K8sConsole puts live maps, monitoring, logs, shells, security checks, access control, Helm and an AI assistant into one fast desktop app, for Kubernetes and Amazon ECS. It connects straight from your kubeconfig and your AWS profiles, and installs nothing in your clusters.
Traffic flows left to right, from Ingress to Service to workloads to pods to the config and storage they depend on, and every box is coloured by health. Click anything to open it. Every object also gets its own relationship graph.
Switch the sidebar to Amazon ECS and connect with an AWS profile or your IAM role. Services, tasks and task definitions are live, with CloudWatch logs, CPU and memory charts, load balancer health and a service map from the load balancer down to every task.
Open a service to see its rollout, the tasks it runs, the latest service events, CloudWatch logs from every task, utilization over time and the health of each load balancer target.
CPU, memory, network and disk for the cluster, every node and every pod, with an hour of history. Usage bars show requests and limits, so you can see what's oversized and what's about to be throttled.
Ask a question in plain language. The assistant investigates with read-only tools (resources, events, logs, metrics, security findings) and explains what it found. When a change would help, it drafts the manifest for you to review, dry-run and apply.
Checks pod security, RBAC and network exposure, gives a posture score, and explains every finding in plain language. Safe fixes come with the exact patch, a server-side dry run and an apply button.
Open zsh or bash in a dock. Cluster shells are bound to the selected cluster and namespace without touching your kubeconfig. kubectl completion is loaded, and inline suggestions offer the commands you're most likely to need for the objects in front of you.
Events laid out per object over time, with an activity strip and warnings highlighted, so the crash loop, the failed mount and the rollout line up on one screen.
Built for the daily work of running Kubernetes and Amazon ECS, from the first look to the fix.
38 built-in kinds and every custom resource, with live updates, sorting and label filters.
Live validation, server-side dry run, conflict detection and create-from-YAML.
Follow, previous container, timestamps, since/tail, search and download.
Interactive shells in any container, with bash, then sh, detected automatically.
Pods and services, named ports, local-only listeners, one place to manage them.
Repositories, chart search, install and upgrade with dry run, history and rollback.
Scale, restart, evict, cordon, drain and CronJob runs. Every change asks first.
All your kubeconfigs, kubectl auth plugins, OIDC tokens, proxies and automatic reconnects.
Your clusters and credentials stay yours.
Version 1.3.0 for Linux, macOS and Windows. Free and open source (MIT).
K8sConsolesudo apt install ./k8sconsole_1.3.0_amd64.deb
k8sconsoleOptional: kubectl for terminal completion, zsh for inline suggestions (Linux and macOS), helm 3 for Helm features, the aws CLI for the AWS shell tab (ECS Exec shells are built in).
No. K8sConsole uses the Kubernetes API with the credentials in your kubeconfig. Monitoring reads the kubelet Summary API through the API server, or metrics-server if you have it.
Any conformant Kubernetes cluster your kubeconfig can reach, self-hosted or managed. Cloud providers' sign-in plugins work the same way they do with kubectl: if kubectl can connect, K8sConsole can.
With the AWS credentials you already use: a profile from ~/.aws (access keys, IAM Identity Center, or a profile that assumes a role), or the default credential chain, including the IAM role of the EC2 instance or container it runs on. You can also assume a role from the app. Keys stay on your machine and are never shown in the app.
AWS connections start read-only, and in that mode every create, update, stop or delete call is refused before it leaves the app. When you switch read-only off, each change still asks for confirmation, and deleting a service or scaling it to zero asks you to type its name. For extra safety, connect with a role that only has read permissions.
Only when you use it: your question plus the cluster data it reads to answer (for example resource summaries, events and, if you allow it, log lines) go to the Claude API using your own API key. Secret values and credential-looking environment values are never sent. It can't change your cluster; you review and apply its proposals yourself.
No. Every change shows a confirmation, edits support server-side dry runs, and destructive actions ask you to type the resource name.
macOS shows this for every app that isn't notarized by Apple; it doesn't mean anything was found. K8sConsole is open source and built by a public GitHub workflow. Every download has a checksum, a software bill of materials and signed build provenance you can verify (gh attestation verify <file> --repo AAnkitpatel/k8sconsole). To open it: click Done, go to System Settings → Privacy & Security, scroll down and click Open Anyway. Or run xattr -dr com.apple.quarantine /Applications/K8sConsole.app. Notarized builds are planned, and they won't show the warning.
Linux (a .deb for Ubuntu and Debian, x86-64), macOS (Apple Silicon and Intel) and Windows 10/11 (x64). Every installer is built and tested on its own operating system before each release.