Kube-Argus

Real-time Kubernetes Dashboard

A Project by Manish Chaudhary

The real-time Kubernetes dashboard for SREs. Live cluster state, streaming logs, JIT exec approvals, drain wizard, spot cost analysis, and AI-powered diagnostics — in a single ~20 MB Go binary with zero external dependencies.

Everything kubectl gives you, in a UI you can hand a junior SRE.

---

🚀 Try it in 30 seconds

helm repo add kube-argus https://manishchaudhary101.github.io/kube-argus
helm install kube-argus kube-argus/kube-argus \
  --namespace kube-argus --create-namespace
kubectl -n kube-argus port-forward svc/kube-argus 8080:80
# → open http://localhost:8080

No database, no CRDs, no agents on your nodes. Uninstall is one helm uninstall. See Getting Started for Docker Compose, plain manifests, and local dev.

---

Cluster Overview — Live node status, CPU/memory utilisation, top namespaces, and resource counts refreshed every 10 seconds.	Node Detail & Metrics — kubectl describe-style detail with Prometheus metrics, events, pod list, and admin actions (cordon, drain).
Pod Metrics & Logs — Per-pod CPU/memory graphs, live log streaming, container selector, and AI-powered diagnosis.	Spot Advisor & Cost Analysis — Spot instance risk scoring, cluster cost breakdown, and intelligent consolidation recommendations.

---

Why Kube-Argus?

Most Kubernetes dashboards show you resources. Kube-Argus gives you a live, real-time operating picture of your cluster — what's happening now, what it costs, and how to fix it — with the same immediacy as k9s, but in a web UI you can share with your team.

The differentiators

• 🔐 JIT exec access — zero-trust shell into any pod with an approval workflow, auto-expiry, and Slack notifications. Viewers get temporary elevated access without becoming admins.
• 💰 Spot Advisor & cost analysis — spot-interruption risk scoring, namespace cost allocation, and concrete consolidation recommendations (EKS today; other clouds via Prometheus).
• 🤖 AI-powered pod diagnosis — bring your own OpenAI-compatible endpoint; get root-cause explanations for CrashLoopBackOff / OOMKilled / ImagePullBackOff pods with streaming responses.
• 📊 Prometheus-driven right-sizing — 7-day resource recommendations per workload, so you can cut overprovisioning without guesswork.
• 🖥️ Full-fidelity operator toolkit — interactive web shell, YAML editor for 11 kinds, drain wizard with PDB preview, CronJob manual triggers, pod restart timeline, audit trail.
• 💡 Single ~20 MB binary, zero external deps — no database, no CRDs, no operators, no agents. helm install and it's running in seconds.

See the full feature comparison and feature list.

Works On

Platform	Support Level	Notes
Amazon EKS	Full	All features including Spot Advisor and cost analysis
Google GKE	Core + Metrics	All features except Spot Advisor
Azure AKS	Core + Metrics	All features except Spot Advisor
Minikube / kind / k3s	Core	All features except cloud-specific cost analysis
Self-managed / on-prem	Core + Metrics	Full functionality with Prometheus

---

Getting Started

Prerequisites

• Access to a Kubernetes cluster (kubeconfig or in-cluster)
• (Optional) Prometheus endpoint for metrics
• (Optional) OIDC provider for authentication

With Docker Compose (easiest)

docker compose up

Open http://localhost:8080. Edit docker-compose.yaml to configure auth, Prometheus, or AI.

With Helm

helm repo add kube-argus https://manishchaudhary101.github.io/kube-argus
helm install kube-argus kube-argus/kube-argus \
  --namespace kube-argus --create-namespace \
  --set env.CLUSTER_NAME="my-cluster"

Alternative: OCI registry (no helm repo add needed)

helm install kube-argus oci://ghcr.io/manishchaudhary101/charts/kube-argus \
  --namespace kube-argus --create-namespace \
  --set env.CLUSTER_NAME="my-cluster"

With plain manifests

kubectl apply -f deploy/k8s/

Local Development

git clone https://github.com/manishchaudhary101/kube-argus.git
cd kube-argus
cd web && npm install && npm run build && cd ..
go run ./cmd/server

---

Configuration

All configuration is via environment variables. No config files to manage.

