Settings

Settings

Everything is saved as soon as you change it. There are two places: the application Settings page, and the settings of a cluster.

Application settings

Open Settings with the gear at the bottom of the cluster rail, the Settings entry in the sections tree, or the command palette (Ctrl+K, then type the tab's name). The page has tabs: General (Appearance, Window, Notifications, Editor), Clusters (Kubeconfig, Helm, Terminal), AI agents, Extensions and Updates & About.

Section	What it does
Appearance	Theme: System (follows your operating system), Light or Dark. Language: System (…) (the default) follows the language of your operating system — the brackets say which one that is now — or English when Sextant has no translation for it; or choose a language, each listed under its own name: English, Russian, Ukrainian, German, French, Spanish, Portuguese (Brazil), Italian, Polish, Turkish, Chinese (Simplified and Traditional), Japanese or Korean. The change applies at once, to the tray menu and desktop notifications too. Kubernetes kinds and terms (Pod, Deployment, namespace) stay in English in every language. Found a bad translation? See Translating.
Window	Closing the window keeps Sextant in the tray (off by default). See The tray icon and closing the window.
Notifications	Desktop notifications about new problems in connected clusters (on by default): the global switch Show desktop notifications about new problems in connected clusters, Mute for 1 hour / Unmute, Notify about (one checkbox per kind of problem; Security — Baseline Pod Security violations — is off until you tick it, and the same setting shows them on the Problems page: see [[Security posture
Editor	Color scheme of YAML in the editor, the details panel and Helm: Auto (One Dark in the dark theme, GitHub Light in the light theme), One Dark, GitHub Dark, GitHub Light, Dracula, Nord, Solarized Dark, Solarized Light.
Helm	Where the helm program is: Find helm in PATH, or Use this binary with a path (Browse…). Shows the version found. Installing and changing Helm releases needs it; viewing releases does not.
Kubeconfig	The sources of clusters (KUBECONFIG or ~/.kube/config, files you added, pasted ones, the ones Sextant made for cloud clusters, and the merged file), with Remove for added, pasted, cloud and merged ones. Each source has Allow Sextant to edit (off by default; Sextant's own files say Sextant's own file: always editable), which lets Sextant rename, change and delete contexts in that file after a preview, with a backup before every write. Merge files… copies chosen files into Sextant's own merged.yaml. Warn about credentials expiring within (days) (default 14, from 1 to 365) decides when a cluster's client certificate or token counts as expiring. See [[Kubeconfig management
Terminal	Node shell image: the container image of the temporary privileged pod behind Shell on a node. Default busybox:stable; an empty field restores it. The image needs nsenter (busybox has it). Saved when you press Enter or leave the field; it applies to the next node shell. See Shell on a node. The image of a debug container is not set here: choose it in the Debug dialog and tick Use this image by default (default busybox:stable); see Debug containers.
AI agents (MCP)	The MCP server: on and off, port, token, ready-made configuration for Claude Code, Claude Desktop and Cursor, the activity log. See MCP server.
Extensions	Installed extensions (enable, disable, permissions, reload, activity, remove, their own settings sections), Install from file…, Install from URL…, Load unpacked folder… and Extension activity. See Extensions.
Updates	The running version, Check for updates when Sextant starts, Check for updates. See Installation.
About	About Sextant opens the window with the version, how this copy was installed, links and Copy version info. See About Sextant.

Cluster settings

Right-click a cluster in the rail and choose Settings.

Section	What it does
General	Display name (empty: the context name), Icon (letters, an emoji or a picture, Reset icon), Color label, and read-only information: context, cluster, server, user and the kubeconfig the cluster comes from.
Metrics	Prometheus: Find automatically (default), Manual address (a Service as namespace/service:port with an optional path prefix, or an http:// / https:// URL) or Off. Current CPU and memory from: Automatic (metrics-server, else Prometheus), metrics-server, Prometheus or Off. Shows what was found. Prometheus is used for the last-hour charts and for the usage history of Right-sizing.
Change preview	Preview changes before applying: saving in the editor, applying in Create resource, and Helm upgrades and installs first show what the API server would store (a server-side dry run), and the change is sent only when you confirm it. Until you choose, it is on for clusters whose name contains "prod" or "production" as a word, off for others; the section says which default applies, and Use the default returns to it. See [[Safe apply
AI agent access	What agents connected through the MCP server may do in this cluster: Off (default), Read-only, Read + write (no delete), Full or Custom rules. See MCP server.
GitOps	Whether Flux and Argo CD are installed in this cluster (Installed / Partly installed / Not installed), and Install Flux… / Install Argo CD… for a missing one. Needs a connected cluster. See [[Installing Flux and Argo CD

