k8sman

A fast, native Kubernetes IDE for macOS, Windows and Linux.

Live tables you shape with jq, an inspector that explains why things are broken, and logs, terminals, port-forwards, Argo CD, Helm and security in one window.

Download for macOS, Windows or Linux · Features · All features · Build from source

Why k8sman

• Live tables you shape with jq. Every resource type, CRDs included, streams in over watches. Columns are jq expressions you edit with a live preview.
• An inspector that explains why. k8sman doesn't just print 0/1 ready. It tells you the container crash-looped 7 times with exit code 1, shows the termination message, and links you to the previous instance's logs.
• Logs, terminals, alerts and port-forwards in one place. A bottom dock holds alerts and tabs for logs and shells, including a local shell whose kubectl follows the cluster on screen. Port-forwards survive pod restarts and app relaunches.
• GitOps and Helm built in. You get Argo CD sync, health and per-resource diffs, and Helm history diffs, rollbacks and dry-run upgrades, without leaving the app.
• Security insights. See network exposure, risky RBAC, Pod Security failures, best practices and image CVEs ranked across the cluster.

It's a real desktop app for macOS, Windows and Linux: a single download with the backend embedded, nothing to run in your cluster, and nothing that leaves your machine.

Every kind Built-ins and CRDs, discovered live	30+ kind panels Pods to Gateways to Argo CD apps	Cluster pages Overview, Nodes, Security, Metrics, Helm, Add-ons, Hubble, plus Alerts and Forwards in the dock
Local only Listens on 127.0.0.1, no telemetry	Native Vibrancy, unified titlebar, dark and light	Self-updating Signed Sparkle updates

Feature tour

Jump anywhere, filter anything

• ⌘K (Ctrl+K on Windows and Linux) opens the command palette from any page: pages, resource kinds (short names like svc work), namespaces, contexts, actions, and objects by name.
• Pick several namespaces at once in the namespace picker (or :ns a,b): tables, Overview, Security, Alerts and Metrics show just those, even when your access covers only those namespaces.
• Save a table as a view (the bookmark in the table toolbar): its kind, namespaces, filter, sort and columns, for any context or only this one. Views live in the sidebar, ⌘K and :view, can be shared as YAML, and one can open at launch.

• The filter box helps you write queries: it suggests columns, then the values seen in that column (Tab or Return to pick). Terms combine: status=Running restarts>3, status!=Running, memory>256Mi, age<1h.

Cluster health at a glance

• The Overview page ranks what's wrong: crash loops, image pull errors, OOM kills, stalled rollouts, failing CronJobs, node pressure, lost PVCs and more.
• Issues are grouped under the workload that owns them, with quick fixes such as Restart, Delete pod or Resume rollout.
• Top warning events from the last hour are deduplicated and counted.
• Alerts in the bottom dock shows firing Alertmanager alerts and silences. A badge on its tab shows when something critical is firing.

Workloads and the inspector

• Select any row to open the inspector: a kind-specific overview, YAML and events, plus actions in the header.
• The Pod panel explains why a pod isn't ready. It also shows containers, probes, env references, volumes, scheduling, QoS and usage against requests and limits.
• Panels cross-link related objects (owners, selected pods, mounting workloads, routes) and you can navigate back.
• Edit YAML with server-side dry-run validation, a diff review before you apply, and conflict detection when the object changed underneath you.
• Open in Editor gives a full-window, split-screen YAML editor: a live diff against the server on the right, validation errors pinned to lines, and the target context and namespace always in view.
• Create resources in the same editor from templates (Deployment, Service, ConfigMap, Secret, Job, CronJob, Ingress, PVC, Namespace, ServiceAccount, Role + RoleBinding) or pasted multi-document YAML. A dry run shows the result for each document before anything is created.

Logs, terminals and port-forwards

• Logs: follow, previous instance, timestamps, wrap, and search with highlighting or "only matching".
• Aggregated logs: press l on a Deployment, StatefulSet, DaemonSet, ReplicaSet, Job or Service (or on two or more selected pods) to see all its pods in one tab, merged by timestamp, each line labelled and colour-coded by pod (and container). The pod set follows rollouts and scaling live; hide sources or search by pod name, or switch to the previous instances. Logs on an Argo Workflow opens the same tab for its step pods.
• Terminals: open a shell in any container. k8sman tries zsh, bash, ash and sh. For distroless images it offers an ephemeral debug container.
• Local shells (macOS and Linux): + in the dock opens your login shell on this machine. Its kubectl, helm and k9s target the context you're viewing, without changing your kubeconfig.
• Alerts: the dock's first tab shows firing Alertmanager alerts and silences, with a badge when something critical is firing, so you can watch them while you work.
• Port-forwards reconnect to a fresh pod when theirs goes away, persist across launches, and can auto-start. They live in the dock's Forwards tab, whose badge shows how many are running.
• ⌘J expands or collapses the dock. Tabs keep streaming while you browse.

