k8sUI — Native Kubernetes UI & Graphical Desktop Client (GUI)

Enterprise-grade, open-source native Kubernetes UI and desktop client for multi-cloud (AWS EKS, Azure AKS) and local clusters.

---

k8sUI is a zero-Electron, native desktop application for managing Kubernetes clusters across Amazon EKS, Azure AKS, and local environments — built with Tauri v2 + Rust + React. It replaces fragile kubectl shell scripts with a secure, observable, production-ready GUI without the overhead of a full web platform.

---

✨ Features

🔐 Security-First Architecture

• Zero kubectl Subprocesses — All cluster operations (list, watch, apply, logs, exec, port-forward) run directly through kube-rs over native TLS. No shell escaping, no CLI version drift.
• Short-Lived Cloud Credentials — AWS authentication uses official aws-sdk-sts + aws-config; Azure uses azure_identity. No long-lived keys are stored on disk.
• Sandboxed Native Shell — Built on Tauri v2: a minimal Rust core + strictly scoped WebView. No Node.js runtime, no Chromium bloat, no Electron attack surface.
• Local Tamper-Evident Audit Log — Every privileged action is recorded locally in a structured JSON audit log with export capability.

☁️ Multi-Cloud & Local Clusters

• AWS EKS with SSO auto-discovery — detects all accessible EKS clusters across your AWS organization accounts.
• Azure AKS with Azure AD / Entra ID authentication.
• Local clusters — kind, minikube, and k3d fully supported via kubeconfig auto-detection.
• Persistent cluster switcher with environment color-coding (Production = Red, Staging = Amber, Local = Blue/Green).

🛡️ Safe Write Operations by Default

• Read-Only Mode enabled by default — write access requires explicit user confirmation per session.
• Server-side dry-run diff viewer — every mutation or scaling action previews a unified diff before being applied.
• Confirmation guardrails — destructive operations (delete, scale-to-zero) require explicit modal sign-off.

🧭 Full Kubernetes Resource Coverage

• Workloads: Pods, Deployments, StatefulSets, DaemonSets, ReplicaSets, Jobs, CronJobs
• Networking: Services, Ingresses, Ingress Classes, Network Policies, Endpoints
• Config & Secrets: ConfigMaps, Secrets, Resource Quotas, Limit Ranges
• Storage: PVCs, Persistent Volumes, Storage Classes
• Access Control: ServiceAccounts, Roles, RoleBindings, ClusterRoles, ClusterRoleBindings
• Policy: HPAs, PDBs, Priority Classes
• Security: ValidatingWebhookConfigurations, MutatingWebhookConfigurations
• Custom Resources (CRDs) — dynamically discovered and grouped by API group with live instance browsing

🤖 AI Copilot (Optional, Air-Gap Friendly)

• Fixed 5-tool whitelist: list_pods, describe_resource, get_logs, scale_deployment, apply_manifest.
• Read tools execute within your existing session RBAC. Mutating tools require explicit human dry-run confirmation.
• Secret redaction engine scrubs sensitive values before any context reaches the LLM.
• Pluggable provider trait — supports local Ollama for fully air-gapped environments, plus Anthropic / OpenAI.

🛠️ Developer Experience

• Global Command Palette (Cmd/Ctrl + K) for instant resource navigation.
• Live log streaming with integrated xterm.js terminal emulator.
• Port-Forward manager — create, list, and teardown port forwards without leaving the app.
• YAML viewer & editor with server-side validation before apply.
• Helm release manager — list releases, view manifests, and inspect revision history.

---

📦 Download Pre-Built Binaries

Pre-compiled binaries for each release are available on the GitHub Releases page.

Platform	Format	Architecture	Notes
macOS	.dmg	Apple Silicon (ARM64) & Intel (x86_64)	See macOS Gatekeeper note
Windows	.msi, .exe	x86_64 (Windows 10 / 11)	WiX Installer & NSIS portable setup
Linux	.deb, .AppImage	x86_64 (Debian / Ubuntu / Universal)	Native package & AppImage binary

🍎 macOS Gatekeeper & Quarantine Note

Because k8sUI is an open-source binary distributed outside the Mac App Store without an Apple Developer ID paid certificate, macOS attaches the com.apple.quarantine attribute when downloaded from GitHub or a web browser, showing:

Apple could not verify “k8sUI” is free of malware that may harm your Mac or compromise your privacy. (or “k8sUI” is damaged and can’t be opened. You should move it to the Trash).

