{"id":38405325,"url":"https://github.com/ryodocx/kube-credential-cache","last_synced_at":"2026-01-17T04:00:49.947Z","repository":{"id":56747504,"uuid":"523558856","full_name":"ryodocx/kube-credential-cache","owner":"ryodocx","description":"Accelerator cache for kubernetes access","archived":false,"fork":false,"pushed_at":"2024-06-12T20:29:24.000Z","size":438,"stargazers_count":12,"open_issues_count":3,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-06-21T18:11:43.465Z","etag":null,"topics":["cache","go","kubectl","kubernetes"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ryodocx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-11T02:18:28.000Z","updated_at":"2024-04-18T10:32:30.000Z","dependencies_parsed_at":"2023-11-21T02:30:33.792Z","dependency_job_id":"e770421f-0e2c-4fd4-9535-2a3ca2c523f3","html_url":"https://github.com/ryodocx/kube-credential-cache","commit_stats":null,"previous_names":["ryodocx/k8s-token-cache"],"tags_count":23,"template":false,"template_full_name":null,"purl":"pkg:github/ryodocx/kube-credential-cache","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryodocx%2Fkube-credential-cache","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryodocx%2Fkube-credential-cache/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryodocx%2Fkube-credential-cache/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryodocx%2Fkube-credential-cache/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ryodocx","download_url":"https://codeload.github.com/ryodocx/kube-credential-cache/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ryodocx%2Fkube-credential-cache/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28494115,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-17T02:39:23.645Z","status":"ssl_error","status_checked_at":"2026-01-17T02:34:19.649Z","response_time":85,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cache","go","kubectl","kubernetes"],"created_at":"2026-01-17T04:00:28.071Z","updated_at":"2026-01-17T04:00:49.936Z","avatar_url":"https://github.com/ryodocx.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# kcc: kube-credential-cache\n\n[![lint](https://github.com/ryodocx/kube-credential-cache/actions/workflows/golangci-lint.yaml/badge.svg)](https://github.com/ryodocx/kube-credential-cache/actions/workflows/golangci-lint.yaml)\n[![CodeQL](https://github.com/ryodocx/kube-credential-cache/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/ryodocx/kube-credential-cache/actions/workflows/codeql-analysis.yml)\n[![asdf-test](https://github.com/ryodocx/kube-credential-cache/actions/workflows/asdf-test.yml/badge.svg)](https://github.com/ryodocx/kube-credential-cache/actions/workflows/asdf-test.yml)\n[![GoReleaser](https://github.com/ryodocx/kube-credential-cache/actions/workflows/goreleaser.yaml/badge.svg)](https://github.com/ryodocx/kube-credential-cache/actions/workflows/goreleaser.yaml)\n[![Go Report Card](https://goreportcard.com/badge/github.com/ryodocx/kube-credential-cache)](https://goreportcard.com/report/github.com/ryodocx/kube-credential-cache)\n\nFast access to Kubernetes!\nEspecially effective with kubectl + EKS, about 3~4x faster!\n\n```sh\n# first time access\n$ time kubectl version \u0026\u003e/dev/null\nkubectl version \u0026\u003e /dev/null  0.42s user 0.10s system 59% cpu 0.868 total\n\n# cache effective\n$ time kubectl version \u0026\u003e/dev/null\nkubectl version \u0026\u003e /dev/null  0.05s user 0.02s system 24% cpu 0.308 total\n```\n\n## Architecture\n[![](./docs/summary.drawio.svg)](./docs)\n\ndetails is [here](./docs) (includes sequence diagram)\n\n## Features\nWork as caching proxy of [ExecCredential](https://kubernetes.io/docs/reference/config-api/client-authentication.v1/#client-authentication-k8s-io-v1-ExecCredential) object, when use [credential plugins](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) of Kubernetes. (e.g. kubectl)\n\n- kcc-cache\n  - [x] Cache [ExecCredential](https://kubernetes.io/docs/reference/config-api/client-authentication.v1/#client-authentication-k8s-io-v1-ExecCredential) object\n  - [x] Concern Command, Args, Env as cache-key\n  - [ ] Cache file encryption\n  - [ ] kubeconfig automated maintenance\n- kcc-injector\n  - [x] kubeconfig optimize (inject kcc-cache command automatically)\n  - [x] kubeconfig recovery (remove injected commands)\n\n## Effects\nA one of notable effect is, when used [`aws eks update-kubeconfig`](https://docs.aws.amazon.com/eks/latest/userguide/create-kubeconfig.html) to access EKS. about 500ms(about 3~4x) faster!