OpenShift Pulse UI

A React and TypeScript dashboard for OpenShift operations: resource browsing and editing, cluster health, logs and terminals, monitoring, and integration with the Pulse Agent.

Sample data. The banner says which checks are off and how to turn them back on; episodes lead with the change closest to what broke and offer a rollback through Pulse's normal confirmation.

Every diagnosis comes with proof. When you pick up an incident, Pulse builds a view of the evidence behind its diagnosis from live cluster data: the steps it took, the metric that moved, the crash line, what it ruled out, and how confident it is.

Ask for a view, get one. Describe what you want to see in plain English. Pulse runs the queries, shows each tool as it goes, and builds a dashboard for that question that you can keep, edit or share.

Sample data in both.

New in v2.37.0: Admin › Updates has one update-readiness panel — a Ready / Not ready / Could not check verdict with every blocker and its fix (removed APIs still called, admin acknowledgements, disruption budgets, certificate expiry, etcd health), and a failed read is shown as unknown rather than a pass; readiness gate waivers are kept by the agent and shared across the cluster instead of living in one browser; the Pod page answers "what changed?" from the resource, its owners, the ConfigMaps and Secrets it uses, Argo CD syncs and cluster upgrades, and reports each container's last termination. v2.36.0: investigation evidence names the exact tool call it came from, with its arguments, and the inbox drawer shows whether each piece supports or contradicts the cause. See the changelog.

See it in 36 seconds:

Install

Use the Pulse Operator installation guide to deploy the UI, agent, PostgreSQL, OAuth proxy, and supporting resources from an OpenShiftPulse custom resource. This repository builds the UI container consumed by spec.ui.image; it does not contain a Helm chart for installing Pulse.

The static UI does not require its own database. Agent features require a reachable agent and its PostgreSQL database; they are unavailable when only the UI is running.

Local development

Requirements: Node.js 24 or later, pnpm 10.33.0 (the version in package.json), and oc authenticated to a target OpenShift cluster for live API data. Local development uses your CLI credentials; the production operator supplies OAuth authentication.

pnpm install --frozen-lockfile
oc login https://api.your-cluster:6443
oc proxy --port=8001

In another terminal:

pnpm dev                  # http://localhost:9000

rspack.config.ts reads environment variables from the process. Copying .env.example to .env does not load it automatically. Export the required variables before starting the server:

export K8S_API_URL=http://localhost:8001
export PULSE_AGENT_URL=http://localhost:8080
# Set PULSE_AGENT_WS_TOKEN to match the agent through your local secret mechanism.
# Set PULSE_USER_TOKEN to a real user token for admin-gated agent operations.
pnpm dev

Do not expose the development server or oc proxy to untrusted users. Its proxy credentials are the developer's credentials. Never commit tokens or include them in screenshots/logs.

Variable	Default	Purpose
K8S_API_URL	http://localhost:8001	Kubernetes HTTP/WebSocket proxy target
THANOS_URL	disabled	Thanos/Prometheus proxy target
ALERTMANAGER_URL	disabled	Alertmanager proxy target
CONSOLE_URL	CLI-discovered when possible	OpenShift Console target for Helm integration
OC_TOKEN	oc whoami -t when available	Development proxy credential
PULSE_AGENT_URL	http://localhost:8080	Agent proxy target
PULSE_AGENT_WS_TOKEN	unset	Shared backend credential injected by dev proxy
PULSE_USER_TOKEN	test placeholder when shared agent token is set	Caller identity forwarded to agent; use a real token against a real agent

Checks

pnpm type-check
pnpm lint                 # does not rewrite files
pnpm lint:fix             # explicitly apply ESLint fixes
pnpm test                 # unit/component tests once
pnpm test:coverage
pnpm build
pnpm verify               # types + lint + tests + build

Test counts and timings vary with the revision and machine; use the current command output. Type-check excludes test files as configured in tsconfig.json.

pnpm e2e runs Playwright. Without PULSE_URL, its config starts a mock Kubernetes API, a real agent/PostgreSQL container stack, and the UI dev server. Install Chromium with pnpm exec playwright install chromium; a working container runtime and an agent checkout are required by e2e/start-agent.sh. With PULSE_URL, tests target an existing deployment instead. These tests can perform mutations: use a dedicated test environment and review the selected specs. Passing mock tests does not establish real cluster readiness.

