Home

Sextant

Sextant is a desktop application for managing Kubernetes clusters, an alternative to Lens. It reads your kubeconfig, shows the resources of every cluster in live tables, and lets you inspect, edit and operate them in one window. It runs on Linux, macOS and Windows, is written in Rust on Tauri 2, and has no account, no server and no telemetry.

What it does

• Clusters from your kubeconfig: KUBECONFIG, ~/.kube/config, files you add and kubeconfig text you paste; several clusters connected at once.
• Kubeconfig management: rename a context, set its default namespace, duplicate it for another namespace, delete it, or merge files — always previewed, with a backup and an atomic write, and only in files you allow (~/.kube/config is untouched until you do); a warning before a client certificate or token expires, and a check of every kubeconfig you add.
• Cloud clusters: find your Amazon EKS, Google GKE and Azure AKS clusters through the aws, gcloud and az you already use, and add them in a few clicks.
• Every resource in live tables: workloads, config, network, storage, namespaces, events, access control, nodes and custom resources, kept up to date by watches.
• Details and YAML: metadata, kind-specific fields, conditions, events, links between objects, a YAML editor with conflict detection.
• A YAML editor that knows your cluster: completion of fields and allowed values, unknown fields, wrong types and missing required fields underlined as you type, documentation on hover and Explain (F1), from the cluster's own schema — custom resources included.
• Saved views, favourites and workspaces: save a table with its filters, label selector, sort and columns; pin objects and views; switch between groups of clusters; export and import them without credentials.
• Command palette: Ctrl+K (Cmd+K) to jump to any section, page, setting or cluster, find an object by name and run its actions.
• Safe apply: Preview changes shows what the API server would store before a save, an apply or a Helm upgrade — a server-side dry run with defaults, webhooks and validation, Secret values never shown — and production-named clusters ask for it every time.
• Changes: edit, create from multi-document YAML, delete, scale, restart, cordon, drain, trigger and suspend CronJobs; a rollout history with a side-by-side diff of revisions and Roll back like kubectl rollout undo.
• Logs, shells and port forwarding: container logs with search, the logs of all pods of a workload or a selector merged in one tab, a shell in any container, a shell on a node, a local terminal already pointed at the cluster, port forwards you can open in the browser.
• Terminal panes, snippets and broadcast: split a terminal tab into up to 8 shells, type saved commands with the namespace, pod or cluster filled in and quoted for the shell, and send your input to several panes at once — only after you confirm.
• Debugging and files: a debug container (busybox, netshoot or your image) for pods without a shell, as an ephemeral container or in a copy of the pod that Sextant removes for you; download and upload files and folders like kubectl cp.
• Problems and notifications: one page with everything that is red in a cluster, and desktop notifications when something starts to fail, which you can turn off completely, per kind of problem, per cluster or for an hour.
• Metrics: CPU and memory from metrics-server, last-hour charts from Prometheus.
• Right-sizing: requests and limits against a day or a week of real usage from Prometheus, with a suggested resources: block per container and the waste and risks (throttling, OOM kills, memory near the limit) of every namespace.
• Storage: how full each PersistentVolumeClaim is (space and inodes) with an optional "disk almost full" warning; VolumeSnapshots and Velero backups explained, and snapshots, restores to a new claim, namespace backups and restores created after a review, never overwriting anything.
• Cost: with OpenCost or Kubecost in the cluster, what each namespace, workload, Pod, node or label value costs, split by resource with the idle cost, a monthly estimate per workload and the savings of its right-sizing recommendation.
• All clusters: up to 10 clusters on one page with a health card each, pods, workloads and Warning events across them, and a search by name in all of them; nothing connects until you click.
• Upgrade readiness: before a Kubernetes upgrade, the deprecated and removed API versions still used by your objects, Helm releases, Argo CD and Flux, and the version skew to resolve.
• Security posture: workloads checked against the Pod Security Standards with the exact field and a fix to copy, what each namespace's Pod Security labels would reject, and Trivy Operator's vulnerability reports.
• Resource map: a Related tab on every object that says what would break if you deleted it and what uses it, and a map of a namespace coloured by health.
• Change timeline: what changed before it broke — every change of the objects Sextant watches, field by field, with the program that made it and the problems that began soon after, plus what the cluster keeps from before; Secret values never recorded, kept between restarts only if you choose.
• Cleanup: objects that look unused or left over, each with the reason and what deleting it would touch, deleted only after a confirmation and a fresh check of each object; when in doubt, nothing is offered, and ConfigMaps and Secrets only if you turn them on.
• Autoscaling insights: why an HPA did or did not scale, by the controller's own formula; why a Pending pod has no node; what KEDA, Karpenter and Cluster Autoscaler decided.
• Network connectivity: "can pod A reach pod B?" from NetworkPolicies and Cilium and Calico policies, with the deciding rule for each side; "Unknown" rather than a wrong "Allowed".
• RBAC, who can do what: a subject's effective permissions as a matrix that names the binding behind every cell, "who can delete Secrets here", and "Can I" answered by the API server.
• cert-manager and certificates: Certificates, requests, issuers and ACME orders explained in plain words with the issuance chain, and the certificate inside any TLS Secret with its expiry, read without the private key ever leaving Sextant's backend.
• Gateway API: Gateways, listeners and routes with their status explained in plain words, a topology per Gateway, the ReferenceGrant a cross-namespace reference needs, and a request check that shows where a request goes and why.
• Helm, Flux and Argo CD: releases, charts and values; Flux sources, Kustomizations and HelmReleases; Argo CD applications with sync and diff. Missing Flux or Argo CD can be installed from their official manifests, with a preview and a confirmation.
• An MCP server for AI agents: let Claude Code, Claude Desktop or Cursor look at your clusters, with rules you set per cluster, confirmations in the window and an activity log.
• A tray icon: keep Sextant running in the tray when you close the window (an option), and an About Sextant window with the version and a button that copies version info for bug reports.
• In your language: English, Russian, Ukrainian, German, French, Spanish, Portuguese (Brazil), Italian, Polish, Turkish, Chinese (Simplified and Traditional), Japanese and Korean, following your system by default; Kubernetes terms stay in English.
• Extensions: add your own pages, details sections, actions, table columns and dock buttons, for your custom resources and processes; each extension runs isolated and reaches a cluster only with the permissions you agree to.

