# Kube2iam Triage

> Kube2iam Triage is an Agent Skill for devops & security published in the jtblin/kube2iam repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Project-specific triage and design principles for kube2iam, focusing on AWS API limits and local environment support.

- Skill name: `kube2iam-triage`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/jtblin/kube2iam/blob/HEAD/.agents/skills/kube2iam_triage/SKILL.md
- Repository: jtblin/kube2iam (2,041 GitHub stars when collected)

## SKILL.md

# Kube2iam Triage & Design Principles

This skill defines the technical constraints and design patterns specific to the `kube2iam` project.

## When to use this skill

- Use this when triaging issues related to AWS credentials, IAM roles, or STS.
- Use this when designing features that interact with host networking or iptables.
- Use this to address compatibility with local development tools like Minikube.

## How to use it

### 1. Be Mindful of External API Limits
- **Principle**: Stability of the AWS account takes precedence over minor latency gains.
- **Avoid**: Do not implement "prefetching" of credentials or high-frequency background refreshes that could lead to account-wide AWS STS/IAM throttling.
- **Design**: Design solutions that minimize the frequency and volume of AWS API calls.

### 2. Local Environment & Mocking Support
- **Principle**: Ensure the tool can run in mock or local environments where cloud services are unavailable.
- **Strategy**: Implement flags (e.g., `--disable-metadata-healthcheck`) to allow bypassing cloud-specific checks when static credentials are provided.

### 3. Environmental Troubleshooting
- **Clock Sync**: For `SignatureDoesNotMatch` errors, always investigate clock drift in the host/VM first.
- **Race Conditions**: Recognize that CNI interfaces may not be ready at startup. Implement graceful retry logic (e.g., 10-15s) in networking setup instead of immediate failure.

---

Source: https://www.openparable.com/skill/devops-security/kube2iam-triage (OpenParable). Cite the canonical URL above.