodic retention job deletes it: `KUBELATCH_AUDIT_RETENTION`, 90 days by default. See Audit and retention.
Revoke	Invalidate a credential or a permission before its expiry. A revoked credential fails on the next request and its streams are cut within 10 s. See Expiry and revocation.
Scope	Where a permission is valid: a namespace or `*` (the whole cluster). See Tiers.
Session	The web interface's `kubelatch_session` cookie, valid for 12 h. It doesn't work for talking to clusters. See Identity.
Subject	Anything that can have permissions: a person or a bot. See Identity.
Tier	A set of Kubernetes permissions: `viewer`, `developer`, `debugger`, `secrets-reader`, `admin` or `cluster-admin`. See Tiers.
Token `klt_`	The secret part of a credential: `klt_` plus 43 characters. Shown once only; kubelatch only stores its SHA-256. See Security model.
Trust rule	Rule that says which GitHub repository (and optionally which ref or environment) can exchange its OIDC token for which bot's credential. See CI: trust rules.