Settings on pages

Two pages keep their own settings, also saved in settings.json:

Page	Setting	Default
Cluster → Timeline	Keep between restarts: save each cluster's recorded changes in a file on this computer (timeline/ in the data folder) and load them at the next start. Unticking it removes all saved timeline files. Secret values are never recorded. See [[Change timeline	Change-timeline]].
Cluster → Cleanup → Settings…	Offer ConfigMaps nothing seems to use, Offer Secrets nothing seems to use (with a warning that Sextant cannot see every reference); Namespaces never checked; Offer only objects older than this, in days, per rule. See Cleanup.	ConfigMaps and Secrets off; excluded cert-manager, flux-system, argocd, ingress-nginx, istio-system, monitoring, local-path-storage; 7 days (ConfigMaps and Secrets, Services, finished Pods and Jobs), 30 days (claims, volumes, empty namespaces)

The tray icon and closing the window

While Sextant runs it shows an icon in the system tray: the notification area on Windows, the menu bar on macOS, and on Linux the tray of a StatusNotifier (AppIndicator) host. On Windows and macOS its tooltip is "Sextant". On macOS the icon is a monochrome template image that follows the menu bar's colors. The icon's menu has:

Item	What it does
Show Sextant / Hide Sextant	The text follows the window. Show brings the window back from the tray or from a minimized state, on top of other windows and focused; Hide hides it.
About Sextant…	Brings the window back and opens About Sextant.
Quit Sextant	Quits Sextant: the same exit as closing the last window, so connections, port forwards, terminals and the MCP server end and the temporary node shell pods are removed.

On Windows a left click on the icon shows the window (the menu is on the right button); elsewhere a click opens the menu. On macOS a click on the Dock icon also brings a hidden window back.

Closing the window keeps Sextant in the tray (Settings → Window, off by default). With it on, the window's close button only hides the window. Nothing is closed: cluster connections, watches, port forwards, terminals and the MCP server keep running, so an agent keeps its server. Bring the window back from the tray icon, and quit with Quit Sextant in its menu (or Cmd+Q on macOS). With it off, closing the window quits Sextant, as before.

Sextant runs once per user: starting it again (from the application menu, a launcher or the command line) while it runs, also hidden in the tray, brings the running window back and the new launch ends.

A request for your confirmation from an AI agent or an extension (see MCP server and Extensions) brings the window back, unminimizes it and focuses it, with the dialog already open, so you do not miss it while Sextant sits in the tray. It is refused automatically only when there is no window at all.

Linux without a tray. The option needs a tray icon that you can actually see. On Linux that means a StatusNotifier/AppIndicator host: KDE, Xfce and most others have one, GNOME does not unless you install an extension (the "AppIndicator and KStatusNotifierItem Support" extension), and Sextant needs the libayatana-appindicator library installed on the computer (on Debian and Ubuntu the package libayatana-appindicator3-1). When Sextant finds no tray, the checkbox is disabled and says "No system tray was found, so closing the window quits Sextant." Sextant works as it always did. It asks again at the moment you close the window: if the host has disappeared since start (a restarted panel, a disabled extension), the window closes and Sextant quits instead of hiding where you could not bring it back.

About Sextant

Open it from About Sextant… in the tray icon's menu, or from the About Sextant button at the end of Settings (it works from the Settings page and from the Settings dialog that opens without a cluster). It shows:

• the icon, the name, the version, and how this copy was installed: AppImage, .deb package, .rpm package, macOS app (.dmg), Windows installer (.msi or NSIS), "development build" (a Vite dev run), or "not installed from a release package" (for example a binary built locally);
• the license (MIT OR Apache-2.0) and the copyright line;
• links that open in your browser: Repository, Wiki, Releases, Discussions and Report an issue;
• Check for updates, the same check as in Settings → Updates (see Installation), with its result and, where the build supports it, the install button;
• Copy version info.

