PodSteer
A fast, native desktop client for Kubernetes.
podsteer.com | What it does | Compared to k9s, Lens and others | FAQ
Every other Kubernetes client hands you a pod list and leaves you to work out
what is wrong. PodSteer reads the cluster and tells you — findings ranked and
grouped, capacity measured against what pods actually reserved, and every custom
resource your operators install browsable without an update here.
It is built on Wails v3: a Go backend talking to the
operating system's own webview, rather than a bundled Chromium. There is no
second browser engine in the process tree, which is where most of an
Electron-based client's memory and startup time go.
🔝 back to top
Installing
macOS — signed with a Developer ID, notarised by Apple, and the ticket is
stapled, so it opens without a Gatekeeper warning.
brew tap podsteer/tap
brew trust podsteer/tap
brew install --cask podsteer
brew trust is not a formality and not specific to PodSteer: Homebrew refuses
to load a cask from a third-party tap until you say you trust it, because a
cask is code that runs on your machine at install time. Every tap outside
Homebrew's own needs it. You can read what you are trusting first — it is one
file, Casks/podsteer.rb.
Linux and Windows — download from
the latest release and
unzip it. Linux needs libgtk-3 and libwebkit2gtk-4.1.
Each release also carries (from v0.6.0; earlier releases ship the zips only):
- Linux (amd64 and arm64) — an AppImage (
chmod +x and run), a .deb
(sudo apt install ./podsteer_<tag>_linux-amd64.deb) and an .rpm
(sudo dnf install ./podsteer_<tag>_linux-amd64.rpm). The .deb and .rpm
declare the libgtk-3 / libwebkit2gtk-4.1 dependencies for you; the
AppImage uses the ones already on your system.
- Windows — a per-user installer,
podsteer_<tag>_windows-amd64-setup.exe.
The Windows build is not code-signed yet. The release pipeline signs the
executable and installer through Azure Trusted Signing once that is configured,
and warns loudly when it is not; a build published without it is unsigned, and
SmartScreen will warn on first launch — "Windows protected your PC". That is the absence of
a signature, not a verdict about the file. Verify the download against the
published checksums.txt if you want to be sure of what you have.
Every release publishes SHA-256 checksums and a CycloneDX SBOM alongside the
binaries.
🔝 back to top
Status
What works today:
- An assessment, not a list. Ranked findings — crash loops, OOM kills,
unschedulable pods, rightsizing, APIs the next Kubernetes version removes —
with capacity measured against requests rather than usage.
- Several clusters at once, one per tab, plus an All-clusters view and a
Multi-kind table; cloud cluster discovery through the aws, az, gcloud or
doctl CLI you already use. One namespace selector in the sidebar takes
several namespaces and applies across pages.
- Applications and Topology: an Applications map and Logs tab with level
chips and a volume histogram; a Topology page that draws a namespace, several
or all as one map where every line is a real relationship, grouped by
namespace, application or label, with findings badges and PNG export
(desktop app only). Kubernetes 1.37 gang-scheduling
Workload and
PodGroup panels sit beside it.
- Observed traffic, only when you switch it on: rates, errors and p50–p99
read from the cluster's own Prometheus (Istio, Linkerd, Beyla/OBI, Caretta or
Hubble metrics), with the PromQL shown. Nothing is installed in the cluster.
- Safe writes of any kind: server-side apply with field conflicts named,
rollout history and rollback, drain with a preview, bulk actions with a
review step, and the kubectl equivalent of every write.
- GitOps and Helm: Argo CD and Flux panels with a warning before any change
a controller will revert; Helm releases listed without reading Secret
payloads.
- Security: posture findings, Trivy Operator reports quoted, and an RBAC
explorer answered by the API server.
- Shells and agents: exec, debug containers, node and in-cluster shells, a
local terminal on every platform, and
podsteer mcp, a read-only MCP server
for coding agents.
- Typed panels for cert-manager, KEDA, External Secrets, Argo Rollouts,
Trivy, Karpenter, Gateway API, DRA and admission policies; every other CRD
browsable through the API server's own table output.
podsteer.com/features describes each in
full, including what it deliberately does not do.
Built for large clusters: the pod table is filtered, sorted and paged in Go, so
a refresh at 10,000 pods moves roughly 120 KB rather than 23 MB, and sampling
slows for clusters in background tabs. Credentials refresh for tabs left open,
a throttled call is reported as throttling, and a dropped port-forward shows
"Lost — Reconnect" (opt-in "Keep across restarts" remembers it).
Capacity is sampled every 30 seconds while the application is open and kept
locally, which is the only way to have a trend at all — Kubernetes reports only
the present — and is deliberately presented as the narrow window it is.
podsteer.com/download carries the same
downloads with a little more context.
🔝 back to top
Requirements
- Go 1.27+ (the version
go.mod pins, and the toolchain whose own macOS
floor the darwin build tracks — see the note in the Makefile)
- Node.js 20+
- The Wails v3 CLI, pinned to the beta this repository
builds against:
go install github.com/wailsapp/wails/v3/cmd/[email protected]
- A kubeconfig at
$KUBECONFIG or ~/.kube/config
🔝 back to top
Running it
make deps # frontend dependencies + go mod tidy
make run # build it, then launch it with logs in your terminal
make run produces the real packaged artefact and starts it in the foreground,
so application logs land in the terminal and Ctrl-C stops it. Add
PODSTEER_LOG_LEVEL=debug for the full picture of what it is asking your
cluster.
While iterating, make dev is the faster loop — it hot-reloads the frontend on
save and rebuilds the Go side on change, rather than repackaging each time. On
macOS, make open launches the built .app the way Finder would, with its own
Dock icon.