Core

Variable	Default	Description
PORT	8080	HTTP listen port
CLUSTER_NAME	auto-detected	Display name for the cluster
LOG_LEVEL	info	Minimum log level (debug, info, warn, error)

Authentication

Auth mode is auto-detected from which env vars you set:

Mode	When	Login screen
Google SSO	GOOGLE_CLIENT_ID is set	"Sign in with Google" button
Generic OIDC	OIDC_ISSUER is set	"Sign in with SSO" button
None	Neither set	No login wall, everyone gets DEFAULT_ROLE

Authentication variables

Google SSO

Variable	Description
GOOGLE_CLIENT_ID	Google OAuth2 client ID
GOOGLE_CLIENT_SECRET	Google OAuth2 client secret

Generic OIDC

Variable	Default	Description
OIDC_ISSUER	—	OIDC issuer URL
OIDC_CLIENT_ID	—	OAuth2 client ID
OIDC_CLIENT_SECRET	—	OAuth2 client secret
OIDC_ADMIN_GROUP	admin	OIDC group claim that grants admin role

Roles & Session

Variable	Default	Description
ADMIN_EMAILS	—	Comma-separated admin email addresses
DEFAULT_ROLE	viewer	Role when auth is disabled: viewer or admin
SESSION_SECRET	random	HMAC key for session cookies
SESSION_TTL	8h	Session duration

Integrations

Prometheus, AI, JIT, and AWS variables

Prometheus Metrics

Variable	Description
PROMETHEUS_URL	Prometheus base URL (Grafana Cloud URLs auto-detected)
PROMETHEUS_USER	Basic auth username
PROMETHEUS_KEY	Basic auth password/API key

AI Diagnosis

Variable	Description
LLM_GATEWAY_URL	OpenAI-compatible chat completions endpoint
LLM_GATEWAY_KEY	Bearer token for the LLM API
LLM_GATEWAY_MODEL	Model name (e.g. gpt-4o, claude-3)

JIT Exec Access

Variable	Default	Description
JIT_CONFIGMAP_NAME	kube-argus-jit	ConfigMap name for JIT requests
AUDIT_CONFIGMAP_NAME	kube-argus-audit	ConfigMap name for audit trail
JIT_RETENTION_DAYS	7	Days to keep terminal JIT requests

Notifications

Settings page UI takes precedence; env vars are a bootstrap fallback for headless deploys.

Variable	Description
SLACK_WEBHOOK_URL	Incoming Slack webhook for JIT request notifications
SLACK_SIGNING_SECRET	Slack signing secret (enables Approve/Deny buttons in Slack)
NOTIFY_WEBHOOK_URL	Generic webhook endpoint for JIT events ({event, cluster, timestamp, actor, data} JSON)
NOTIFY_WEBHOOK_SECRET	If set, requests carry X-KubeArgus-Signature: sha256=<hex> HMAC of the body

AWS

Variable	Default	Description
AWS_SECRET_NAME	—	AWS Secrets Manager secret ID
AWS_REGION	us-east-1	AWS region

---

Architecture

┌──────────────────────────────────────────────┐
│  Browser (React + TypeScript + Tailwind)     │
│  Recharts for metrics, xterm.js for shell    │
└──────────────┬───────────────────────────────┘
               │ HTTP / WebSocket
┌──────────────▼───────────────────────────────┐
│  Go Backend (single binary)                  │
│  ┌─────────────┐ ┌──────────┐ ┌───────────┐ │
│  │ K8s API     │ │Prometheus│ │ AWS EC2   │ │
│  │ client-go   │ │ /api/v1  │ │ Spot Price│ │
│  └─────────────┘ └──────────┘ └───────────┘ │
│  ┌─────────────┐ ┌──────────┐ ┌───────────┐ │
│  │ OIDC Auth   │ │ LLM GW   │ │ Secrets   │ │
│  │ (any IdP)   │ │ (OpenAI) │ │ Manager   │ │
│  └─────────────┘ └──────────┘ └───────────┘ │
└──────────────────────────────────────────────┘