Copy version info puts text like this on the clipboard, for a bug report:

Sextant 0.7.0 (AppImage)
OS: Linux Ubuntu 24.04.1 LTS x86_64
WebView: 2.44.1
Tauri: 2.12.3

It holds the version and install kind, the operating system with its version and architecture, and the versions of the web view and of Tauri. It does not contain paths, user names, cluster names or anything from your settings. Paste it into the issue form; see Troubleshooting.

Where Sextant keeps its files

Sextant has no account and no server. Everything stays on your computer, in two folders named after the application identifier dev.sextant.app:

System	Settings folder	Data folder
Linux	~/.config/dev.sextant.app/ ($XDG_CONFIG_HOME is honored)	~/.local/share/dev.sextant.app/ ($XDG_DATA_HOME is honored)
macOS	~/Library/Application Support/dev.sextant.app/	the same folder
Windows	%APPDATA%\dev.sextant.app\	the same folder

File	Folder	What it holds
settings.json	settings	Theme, language (system or a language code), whether closing the window keeps Sextant in the tray, editor scheme, helm path, node shell image, default debug container image, notification settings (on/off, categories turned off and opt-in categories turned on, clusters turned off, muted until, certificate warning days), the clusters chosen for All clusters, whether the change timeline is kept between restarts, the Cleanup page's settings (excluded namespaces, ages, whether ConfigMaps and Secrets are offered), kubeconfig sources and which of them Sextant may edit, the credential warning days, saved views, pins, workspaces and the active workspace, per-cluster settings (names, colors, icons, Prometheus, agent access rules, change preview), window size, MCP on/off and port, installed extensions and the permissions you granted them
mcp-token	settings	The MCP token (readable only by you on Linux and macOS)
kubeconfigs/	data	Private copies of pasted kubeconfigs, cloud-aws.yaml, cloud-gcp.yaml, cloud-azure.yaml with the cloud clusters you added (addresses and certificate authorities, no credentials), and merged.yaml with the files you merged; readable only by you on Linux and macOS
mcp-audit.jsonl	data	The agent activity log (last 2000 entries)
extensions/, extensions-data/	data	Installed extensions (<id>/<version>/) and each extension's own data (<id>.json); see Extensions
extensions-audit.jsonl	data	The extension activity log (last 2000 entries)
timeline/	data	Only when Keep between restarts is on: one file per cluster with its recorded changes (at most 8 MB each, no Secret values); removed when you turn it off. See [[Change timeline

Temporary files: Sextant gives the local terminal and helm a private single-context kubeconfig in your system's temporary folder (named sextant-kubeconfig-…, readable only by you), which is removed when the session ends; leftovers after a crash are cleaned up at the next start.

Kubeconfig backups: before every change Sextant makes to a kubeconfig file, it copies the file next to itself as <file>.bak-<date>-<time> (readable only by you on Linux and macOS) and keeps the newest five of these per file. See Kubeconfig management.

Saved views, pins and workspaces are in settings.json; to move them to another computer use Export… and Import… in Views and workspaces, see Views and workspaces.

A damaged settings file

If settings.json cannot be read or parsed, Sextant copies it to settings.json.bak-<date>-<time> next to it, starts with default settings and shows a banner with the path of the copy. If the file cannot be written (permissions), Sextant says changes are not saved; fix the permissions and restart. Sextant never overwrites a file it could not read.

Environment variables

Variable	Effect
KUBECONFIG	Where Sextant reads clusters from (every file in the list), instead of ~/.kube/config
SHELL	The shell of the local terminal on Linux and macOS (otherwise /bin/sh)
XDG_CONFIG_HOME, XDG_DATA_HOME	Move the settings and data folders on Linux; handy for a throwaway profile

Sextant sends no telemetry. Apart from your clusters (and Argo CD, through the cluster), the only servers it contacts are GitHub's: for the update check, which you can turn off in Settings → Updates, and, only when you open Install Flux… or Install Argo CD…, for the list of versions and the manifest (see Installing Flux and Argo CD).