Pages

Page	What is in it
Installation	Installers for Linux, macOS and Windows, unsigned installers, optional tools, updates
Getting started	Where Sextant finds clusters, adding a kubeconfig (and the check before adding) or cloud clusters (EKS, GKE, AKS), connecting, the layout
Views and workspaces	Saved views, favourites (pins), workspaces, export and import, what is never exported
Kubeconfig management	How Sextant writes your kubeconfig safely, Allow Sextant to edit, renaming, namespaces, duplicating and deleting contexts, merging files, credential expiry, the check when adding
Using Sextant	Tables, the command palette, details, editing, the change preview, rollout history and rollback, logs (also of several pods), shells (containers and nodes), debug containers, copying files, port forwarding, metrics, right-sizing, related objects and the map, cert-manager, permissions, Helm, Flux, Argo CD
YAML editor	Completion, problems, hover and Explain from the cluster's schema; where the schema comes from; without a schema
Terminal	Split panes, keyboard, snippets and their placeholders and quoting, broadcast input and its safeguards
Storage	Volume usage and where it comes from, Disk almost full, volume snapshots, Velero backups and restores, how the actions create objects
Cost	Costs from OpenCost or Kubecost: what you need, the Cost page, a workload's estimate and savings, how Sextant reaches the cost service, limits
Safe apply (Preview changes)	The server-side dry run before saving, applying YAML and Helm upgrades or installs, the per-cluster setting, Secrets, agent dry runs
All clusters	The overview of several clusters: choosing and connecting them, health cards, tables across clusters, find by name
Upgrade readiness	Deprecated and removed API versions in use, where they come from, served deprecated versions, version skew, the deprecation table
Security posture	Pod Security Standards findings and fixes, namespace labels, "added at admission", Trivy Operator reports, the Security problem category
Right-sizing	Requests and limits against real usage, how recommendations and findings are made
Resource map	The Related tab, what a deletion would break, the Map page
Change timeline	What changed, when and by which program; history before Sextant; problems after a change; keeping the timeline between restarts
Cleanup	Unused and left-over objects, what is never offered for deletion and why, the safe bulk deletion, its settings
Autoscaling	The HPA scaling decision, why a Pod is not scheduled, Karpenter, Cluster Autoscaler, KEDA
Connectivity	Can pod A reach pod B: the check, Allowed / Denied / Unknown, the policy map, Cilium and Calico, what counts as unknown
RBAC: who can do what	Effective permissions of a subject, who can do an action, Can I, the RBAC rules as Sextant reads them
cert-manager and certificates	The cert-manager section, the issuance chain, the certificate in TLS Secrets, the TLS certificates page, the expiry warning
Problems and notifications	The Problems page, what counts as a problem, desktop notifications and how to turn them off
Gateway API	Gateways, routes and policies, explained problems, topology, the request check and the hostname map
Installing Flux and Argo CD	Installing them into a cluster from the app: sources and checks, rights, the preview, progress, partial installs, removing them by hand
MCP server	Connecting AI agents: setup, per-cluster permissions, confirmations, the tool list, dry runs, security
Extensions	Installing extensions from a file, a GitHub release or a folder; permissions and consent, confirmations, the activity log, security
Writing extensions	For authors: the SDK and template, the manifest, contributions, the API, packaging and publishing, two examples
Settings	Application settings (including language and notifications), the timeline and Cleanup page settings, the tray icon, About Sextant, cluster settings, where the files live
Troubleshooting	Common problems and what to do about them
Building from source	Requirements and commands to build and run Sextant
Development	Repository layout, translations in code, checks, the test cluster, end-to-end tests, releases
Translating	The interface languages, where the texts are, and how to correct a translation

Links

• Source code and issues: https://github.com/FriendsOfKubernetes/sextant
• Latest release: https://github.com/FriendsOfKubernetes/sextant/releases/latest
• Plans: milestones
• License: MIT or Apache-2.0, at your option