Argo CD, with real diffs

• Application, ApplicationSet and AppProject panels show sync and health, the managed resource tree, sync history, the last operation and sync windows.
• Sync, Refresh, Hard refresh and Terminate run from the inspector.
• Per-resource live vs desired diffs come from argocd-server. Connect with your existing argocd login --sso (the token stays in the argocd CLI's own config), with a pasted token, or with the initial admin password.

Helm releases

• See releases across namespaces with values, manifest, hooks, notes and resources.
• Diff any two revisions (manifest and values) and roll back to a revision.
• Upgrade with edited values: a dry run shows the diff before anything changes.
• k8sman detects releases stuck in pending-* and offers the rollback that recovers them. You can also uninstall, optionally keeping history.

Security

• A cluster score and ranked findings across network exposure, RBAC, workload hardening (Pod Security baseline and restricted), images and best practices.

• RBAC analysis flags cluster-admin-equivalent grants, secret readers, and privileged ServiceAccounts that no pod uses.

  

• Image CVEs come from Trivy Operator reports, or from on-demand scans with a local trivy CLI.

• Copy for AI puts a Markdown brief of the findings on your clipboard.

Nodes, metrics and Prometheus

• The Nodes page lists nodes grouped by role, with live usage from metrics-server next to requests and limits, pressure and cordon state. Each node's menu cordons, uncordons or drains it. A drain shows which pods it will evict first, and respects PodDisruptionBudgets.
• The Pods and Nodes tables show live CPU and memory with a small bar and the percentage of the limit (else the request; for nodes, allocatable), amber from 70% and red from 90%. Sort by it, or filter with cpu>500m or memory%>80. The PVC table's Used column shows "12 / 50 Gi" with a bar. The HPA panel shows each metric's live value (including custom and external metrics, for example KEDA) next to its target.
• With Prometheus installed, Pod and Node panels gain 1h/6h history charts. PrometheusRule panels show live rule state, and ServiceMonitor/PodMonitor panels show scrape-target health. k8sman reaches Prometheus through the Kubernetes service proxy, so you don't need a port-forward.

Cilium Hubble

On auto by default: it appears only on clusters where Hubble Relay (or Cilium with Hubble) is found. Turn it on or off in Settings ▸ Integrations.

• A Map of who talks to whom: namespaces around a disc, chords between those that talk, and rays crossing the edge for traffic to and from the world (and through Cilium Ingress), over the last 1, 5 or 15 minutes. Drops show in red. Hover for ports, workloads and world destinations; click through to Can A reach B? or the flows. A matrix shows the same counts as a grid.
• Live network flows from Hubble Relay: for the whole cluster or a namespace on the Hubble page, and for one object in a Flows tab on Pods, Services, Namespaces and workloads. Drops stand out with their reason, and both ends link to their pods and services.
• Drops groups recent drops by source, destination and reason.
• Can A reach B? answers with the verdicts, drop reasons and the policy that decided, then follows the traffic between the two live.
• Filters run in the relay, and k8sman reaches it through its own read-only port-forward, so there's nothing to set up.

Gateway API

• Gateway, GatewayClass, route (HTTPRoute, GRPCRoute, …) and ReferenceGrant panels.
• Status conditions are explained in plain English: why a route wasn't accepted and which listener it attached to.
• Each route comes with a ready-to-run curl hint.

Add-ons

• One-click Helm installs of metrics-server, the Prometheus stack, Trivy Operator, Argo CD, Envoy Gateway and cert-manager.
• Pick a chart version, review the dry-run, and install.

Multi-select and bulk actions

• ⌘-click, ⇧-click and ⌘A select rows. ⇧↑/⇧↓ extends the selection.
• Bulk restart and delete show progress, then a summary of any failures.
• Right-click any row to open it, copy its name or YAML, or run its actions.

Columns you define

• Drag a header to move a column and drag a divider to resize it (double-click to reset). Tables remember their sort, widths and filter across launches.

• Each column is a jq expression with a type: string, number, quantity, percent, age, status, bool or labels.
• A field picker lists paths from a sample object, and a live preview runs your columns against the cluster.
• Columns are saved per resource type. Sorting understands quantities (500m < 2), and the filter compares them by value (memory>256Mi).

