Kube Desk Download
0.4.0 AI agents with approval, search and compare across clusters

Every cluster, one keystroke away.

Kube Desk is a fast Kubernetes desktop client for people who juggle many clusters. Every context in your kubeconfig, in one small app: switch in a keystroke, watch resources change live, tail logs, open a shell, edit YAML.

Download for macOS Source on GitHub

Free and open source (MIT)Apple silicon, macOS 12+No telemetry Linux, Windows, Intel

This is a working preview. Press 1 2 3 4 to switch clusters and 0 for all of them. Open a page, switch away and come back: it’s where you left it.

Built around switching between clusters.

Kube Desk takes the parts of Headlamp and Lens you use every day and makes moving between clusters the core of the app, not an afterthought in a dropdown.

One app for every cluster

It reads every context in ~/.kube/config and $KUBECONFIG. Add more by picking a file, pasting a kubeconfig, or entering a server and a token.

Switching is instant

Each cluster keeps its own page, namespace and open object, and its data stays live for a while after you leave. Coming back shows it as you left it.

Small and light

One Go binary, about 47 MB. It uses the system’s WebView instead of bundling Chromium, and starts like a native app.

Your kubeconfig is never modified

Clusters you add in the app live in its own data folder. Files that gcloud, aws or az rewrite are read in place, so changes show up.

For the day something breaks.

Hear about a problem before anyone asks, see what changed and who changed it, and know what a fix will touch before you make it.

Watch from the title bar, ⌘K or the menu bar

Hear about problems, even with the window closed.

Watch a namespace or a whole cluster. Kube Desk keeps watching in the background and tells you when something goes wrong. When many things break at once, you get one notification, not forty.

  • Crash loops, out of memory, image pull errors, pods that can’t be scheduled
  • Rollouts that get stuck, and nodes that go down
  • A menu bar icon counts the problems; click one to open it

Sidebar → Changes, and the History tab of every object

See what changed, and who changed it.

In the namespaces you watch, every change is kept for 7 days, in plain words, with a diff of before and after. Changes made while Kube Desk was closed are found when it starts again.

  • Who did it: kubectl, Helm, Argo CD, a controller, or an AI agent
  • Restarts, readiness and warning events on the same line
  • Secret values never reach the timeline, only which keys changed
Changes in shop last 24 hours
  1. deployment/api Helm image api:1.8.2 → api:1.9.0
    containers:
    - name: api
    - image: registry.example.com/api:1.8.2
    + image: registry.example.com/api:1.9.0
  2. pod/api-6b7f8d9c5-mx2rt kubelet restarted · OOMKilled
  3. configmap/api-config kubectl key LOG_LEVEL changed
  4. deployment/checkout Argo CD replicas 1 → 2
  5. secret/db-credentials kubectl key password changed while closed

Delete, scale, restart and drain

Know what breaks before you click.

Every risky action shows first what else it affects. Mark a cluster as production and it shows in red, and every change asks you to type its name. Read-only clusters refuse every change and shell, enforced by the app itself, not just by hidden buttons.

  • Services left without endpoints, ingress routes that stop working
  • Disruption budgets, data in volumes, pods that won’t fit elsewhere
  • Objects that Helm, Argo CD or Flux would put back
production-eu is a production cluster
Delete deployment/checkout?

What this affects

  • BreaksService checkout is left with no endpoints
  • BreaksIngress route shop.example.com/checkout stops working
  • WarnsPodDisruptionBudget checkout-pdb would be broken
  • NoteManaged by Argo CD, which may create it again
Type the cluster’s name to continue

MCP server for Claude Code, Cursor, Codex, Claude Desktop

Let agents investigate. You approve every change.

Ask “Why is checkout failing in production-eu?” and the agent reads the incident report and recent changes. When it proposes a fix, Kube Desk shows you the diff and what it affects before anything changes.

What agents may doper cluster
production-eu
staging
qa

Every cluster starts at Off. Choose what each one allows.

Claude Code wants to change production-eu 4:52 left

Agent’s reason ledger-sync crash loops because LEDGER_DB_URL still points at the old database host. Point it at the new one.

apply_manifestdeployment/ledger-syncpayments

- name: LEDGER_DB_URL
- value: postgres://ledger-db-old.payments:5432/ledger
+ value: postgres://ledger-db.payments:5432/ledger
  • NoteRolls out 1 pod; the service keeps its other endpoints
Production: you’ll type the cluster’s name

Read

  • list_clusters
  • list_resources
  • get_resource
  • get_logs
  • get_events
  • get_changes
  • incident_report
  • search
  • compare
  • preview_impact

Propose, then wait for you

  • apply_manifest
  • delete_resource
  • scale
  • restart
Add Kube Desk to Claude Code. The app shows the command, with your token, for each client. 
$ claude mcp add --transport http kubedesk http://127.0.0.1:47428/mcp \
    --header "Authorization: Bearer <token from Kube Desk>"

Off by default

The server is off until you turn it on, and every cluster starts at Off.