Product surfaces

• Pulse / Workloads / Compute / Storage / Networking: health summaries, generic Kubernetes resource tables/details, deployment revision rollback, YAML editing and server dry-run validation.
• Inbox: findings and episodes, task lifecycle, review proposals, and chronological activity.
• Agent: Mission Control with trust preferences, reported effective server policy, scanner coverage, quality results, and learning information.
• Toolbox: backend-discovered tools, skills, connections, components, usage, and analytics.
• GitOps: ArgoCD integration and Git provider workflows, when those integrations are configured.
• Fleet: ACM discovery and cross-cluster views. Cluster identity must be preserved through data and action flows; verify live cluster switching before production use.
• Identity / Admin / Readiness: user/RBAC views, cluster administration, and readiness checks. Readiness scores are a guide, not a certification. The /readiness page also shows the agent installation diagnostic: provider configuration/connectivity, database, Kubernetes read permissions and monitoring. Unknown checks remain unknown; this report does not certify model execution or incident recovery.
• Custom views: agent-generated dashboards persisted by the agent, with version/share controls.

Available tools, scanners, component kinds, and operator catalog entries depend on the backend and cluster. Read capability endpoints and current source rather than relying on release-era counts.

Trust and action boundaries

Browser trust is persisted per hostname in trustStore. Direct UI mutation controls, interactive chat confirmation, and background autonomous monitoring have different enforcement paths. The backend's reported effective trust can differ from the browser selection. Current category controls do not establish a server-side allowlist, and Bounded chat requires approval when the backend supplies no verified category; do not interpret a browser category selection as authorization enforcement. Review Security and API integration, and validate policy on a test cluster.

Architecture

src/kubeview/
  engine/       API helpers, discovery, watches, agent clients, component registry
  engine/types/ Kubernetes and incident types
  hooks/        TanStack Query, list/watch, capability and RBAC hooks
  store/        Zustand UI, fleet, agent, monitor, trust, inbox and view state
  components/   Resource UI, logs, metrics, YAML, agent renderers, feedback
  views/        Domain pages and generic resource CRUD pages
  routes/       Domain/resource routes and legacy redirects

Production request path: browser → OAuth proxy → operator-generated nginx proxy → Kubernetes/monitoring APIs or agent. The operator owns nginx configuration, OAuth settings, RBAC, images, and rollout behavior. Dockerfile packages already-built dist/; it does not build TypeScript itself.

The UI uses React 19, TypeScript 5, Rspack 2, Tailwind 4, Zustand, TanStack Query, Vitest, and Playwright. Exact versions are in package.json and pnpm-lock.yaml.

Image development

Use an immutable tag/digest and update the operator CR to test a rebuilt UI image. Review the operator's image and rollout documentation; this repository's older S2I/manual deployment instructions are not the supported install path.

pnpm build
podman build --platform linux/amd64 -t "$PULSE_UI_IMAGE" .
podman push "$PULSE_UI_IMAGE"
# Then update spec.ui.image on the target OpenShiftPulse CR.

Screenshots and project links

inbox.png and scanners.png (v2.33.0) and chat.png, view.png and evidence.png (v2.34.0) in docs/screenshots are sample data from node e2e/screenshots/capture.mjs (see the header of that file); evidence.png predates the v2.35.0 stance and source labels. The other screenshots there capture earlier UI revisions from a live cluster and may differ from the current routes and data. docs/index.html is the project landing page.

• Contributing
• Security
• API integration
• Changelog
• Operator
• Agent

MIT license; see LICENSE.

Release safety regression checks: pnpm run test:acceptance. See release acceptance for the isolated CI lane and separate real-cluster gate.