Roadmap¶

This page says what comes next in kubelatch over the coming months, and in what order. The dates are indicative: a phase closes when what it promises works, even if the month has gone by. Only the phase in progress is a commitment; the rest set the direction and move with what people ask for.

The order has a logic to it: first, a team gets in with the identity it already has and sees what kubelatch is for on day one; then asking for access to production becomes just that, a request; then the evidence an auditor asks for; and last, agents and sessions. What belongs to Free stays in Free; what lands in Pro carries its label.

If kubelatch is missing something you need, say so in the roadmap thread on GitHub Discussions or through the contact page. What has already shipped is on the Releases page.

Phase 1 · Get in on day one¶

In progress · late 2026 · Free

Sign-in with your organization's identity provider (an OIDC-compatible one), onboarding without waiting for someone to invite you, an audit that is easier to read, notifications about what affects you, and the CI credential in a single step of the pipeline.

Phase 2 · Ask for access, not a favor¶

Next · around the turn of the year · Pro

Access requests with approval, rules per environment that decide how long a permission lasts and when it needs approving, owners who approve without being administrators, the groups you already have in your identity provider, and blocking someone on the spot, in a single step.

Phase 3 · Show it to the auditor¶

Later · Pro

The audit outside kubelatch, in the tools you already use, with a way to check that nobody has touched it; periodic access reviews; and a report with what standards and auditors ask about access to your clusters.

Phase 4 · Agents with limits¶

Later · Pro

AI agents with visible limits: how much each one may do without asking, a record of what it proposed and what was approved, and alerts when something is out of the ordinary.

Phase 5 · Sessions on record¶

Later · Pro

What happens inside an interactive session is recorded, the most sensitive actions on production ask for an extra confirmation, and on-call access comes with the shift, without asking.

On request¶

SCIM, SAML and access to clusters that are not exposed to the internet sit outside these phases and come in when a customer needs them.

What does not change¶

Free stays the whole product with some limits, and the core of phase 1 lands in Free; only the notifications that go out to other tools are Pro. kubelatch sends no usage data (it only checks once a day whether there is a new version, without identifying itself), so the order moves with the requests that come in through Discussions and the contact page. This page is revised when each phase closes.