A locally built .app is ad-hoc signed by make dev and unsigned by
make build, which macOS accepts for something built on the machine running
it. Downloaded release artefacts are a different matter — see
docs/RELEASING.md.
🔝 back to top
Asking about your cluster from a coding agent
The same binary is a Model Context Protocol
server, so the agent you already use can read your clusters through PodSteer:
podsteer mcp
Point your agent's MCP configuration at that command — it starts the server
itself and talks to it over stdin and stdout. No port is opened, nothing is
served over HTTP, and nothing PodSteer operates is contacted.
Every tool is read-only: lists, manifests, bounded log reads, events, the
cluster and pod assessments, the ranked cluster findings with their evidence (filterable by severity and namespace), the dependency map and the RBAC reviews — 19 tools in all. There is
no delete, scale, apply, exec or port-forward, and no tool that reveals a
Secret's values. It reads your own kubeconfig with your own credentials, so it
can see exactly what your account can see and nothing more — a refusal comes
back as a refusal rather than as an empty list.
🔝 back to top
Architecture
Hexagonal (ports and adapters) with a domain-driven core. The whole point of
the layering is the direction of the arrows: dependencies point inward, and
the domain knows nothing about Kubernetes, Wails, or the UI.
┌─────────────────────────────┐
Svelte UI ─────► │ adapters/wails (driving) │
└──────────────┬──────────────┘
│ ports (inbound)
┌──────────────▼──────────────┐
│ application │ use cases
└──────────────┬──────────────┘
│ ports (outbound)
┌──────────────▼──────────────┐
│ adapters/k8s (driven) │ ─────► API server
└─────────────────────────────┘
app/domain — entities, value
objects, events; stdlib only
| Directory | Responsibility |
|---|
app/domain | Cluster, Namespace, Pod; invariants and derived status |
app/ports | Interfaces: what the app offers, and what it needs |
app/application | Use cases; orchestration, ordering, event publication |
app/adapters/k8s | client-go + cli-runtime; the anti-corruption layer |
app/adapters/wails | Bound structs and DTOs — the frontend API contract |
app/cmd | Composition root; the only place dependencies are constructed |
web/src | Svelte 5 UI, Material Design 3 tokens over Tailwind v4 |
A concrete payoff: the entire application test suite runs against hand-written
fakes with no cluster, no HTTP and no Kubernetes types in sight.
🔝 back to top
Performance choices
- Protobuf, not JSON, for core API requests — faster to decode and far
lighter on allocations for large pod lists.
- Clients cached per cluster. Building one re-reads the kubeconfig and may
spawn a credential-plugin process; that cost is paid once.
- client-go's 5 QPS default raised, because it is sized for a controller's
background load, not for a UI that fans out on navigation.
- No sourcemaps, no webfonts, no icon font in the embedded bundle — the
application starts from what it ships with and fetches nothing to render.
🔝 back to top
Configuration
Everything is optional and prefixed PODSTEER_:
| Variable | Default | Purpose |
|---|
PODSTEER_KUBECONFIG | $KUBECONFIG, ~/.kube/config | Alternative kubeconfig |
PODSTEER_KUBECONFIG_DIR | unset | Directory of kubeconfigs, merged in after |
PODSTEER_QPS | 50 | Sustained request rate |
PODSTEER_BURST | 100 | Burst allowance |
PODSTEER_REQUEST_TIMEOUT | 30s | Per-call deadline |
PODSTEER_LOG_LEVEL | info | debug/info/warn/error |
PODSTEER_LOG_SOURCE | false | Include source file and line |
PODSTEER_UPDATE_CHECK | true | false disables the update check machine-wide |
PODSTEER_LIVE_WATCH | true | false re-lists pods instead of watching them |
PODSTEER_COPY_MAX_BYTES | 1073741824 | Ceiling on one file copy to or from a container |
PODSTEER_COPY_MAX_ENTRIES | 100000 | Ceiling on entries in one such copy |
🔝 back to top
Contributing and releasing
Contributions are welcome under Apache-2.0, signed off under the
Developer Certificate of Origin — git commit -s. There is no CLA.
CONTRIBUTING.md covers what the build expects of a change
and the handful of CI gates worth anticipating.
develop is the integration branch; main holds released code and is only
ever reached by a PR from develop. Tags follow the ParliTrack standard —
v1.2.3-dev-N for development, v1.2.3-rc-N for candidates, v1.2.3 for
production — and are cut with make tag.
See docs/RELEASING.md for the full cycle, what each guard
protects against, and why the generated Wails bindings are committed.
make check # gofmt, go vet, golangci-lint, svelte-check
make test # go test -race ./...
make tag show # what is actually released right now
🔝 back to top
Security
PodSteer reads and writes: it can delete objects, scale and restart
workloads, apply edited manifests, and open a shell in a container. It does so
with the credentials your kubeconfig already grants, and it enforces no
permissions of its own — restricting what it may do is a matter of restricting
those credentials.
There is no account and no telemetry, and the webview is locked down by a CSP
that forbids every remote origin — all cluster traffic goes through the Go
process, never the page.
The one thing it contacts besides your clusters is GitHub, once a day, to see
whether a newer release exists — and only if you leave that on. It sends no
version, no platform and no identifier; the comparison happens locally. Switch
it off in Settings → Notifications, or set PODSTEER_UPDATE_CHECK=false to
disable it for a whole machine. SECURITY.md says exactly what is
and is not sent.
To report a vulnerability, see SECURITY.md.
🔝 back to top
PodSteer
Website | LinkedIn | BlueSky | GitHub
© PodSteer - A Cloudresty project
