Ichor for Kubernetes and Talos Linux
Any Kubernetes cluster from its kubeconfig, and the whole Talos layer, from your phone.
Ichor is a free, open-source Android and iOS app to monitor and operate Kubernetes clusters:
workloads, pods, logs, Argo CD and Flux, on EKS, GKE, AKS, DigitalOcean, Rancher, Omni or your
own (see Kubernetes clusters without Talos). On
Talos Linux clusters it goes down to the nodes: node health, etcd,
KubeSpan, upgrades, machine config and live graphs in your pocket, and a notification the
moment a node goes down.
Website: https://cyrinux.github.io/ichor/
In the app, Settings → About → Ichor website opens the project site.
About → Integrations → Platform → Talos Linux opens the Talos website.
Want to explore without a cluster? Tap Try demo on the import screen.
The built-in demo works offline and shows five sample nodes, live metrics, services,
logs, events, etcd, networking, storage, hardware and resources. The overview marks
it as demo data; cluster changes and credential exports are unavailable. It can
sit alongside your real clusters and be removed from Manage clusters.
The first time the Talos demo opens, a short tour points at the cluster switcher, the nodes,
a node that needs a look, the action bar and Settings; Settings → About → Replay the demo
tour shows it again.
Ichor is an independent community project, not affiliated with or endorsed by Sidero Labs.
Talos is a trademark of Sidero Labs, Inc.
What it does
- Talos nodes: status, services, resources, logs, events, etcd, live graphs, machine config
with try mode, hardware, storage, KubeSpan, packet capture and a debug shell. Reboot, shut down
or wake a node, upgrade Talos node by node or the whole cluster, upgrade Kubernetes, add,
replace, reset or wipe a node, recover etcd, rotate the Talos CA. Alerts when a node goes down, with quiet hours, a per-cluster
minimum severity and a digest.
- Any Kubernetes cluster: workloads with rollout history and undo for Deployments,
StatefulSets and DaemonSets (the pod template diff first) and a Deployment's pause, pods, logs and shells, a browser of every object with
summary, YAML, scale and delete, Jobs, Services and load balancing, storage, autoscaling,
policies, virtual machines, capacity, live events and Alertmanager, with RBAC checked before
you tap. Clusters come from a kubeconfig or a cloud account: EKS, GKE, AKS, DigitalOcean,
Rancher, Omni, OIDC. The
? on the add screen says what each way in needs: a cloud
account, a kubeconfig or a Talos identity for the phone.
- GitOps: Argo CD and Flux apps with the diff a sync would apply, Argo Rollouts, the files
an app deploys at the revision the cluster runs, edits reviewed and opened as pull requests,
a cluster repository for Talos machine config patches, offered a dependency-update bot
configuration when it has none, and the images and charts with a newer version, one tap from
the pull request that bumps them (or select several and propose them as one pull request).
- Operators: Longhorn, CloudNativePG, Garage, Rook Ceph, Velero, cert-manager, External
Secrets, Sealed Secrets, ExternalDNS, Crossplane, Tailscale, Cluster API, Kyverno,
Gatekeeper, KubeVirt, CAST AI and more, each with its findings in the cluster checkup, and
plugins for any CRD of your own.
- Troubleshooting: cluster checkup, configuration drift, incident recorder, node pressure,
bottleneck metrics, network tests between nodes, node network tools, image vulnerability
scans, thirty days of history and an optional AI diagnosis.
- Operating safely: read-only by default, typed confirmations, dry runs, an encrypted audit
log, runbooks with a confirmation per destructive step, a security key or biometric lock,
configs sealed in the phone's security chip, backups that move between Android and iPhone.
The full list, screen by screen, is in docs/features.md; the
website shows the highlights of each release.
The Talos API layer is the official Go client (siderolabs/talos/pkg/machinery, same code as
talosctl) compiled with gomobile, so talosconfig parsing, Ed25519 mTLS and endpoint→node
proxying behave exactly like talosctl.
Install on Android:
- Obtainium installs and updates the app straight from this
repository's GitHub releases. The button above pre-fills it, with a filter that skips
unsigned APKs.