Native macOS feel

• Sidebar vibrancy, a unified titlebar, and it follows the system dark or light appearance.
• A single universal app (Apple silicon and Intel) with the Go backend embedded and supervised. Your login-shell environment is passed through, so aws, gke-gcloud-auth-plugin and kubelogin exec plugins just work.
• It remembers the window size and position. Tabs switch instantly, without animated transitions.

All features

The tour above covers the highlights. docs/FEATURES.md lists everything: navigation, tables, every kind panel, Argo CD, Helm, metrics, security, port-forwards and more.

Install

macOS

1. Download k8sman-<version>-macos.dmg from Releases and open it. It's a universal app for Apple silicon and Intel and needs macOS 12 or later.
2. Drag k8sman.app onto the Applications shortcut beside it, then open it from Applications. Releases are signed with a Developer ID and notarized by Apple, so it opens without a Gatekeeper warning. If you run it straight from the disk image or Downloads, it offers to move itself into Applications, where it can update itself.

A .zip of the same app is attached too; it's what in-app updates and Homebrew use. (Releases up to 0.2.7 weren't notarized: if one of those is blocked, open System Settings → Privacy & Security and click Open Anyway.)

To verify a download against the release's SHA256SUMS, run shasum -a 256 -c SHA256SUMS.

Homebrew. Install from the matty234/tap tap. Homebrew 7 and later only load casks from third-party taps you have trusted, so trust it first:

brew trust matty234/tap
brew install --cask matty234/tap/k8sman

k8sman updates itself, so brew upgrade skips it unless you pass --greedy.

Windows

Windows 10 or 11 (x64). From Releases, download either:

• k8sman-<version>-windows-x64-setup.exe: installs k8sman for your user (no admin rights) with a Start menu entry and an uninstaller, or
• k8sman-<version>-windows-x64.zip: a portable copy. Unzip it anywhere and run k8sman.exe (keep k8sman-server.exe next to it).

First launch (SmartScreen): the Windows builds aren't code-signed, so Microsoft Defender SmartScreen may say "Windows protected your PC". Click More info, then Run anyway. To check a download first, run Get-FileHash <file> in PowerShell and compare it with SHA256SUMS.

k8sman reads %USERPROFILE%\.kube\config (or $KUBECONFIG) and keeps its own settings in %USERPROFILE%\.config\k8sman. Exec credential plugins (kubelogin, gke-gcloud-auth-plugin, aws, …) must be on your PATH.

Linux

x64, glibc 2.35 or newer (Ubuntu 22.04, Debian 12, Fedora 36 and later), with GTK 3. From Releases, download either:

• k8sman_<version>_amd64.deb for Debian and Ubuntu: sudo apt install ./k8sman_<version>_amd64.deb. It installs to /opt/k8sman with a k8sman command and an app-menu entry, or
• k8sman-<version>-linux-x64.tar.gz for anything else: unpack it anywhere and run ./k8sman (keep k8sman-server next to it). ./install.sh adds an app-menu launcher and ~/.local/bin/k8sman for your user; ./install.sh --uninstall removes them.

k8sman reads ~/.kube/config (or $KUBECONFIG) and keeps its settings in ~/.config/k8sman; change them on the Settings page (⌘, or Ctrl+,). Exec credential plugins must be on your PATH.

Updates

On macOS k8sman updates itself with Sparkle: it checks at launch and every 6 hours, and a banner offers Install & Relaunch… (updates are EdDSA-signed). On Windows and Linux the same check links to the download. See docs/UPDATES.md.

Quick start

1. Open k8sman. It uses your current kubeconfig ($KUBECONFIG or ~/.kube/config) and context.
2. To use another file, pick it from the kubeconfig menu under the context switcher, or choose Choose file…. k8sman remembers the file and the last context you used in each one.
3. Start on Overview to see what's broken, or pick a kind in the sidebar. Click a row to inspect it, press ⌘J for the dock, and ⌘I to fold the inspector away.

Nothing is installed in your cluster. k8sman uses your kubeconfig credentials exactly as kubectl does.

