OpenParable
Skip to content
← Back to skills

Kube2iam Triage

DevOps & Security
kube2iam-triage

Kube2iam Triage is an Agent Skill for devops & security published in the jtblin/kube2iam repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Project-specific triage and design principles for kube2iam, focusing on AWS API limits and local environment support.

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/jtblin/kube2iam/blob/HEAD/.agents/skills/kube2iam_triage/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/kube2iam-triage, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Kube2iam Triage & Design Principles

This skill defines the technical constraints and design patterns specific to the kube2iam project.

When to use this skill

  • Use this when triaging issues related to AWS credentials, IAM roles, or STS.
  • Use this when designing features that interact with host networking or iptables.
  • Use this to address compatibility with local development tools like Minikube.

How to use it

1. Be Mindful of External API Limits

  • Principle: Stability of the AWS account takes precedence over minor latency gains.
  • Avoid: Do not implement "prefetching" of credentials or high-frequency background refreshes that could lead to account-wide AWS STS/IAM throttling.
  • Design: Design solutions that minimize the frequency and volume of AWS API calls.

2. Local Environment & Mocking Support

  • Principle: Ensure the tool can run in mock or local environments where cloud services are unavailable.
  • Strategy: Implement flags (e.g., --disable-metadata-healthcheck) to allow bypassing cloud-specific checks when static credentials are provided.

3. Environmental Troubleshooting

  • Clock Sync: For SignatureDoesNotMatch errors, always investigate clock drift in the host/VM first.
  • Race Conditions: Recognize that CNI interfaces may not be ready at startup. Implement graceful retry logic (e.g., 10-15s) in networking setup instead of immediate failure.