# Kube2iam Triage

> Project-specific triage and design principles for kube2iam, focusing on AWS API limits and local environment support.

- Skill: `jtblin/kube2iam-triage` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jtblin/kube2iam-triage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jtblin/kube2iam-triage/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: jtblin (https://skillmd.com/u/jtblin)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/jtblin/kube2iam-triage

---


# Kube2iam Triage & Design Principles

This skill defines the technical constraints and design patterns specific to the `kube2iam` project.

## When to use this skill

- Use this when triaging issues related to AWS credentials, IAM roles, or STS.
- Use this when designing features that interact with host networking or iptables.
- Use this to address compatibility with local development tools like Minikube.

## How to use it

### 1. Be Mindful of External API Limits
- **Principle**: Stability of the AWS account takes precedence over minor latency gains.
- **Avoid**: Do not implement "prefetching" of credentials or high-frequency background refreshes that could lead to account-wide AWS STS/IAM throttling.
- **Design**: Design solutions that minimize the frequency and volume of AWS API calls.

### 2. Local Environment & Mocking Support
- **Principle**: Ensure the tool can run in mock or local environments where cloud services are unavailable.
- **Strategy**: Implement flags (e.g., `--disable-metadata-healthcheck`) to allow bypassing cloud-specific checks when static credentials are provided.

### 3. Environmental Troubleshooting
- **Clock Sync**: For `SignatureDoesNotMatch` errors, always investigate clock drift in the host/VM first.
- **Race Conditions**: Recognize that CNI interfaces may not be ready at startup. Implement graceful retry logic (e.g., 10-15s) in networking setup instead of immediate failure.