\n\n![](./benchmark/graph_eks.svg)\n\nbenchmark is [here](./benchmark/)\n\n## Installation\n\n```sh\n# go install\ngo install github.com/ryodocx/kube-credential-cache/cmd/kcc-cache@latest\ngo install github.com/ryodocx/kube-credential-cache/cmd/kcc-injector@latest\n\n# asdf-vm: https://asdf-vm.com\nasdf plugin add kube-credential-cache\n\n# aqua: https://aquaproj.github.io\naqua g -i ryodocx/kube-credential-cache\n```\n\nor download from [releases](https://github.com/ryodocx/kube-credential-cache/releases)\n\n## Usage(edit kubeconfig)\n\n:running: install \u0026 just run `kcc-injector -i ~/.kube/config`\n\n:ambulance: restore kubeconfig: `kcc-injector -i -r \u003cyour kubeconfig\u003e`\n\n\n\u003cdetails\u003e\n\u003csummary\u003emanual setup\u003c/summary\u003e\n\u003cp\u003e\n\nif manually edit kubeconfig,\n  * set `kcc-cache` to command\n  * original command move to args\n  * :warning: **Do not use the same pattern for command, args and env**\n    * :warning:U sing the same pattern presents the risk of mixing up credentials\n    * :warning: env is ignored if not in `KUBE_CREDENTIAL_CACHE_CACHEKEY_ENV_LIST`\n    * if use `kcc-injector`, generate unique env `KUBE_CREDENTIAL_CACHE_USER` from user's name\n\nEKS (same effect as `kcc-injector -i \u003cyour kubeconfig\u003e`)\n\n```diff\nkind: Config\napiVersion: v1\nclusters: [...]\ncontexts: [...]\ncurrent-context: \u003cyour-current-context\u003e\npreferences: {}\nusers:\n  - name: user-name\n    user:\n      exec:\n        apiVersion: client.authentication.k8s.io/v1beta1\n-       command: aws\n+       command: kcc-cache\n        args:\n+         - aws\n          - --region\n          - \u003cyour-region\u003e\n          - eks\n          - get-token\n          - --cluster-name\n          - \u003cyour-cluster\u003e\n        env:\n          - name: AWS_PROFILE\n            value: \u003cyour-profile\u003e\n```\n\nEKS with [aws-vault](https://github.com/99designs/aws-vault)\n\n```diff\nkind: Config\napiVersion: v1\nclusters: [...]\ncontexts: [...]\ncurrent-context: \u003cyour-current-context\u003e\npreferences: {}\nusers:\n  - name: user-name\n    user:\n      exec:\n        apiVersion: client.authentication.k8s.io/v1beta1\n-       command: aws\n+       command: kcc-cache\n        args:\n+         - aws-vault\n+         - exec\n+         - \u003cyour-profile\u003e\n+         - --\n+         - aws\n          - --region\n          - \u003cyour-region\u003e\n          - eks\n          - get-token\n          - --cluster-name\n          - \u003cyour-cluster\u003e\n-       env:\n-         - name: AWS_PROFILE\n-           value: \u003cyour-profile\u003e\n```\n\nkubeconfig specification\n* https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/\n* https://pkg.go.dev/k8s.io/client-go/tools/clientcmd/api/v1#Config\n\n\u003c/p\u003e\n\u003c/details\u003e\n\n## Troubleshooting\n\n###### `error: You must be logged in to the server (the server has asked for the client to provide credentials)` at kubectl\nIncorrect credentials may be cached.  \nFor example, occur when using the wrong pair of aws-vault context and kubecontext.  \nThe root cause is aws command return invalid credential without error.  \n**Try remove cache file!** In macOS: `rm ~/Library/Caches/kube-credential-cache/cache.json`  \n※see below `kcc-cache` configuration for other environment\n\n###### `...Corruption detected, recreate cache file`\nDetected broken cachefile.  \nThe cause is unknown. However, we ignore error by recreating the cache currently.\n\n## Configration\n\n### kcc-cache\n\n| Environment variable                    | default                                                                                                                                                                                                                                        | description                                        |\n|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------|\n| KUBE_CREDENTIAL_CACHE_FILE              | macOS:\u003c/br\u003e`~/Library/Caches/kube-credential-cache/cache.json`\u003c/br\u003eLinux:\u003c/br\u003e`$XDG_CACHE_HOME/kube-credential-cache/cache.json`\u003c/br\u003e`~/.cache/kube-credential-cache/cache.json`\u003c/br\u003eWindows:\u003c/br\u003e`%AppData%\\kube-credential-cache\\cache.json` | path of Cache file                                 |\n| KUBE_CREDENTIAL_CACHE_REFRESH_MARGIN    | `30s`                                                                                                                                                                                                                                          | margin of credential refresh                       |\n| KUBE_CREDENTIAL_CACHE_CACHEKEY_ENV_LIST | `KUBE_CREDENTIAL_CACHE_USER,AWS_PROFILE,AWS_REGION,AWS_VAULT`                                                                                                                                                                                  | comma separated env names for additional cache-key |\n\n### kcc-injector\n\n```sh\n$ kcc-injector -h\nUsage: kcc-injector [flags] \u003ckubeconfig filepath\u003e\n  -c string\n        injection command (default \"kcc-cache\")\n  -i    edit file in-place\n  -r    restore kubeconfig to original\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fryodocx%2Fkube-credential-cache","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fryodocx%2Fkube-credential-cache","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fryodocx%2Fkube-credential-cache/lists"}