---

Cluster Impact

• Cached: All K8s list operations cached in-memory, refreshed every 10 seconds server-side
• Single connection: One set of API calls per refresh cycle, not per-user
• No CRDs, no agents: Nothing deployed to worker nodes
• Low footprint: Runs on 100m CPU / 128Mi memory

---

Feature Comparison

Capability	Kube-Argus	K8s Dashboard	Lens	Headlamp	k9s
Single binary, zero deps	✅	❌	❌	❌	✅
Docker image size	~30 MB	~250 MB	~500 MB	~200 MB	N/A
Shared cache (no per-user load)	✅	❌	❌	❌	❌
Live auto-refresh	✅	❌	✅	✅	✅
Streaming pod logs	✅	❌	✅	✅	✅
Web terminal (exec)	✅	❌	✅	✅	Native
Spot cost analysis & consolidation	✅	❌	❌	❌	❌
AI-powered pod diagnosis	✅	❌	❌	❌	❌
Resource right-sizing	✅	❌	❌	❌	❌
JIT exec access (approval workflow)	✅	❌	❌	❌	❌
Audit trail & online users	✅	❌	❌	❌	❌
Config drift detection	✅	❌	❌	❌	❌
Namespace favorites	✅	❌	❌	❌	❌
CronJob manual trigger (with JIT)	✅	❌	❌	❌	❌
Pod restart reason timeline	✅	❌	❌	❌	❌
Init container visibility	✅	❌	✅	❌	✅
Drain wizard with PDB preview	✅	❌	❌	❌	❌
NOC/wall screen mode	✅	❌	❌	❌	❌
Web-based (sharable)	✅	✅	❌	✅	❌
Open source (Apache 2.0)	✅	✅	Freemium	✅	✅

---

Features

Cluster Overview

• Live cluster state refreshed every 10 seconds
• Node status (Ready, NotReady, Draining, Cordoned)
• Cluster-wide CPU and memory utilisation
• Warning counts and top resource consumers by namespace

Node Management

• All nodes with status, instance type, capacity, and age
• kubectl describe-style detail with live events
• Drain wizard with PDB preview and streaming progress
• Pod heatmap for noisy neighbor detection
• Admin actions: cordon, uncordon, drain
• Per-node Prometheus metrics

Workloads

• Deployments, StatefulSets, DaemonSets, Jobs, CronJobs
• Restart and scale directly from the UI
• Aggregated logs from all pods in one color-coded view
• ReplicaSet history, rolling update details
• PDB status badges inline
• Resource right-sizing recommendations (7-day Prometheus data)
• Config drift detection

Pod Management

• Table and card views with search, filters, and sorting
• Pod sparklines (CPU/MEM trends updated every 10s)
• Live log streaming with container selector
• Previous container logs for crash debugging
• Interactive web shell via WebSocket
• AI-powered diagnosis for unhealthy pods
• Restart reason timeline — color-coded scatter chart showing when and why containers restarted

Cost & Optimisation

• Spot Advisor: risk analysis with consolidation suggestions
• Namespace-level cost allocation
• Total cluster cost panel (spot + on-demand)

Security

• Three auth modes: Google SSO, generic OIDC, or none
• Role-based access: admin vs viewer
• JIT exec access with approval workflow, auto-expiry, and custom durations (up to 7 days)
• JIT-gated CronJob manual trigger for viewers
• Audit trail for all actions
• Online users with presence indicators
• Runs as non-root (USER nobody)

More Features

• Networking: Services, Ingresses with hosts/paths/TLS
• Storage: PVCs, PVs, StorageClasses with pod mapping
• Configuration: ConfigMaps, Secrets with drift detection
• YAML viewer/editor for 11 resource kinds
• Topology spread constraint validation
• Troubled pods / NOC screen with fullscreen mode
• Spot interruption tracking with resilience scoring
• Events filtered by namespace
• Namespace favorites with per-user persistence
• Init container visibility across all workload types
• CronJob manual trigger with JIT approval

---

Contributing

See CONTRIBUTING.md for development setup and guidelines.

---

Star History

---

License

This project is licensed under the Apache License 2.0 — see the LICENSE file for details.