Safety and privacy

• Local only, and locked. The embedded backend listens on 127.0.0.1 on a random port, never on an external interface. Every request must carry a secret token the app generates at each launch, so web pages and other user accounts on your Mac can't use it. It also rejects foreign Host and Origin headers (DNS rebinding) and non-JSON writes (cross-site requests).
• Local shells run as you. A local shell tab is your own login shell, so that token guards a real shell on your machine too. Read-only mode can't restrict what you run there, and on read-only contexts the tab says so.
• No telemetry. k8sman has no analytics, crash reporting or usage tracking. The only outbound requests besides your clusters are:
  • the periodic update check (which you can turn off);
  • CRD icon favicons, only for local clusters by default;
  • chart repositories when you install an add-on;
  • the Argo CD API when you connect it;
  • trivy's own vulnerability database download when you scan.
• Confirmations name the context. Every mutating action says which context it will change, and warns when that isn't a local cluster.
• Production starts read-only. A context whose name contains prod, production or prd as a word (prod-eu, gke_acme_prod, not product-api) is read-only until you click its lock and confirm. Lock any other context the same way. The backend enforces it (HTTP 403), not just the UI. Start the backend with --read-only to lock every context; in the app, run defaults write dev.k8sman.app BackendArgs -array --read-only.
• Credentials stay put.
  • The kubeconfig listing returns only file paths and context names, never their contents.
  • The backend logs only each request's method and URL. Tokens travel in request bodies, so they are never written to logs.
  • With an argocd CLI login, the token stays in the argocd CLI's own config. k8sman reads it when needed and never copies it.
  • A pasted Argo CD token is stored in ~/.config/k8sman/settings.json (mode 0600).
• No App Sandbox. The app runs unsandboxed because it must read ~/.kube and cloud credentials and run exec auth plugins, which the sandbox forbids.

Keyboard shortcuts

Shortcut	Action
⌘K or ⌘P	Command palette: jump to a page, kind, namespace, context or object (in a focused terminal, ⌘K clears it)
⌘J	Expand or collapse the bottom dock (alerts, logs and terminals)
⌘I	Collapse or expand the inspector
⌘A	Select all visible rows
⌘-click / ⇧-click	Toggle a row / select a range
↑ / ↓, ⇧↑ / ⇧↓	Move the selection / extend it
⌘⌫	Delete the selected rows (with confirmation)
Esc	Clear a multi-selection, else close the inspector; leave an unchanged YAML edit; close pickers
⌘S	YAML editor: review and apply (full-window editor: validate, review, apply). Elsewhere with a table showing: save it as a view, or update the open view
⌘F	YAML editor: find
⌘↩	Run the dry run (Helm upgrade), apply (add-on install), or apply or create (full-window editor)
⌘+ / ⌘− / ⌘0, ⌘K	Terminal: font size, clear

On Windows and Linux, use Ctrl in place of ⌘. In a terminal tab, Ctrl keys go to the shell: copy with Ctrl+Shift+C and paste with Ctrl+V.

Build from source

You need Flutter (stable) and Go 1.27+; for the sample cluster, also kind and kubectl.

make cluster    # a kind cluster with sample workloads (writes .kubeconfig-dev)
make app        # run the macOS app; builds and embeds the backend
make test       # go vet + go test, flutter analyze, flutter test

docs/DEVELOPMENT.md covers Windows and Linux builds, releases, the code layout and the rest of the docs (API.md lists every backend endpoint).

Architecture

The app is a Flutter desktop UI (macOS, Windows and Linux) with an embedded Go backend (client-go). The app starts the backend on 127.0.0.1, supervises it (BackendSupervisor.swift on macOS, lib/app/backend_supervisor.dart on Windows and Linux), and talks to it over HTTP and WebSockets: watches, logs, exec and port-forwards. The backend holds the kubeconfig and does the cluster work. Argo CD, Prometheus and Alertmanager are reached in-cluster through the Kubernetes API's service proxy; Hubble Relay, which speaks gRPC, through an in-process port-forward.

flowchart LR
  UI["Flutter UI<br/>(desktop app)"] <-- "HTTP + WebSocket<br/>127.0.0.1" --> BE["k8sman-server<br/>(Go, client-go)"]
  BE <--> K8S["Kubernetes API"]
  K8S -- "service proxy" --> ARGO["argocd-server"]
  K8S -- "service proxy" --> PROM["Prometheus / Alertmanager"]
  K8S -- "port-forward (gRPC)" --> HUBBLE["Hubble Relay"]
  BE -. "local CLIs" .-> CLI["helm SDK · argocd login · trivy"]

Loading

More in docs/DEVELOPMENT.md.

Roadmap and contributing

Next on the list:

• More kind panels and Overview checks.

Issues and pull requests are welcome. Before opening a PR, run make test. For a new inspector panel, start with docs/PANELS.md. The screenshots in this README are rendered headlessly from demo data (make shots), so UI changes can refresh them without touching a real cluster.

License

Apache-2.0. See LICENSE and NOTICE. Bundled third-party icons are subject to their own terms; see ATTRIBUTION.md. CNCF project artwork is used under the Linux Foundation trademark guidelines.