The package is 100% safe and verified. To open k8sUI on macOS, use either of the following methods:

Option 1: Quick Terminal Command (Instant)

1. Drag k8sUI.app from the .dmg into /Applications.
2. In your macOS Terminal, clear the download quarantine flag:

   xattr -cr /Applications/k8sUI.app

3. Double-click k8sUI to launch immediately.

Option 2: macOS System Settings (Without Terminal)

1. Drag k8sUI.app into /Applications and double-click to open it (macOS will show the verification warning; click Cancel or OK).
2. Open System Settings (Configuración del Sistema) on your Mac.
3. In the sidebar, select Privacy & Security (Privacidad y Seguridad).
4. Scroll down to the Security section.
5. You will see the notice:

   “k8sUI” was blocked from use because it is not from an identified developer.

6. Click the "Open Anyway" (Abrir de todos modos) button.
7. Enter your Mac administrator password or Touch ID, then click "Open".

macOS will remember this authorization permanently and allow k8sUI to open normally.

---

🚀 Quick Start

Prerequisites

Requirement	Version	Notes
Node.js	v20+	Use nvm or fnm for version management
pnpm	v9+	Required package manager (no npm/yarn)
Rust	stable	rustup update stable
Xcode CLT (macOS)	latest	xcode-select --install

1. Clone & Install

git clone https://github.com/akretrix/k8sUI.git
cd k8sUI
pnpm install

2. Browser Preview (Mock API — no cluster required)

pnpm run dev

Opens at http://localhost:5173 with a fully-functional mock cluster for UI development.

3. Native Desktop App (Tauri v2 + live cluster)

pnpm run tauri dev

Prerequisites: A valid ~/.kube/config or active AWS SSO session for EKS discovery.

4. Run All Checks

# Frontend
pnpm run lint
pnpm test

# Rust backend
cargo fmt --all --check --manifest-path src-tauri/Cargo.toml
cargo clippy --manifest-path src-tauri/Cargo.toml -- -D warnings
cargo test --manifest-path src-tauri/Cargo.toml
cargo deny check --config deny.toml

---

📖 Architecture

UI (React + TanStack Query)
    ↕ Tauri IPC (typed commands, event subscriptions)
Rust Core (Credential Broker · Session State · Audit Logger)
    ↕ ClusterConnector Trait
Connector Implementations: EKS · AKS · Local (kubeconfig)
    ↕ Native TLS
Kubernetes API Servers

Full technical documentation:

Document	Description
Architecture Overview	System design, component boundaries
Connector Layer	EKS / AKS / Local connector implementations
AWS SSO Auto-Discovery	Cross-account EKS discovery flow
AI Copilot Layer	LLM integration, safety invariants
Threat Model (STRIDE)	Security threat analysis
Dependency & Supply-Chain Policy	License & supply-chain enforcement
Architecture Decision Records	ADR log for major design decisions

---

🤝 Contributing

We welcome contributions of all sizes — bug fixes, new connector features, documentation improvements, and UI polish.

Before you open a PR:

1. Read CONTRIBUTING.md for the DCO sign-off requirement and dependency license policy.
2. Ensure all CI gates pass locally (see Run All Checks above).
3. Sign every commit with git commit -s.

All contributions are made under the Apache-2.0 License. We use a Developer Certificate of Origin (DCO) instead of a CLA — no legal paperwork, just a Signed-off-by: trailer on your commits.

---

💛 Sponsorship

k8sUI is free and open-source, and we intend to keep it that way. Running this project sustainably requires:

• CI/CD infrastructure — macOS runners for Tauri/Rust builds are expensive.
• Code-signing certificates — Apple Developer ID + Windows EV signing certificates are required to distribute the app without OS-level security warnings. Without them, users must manually bypass Gatekeeper / SmartScreen on every install.
• Domain & release infrastructure — hosting, CDN, and artifact storage.

If k8sUI saves you or your team time, please consider sponsoring:

• Helps cover the costs of signing certificates and infrastructure.
• Supports dedicated development time for new features.
• ☕ Support us on Ko-fi

Corporate Backers

If your organization uses k8sUI in production and wants to ensure its long-term development:

• Logo placement in this README and on the project website
• Priority issue triage for your use cases
• Acknowledgment in release notes

Contact us at admin@akretrix.com to discuss corporate sponsorship tiers.

Sponsorship funds are used exclusively for project infrastructure. No funds are used for proprietary development — the project will always remain Apache-2.0 licensed.

---

📄 License

Licensed under the Apache License, Version 2.0.

Copyright © 2024–2026 AkreTrix and k8sUI Contributors.

This project explicitly rejects all copyleft-licensed dependencies (GPL, AGPL, LGPL). Dependency license compliance is enforced automatically in CI via cargo-deny for Rust and license-checker for the Node/TypeScript frontend. See CONTRIBUTING.md for the full policy.