- Manually: download
ichor-v<version>-<abi>.apk from the
latest release; arm64-v8a
fits almost all phones.
F-Droid: not listed yet. The planned route is IzzyOnDroid,
an F-Droid repository that ships the signed release APKs. Release APKs are rebuilt from their
tag and compared in CI (just verify-release, see
Reproducible builds). The release also carries
ichor-wear-v<version>.apk, the Wear OS tile: it only works with the Google Play phone build
(same package and signing key), so it is not meant for F-Droid.
Documentation
| Read | For |
|---|
| Features | Everything the app does, screen by screen |
| Roles | Which talosconfig role each feature needs |
| Adding clusters | Talosconfig for the phone, kubeconfig and cloud clusters, Omni, several clusters, share links, backup and restore |
| Kubernetes screens | Checkup, CronJobs, capacity, policies, autoscaling, virtual machines, Crossplane, Tailscale, Cluster API, image scans, Argo CD icons |
| Network | Node network tools, packet capture, network test |
| Safety | What protects the cluster and the phone |
| etcd | Snapshots, recovery, the NOSPACE fix |
| Cluster insights | Drift, incident recorder, bottleneck metrics |
| AI diagnosis | Optional, off by default |
| Plugins | The plugin file format and how to write one from a CRD |
| Runbooks |
Updates
The Android app updates itself from this repository's GitHub releases (Settings → About → Updates):
- When it checks: once a day, or when you tap "Check now".
- What it downloads: the signed APK for the phone's ABI, after you confirm.
- Verification before installing:
- the SHA-256 checksum GitHub publishes for the file; a release without one is refused;
- the package name;
- that it is signed with exactly the installed app's key, or with a key rotated from it
(APK signature scheme v3 lineage, Android 9+).
- Installing: Android shows its own confirmation, and asks once to allow
"Install unknown apps" for Ichor.
Updates only work between builds signed with the same key, which means CI release builds with
the ICHOR_KEYSTORE* secrets set. A debug build, signed with your machine's debug key,
cannot be replaced by a release. To switch once:
- uninstall the debug build;
- install
ichor-vX.Y.Z-<abi>.apk from a release;
- re-import the talosconfig.
There is no self-update on iOS, where sideloaded apps are reinstalled with Sideloadly or AltStore.
Languages
The app is available in English, French, Spanish, Ukrainian, German, Italian, Simplified Chinese, Japanese, Brazilian Portuguese and Russian.
- Android: pick a language in Settings → Appearance → Language. On Android 13+, the
system's per-app language settings work too.
- iOS: iOS sets the app's language in the Settings app; the app's Language row opens it.
When you add or change a UI string, translate it in every language:
| Platform | English source | Translations |
|---|
| Android | app/src/main/res/values/strings.xml | values-{fr,es,uk,de,it,zh-rCN,ja,pt-rBR,ru}/strings.xml |
| iOS | ios/**/Localizable.xcstrings | the same catalogs (String Catalogs) |
Then run:
just i18n-check # also part of `just check` and the iOS CI build
It fails on a missing translation, when placeholders (%1$s, %@, %lld) differ from
English, or when a plural lacks one of its language's categories (Russian needs few and
many, Chinese only other). It also fails on an Android key that no code or resource reads:
delete it in every language's file.
Support the project
Ichor is free, with no ads or tracking. To help keep it going:
- GitHub Sponsors
- Bitcoin:
bc1qc0dhqrgw6z08du94rkfequk8n5r3lgcr5lnxtl
- Ethereum:
0xb32676301F9c4abD35Eb2e4c7C8cdA754BA29804
The app's About section and the website show them as QR codes.
The Google Play version can't show those links (Play's payment rules). Instead,
Settings → About → Fund features lets you back the features you want next, with Google
Play purchases. The list is docs/roadmap.json; the maintainer side is
in fastlane/PLAY_CONSOLE.md.
License
Apache License 2.0; see LICENSE and NOTICE for third-party components.
The Ichor name, logo and icon are not covered by the license; see TRADEMARKS.md.
To contribute, see CONTRIBUTING.md.