This Mac only

It listens on 127.0.0.1, behind a token, and checks the Host header.

Secrets stay secret

Secret values never reach agents. Tokens and passwords in logs are masked.

Named in the timeline

Changes carry the agent’s name, so the timeline shows who made them.

Many clusters, searched and compared as one.

Find a pod without remembering which cluster it runs in, and see at a glance why staging works and production doesn’t.

⇧⌘F Search every cluster

app=checkout ns:shop
production-eu3
pod/checkout-7f9c6d5b8-2xkqpRunning
pod/checkout-7f9c6d5b8-h7vnsRunning
deployment/checkout2/2
staging2
pod/checkout-86b5d7c9f-tq2mlRunning
deployment/checkout1/1
edge-singaporeunreachable

Search by name, image:, app=web, kind:, ns:, node: or is:failing. Results arrive cluster by cluster.

Compare across clusters, from any workload, service, config map or secret

deployment/checkout Only differences
production-eu staging qa
imagecheckout:2.4.1checkout:2.5.0checkout:2.5.0
replicas211
cpu request500m250m250m
env NEW_CARTfalsetruetrue
port8080/TCP8080/TCP8080/TCP
secret db-urlsha 3f9a…sha 81c2…sha 81c2…

What differs is highlighted, with a YAML diff between any two clusters. Secrets are compared by fingerprint only.

And the rest of a day’s work.

Logs, shells, YAML and the details of every kind, in the real app.

Every kind, updated live.

Lists stay current through watches, so you never press refresh. Custom resources show the columns their CRD declares.

Cluster

  • Nodes
  • Namespaces
  • Events

Workloads

  • Pods
  • Deployments
  • StatefulSets
  • DaemonSets
  • ReplicaSets
  • Jobs
  • CronJobs

Network

  • Services
  • Ingresses
  • EndpointSlices
  • NetworkPolicies

Config

  • ConfigMaps
  • Secrets
  • HPAs
  • PodDisruptionBudgets

Storage

  • PersistentVolumeClaims
  • PersistentVolumes
  • StorageClasses

Access control

  • ServiceAccounts
  • Roles
  • RoleBindings
  • ClusterRoles
  • ClusterRoleBindings

Custom resources

Every CRD in the cluster, with its additionalPrinterColumns.

Metrics

CPU and memory of pods and nodes in their lists, with metrics-server.

Logs of a whole workload

Every pod of a Deployment, StatefulSet, Job or Service, interleaved by time and colored by pod. Pods that start during a rollout join in.

Incident report

A pod’s state, events, logs from before its last restart, its node and recent changes, in one Markdown report with secrets masked.

Port forwarding

From pods and services, listed in the title bar so you can see and stop what’s open.

Actions, in bulk too

Delete, scale, restart, cordon, uncordon and drain. Run a CronJob now, suspend and resume.

Create from YAML

From templates or your own YAML, several documents at once.

Works with your login

GKE, EKS, AKS/kubelogin and OIDC plugins work even when the app opens from Finder, because it loads your shell’s PATH.

Keyboard first.

⌘KCommand palette: clusters, pages, namespaces, objects
⌘1 … ⌘9Switch to the nth cluster
⌘0All clusters
⇧⌘FSearch every cluster
⌘FFilter the current list, by text or label=value
⌘SApply the YAML you’re editing
EscClose the details panel

Private by design.

  • No telemetry. Kube Desk only talks to the API servers in your kubeconfigs and to the update server.
  • Your files stay yours. It never writes to your kubeconfig. Pasted kubeconfigs and tokens are stored with 0600 permissions in the app’s own folder.
  • Signed updates. Releases are signed with Ed25519, and the app checks the signature before installing.
  • Open source. Read every line on GitHub, under the MIT license.

Bring every cluster
into one window.

Free and open source. Updates itself after the first install.

Download Kube Desk 0.4.0 Install guide

macOS 12 or later, Apple silicon Not notarized yet: the first time, right-click the app and choose Open