tomevault-io Kube2iam Triage & Design Principles
This skill defines the technical constraints and design patterns specific to the kube2iam project.
When to use this skill
- Use this when triaging issues related to AWS credentials, IAM roles, or STS.
- Use this when designing features that interact with host networking or iptables.
- Use this to address compatibility with local development tools like Minikube.
How to use it
1. Be Mindful of External API Limits
- Principle: Stability of the AWS account takes precedence over minor latency gains.
- Avoid: Do not implement "prefetching" of credentials or high-frequency background refreshes that could lead to account-wide AWS STS/IAM throttling.
- Design: Design solutions that minimize the frequency and volume of AWS API calls.
2. Local Environment & Mocking Support
- Principle: Ensure the tool can run in mock or local environments where cloud services are unavailable.
- Strategy: Implement flags (e.g.,
--disable-metadata-healthcheck) to allow bypassing cloud-specific checks when static credentials are provided.
3. Environmental Troubleshooting
- Clock Sync: For
SignatureDoesNotMatcherrors, always investigate clock drift in the host/VM first. - Race Conditions: Recognize that CNI interfaces may not be ready at startup. Implement graceful retry logic (e.g., 10-15s) in networking setup instead of immediate failure.
Source: jtblin/kube2iam — distributed by TomeVault.