Actions
27 actions, callable from the panel, the command palette and the API as
POST /api/v1/a/<id>. Internal actions used between modules are not listed.
| Action | What it does | Risk | Preview |
|---|---|---|---|
kubernetes.cluster.list | List clusters (read) | low | No dry run |
kubernetes.cluster.get | Get a cluster (read) | low | No dry run |
kubernetes.cluster.connect | Connect a cluster | high | |
kubernetes.cluster.test | Test a connection (read) | low | No dry run |
kubernetes.cluster.create_k3s | Create a k3s cluster | critical | |
kubernetes.cluster.forget | Forget or remove a cluster | critical | |
kubernetes.view | Read cluster objects (read) | low | No dry run |
kubernetes.pod.logs | Pod logs (read) | low | No dry run |
kubernetes.workload.scale | Scale a workload | medium | |
kubernetes.workload.restart | Restart a workload | medium | No dry run |
kubernetes.workload.delete | Delete a workload or pod | high | |
kubernetes.secret.get | Show a secret with values hidden (read) | low | No dry run |
kubernetes.secret.reveal | Show one secret value | high | |
kubernetes.yaml.preview | Preview YAML (read) | low | No dry run |
kubernetes.yaml.apply | Apply YAML | high | |
kubernetes.pod.exec.start | Open a shell in a pod | high | |
kubernetes.pod.exec.io | Shell input and output (read) | low | No dry run |
kubernetes.pod.exec.close | Close a shell | low | No dry run |
kubernetes.helm.catalog | Chart catalog (read) | low | No dry run |
kubernetes.helm.list | Helm releases (read) | low | No dry run |
kubernetes.helm.values | Values of a release (read) | low | No dry run |
kubernetes.helm.install | Install a chart | high | |
kubernetes.helm.upgrade | Upgrade a release | high | |
kubernetes.helm.rollback | Roll a release back | high | |
kubernetes.helm.uninstall | Uninstall a release | high | |
kubernetes.namespace.ensure | Give an account a namespace | medium | |
kubernetes.namespace.mine | My namespaces (read) | low | No dry run |
Permissions and limits
Permissions
kubernetes.viewLook at clusters and everything in themkubernetes.manageConnect, create and change clusters, apply YAML and chartskubernetes.namespace.useUse the namespaces given to the account
Engineering notes
Generated from modules/kubernetes/docs.md at build e0cdf300. These are the notes the engineers keep
next to the code: precise, technical, and honest about what is not done yet.
Spec: docs/specs/kubernetes.md. ADR 0024 decision 6. Paid add-on (edition: kubernetes).
Layout
k8s/: the client layer onkubernetes.Interface(client-go, Apache-2.0): connection material and kubeconfig vetting (conn.go), read views (views.go, columns after k9s), masked secrets, workload actions, YAML apply with server-side dry run and diff (apply.go), account namespaces and ingress host rules (tenancy.go), Helm SDK (helm.go). Tested with client-go's fake clientset.cp/: the plugin.main.go(levels,scopedgate),clusters.go,views.go,tenancy.go,helm.go,exec.go.- Agent ops:
kubernetes.k3s.install|info|remove(internal/agent/kubernetes.go, types insdk/agentop/kubernetes.go). The pinned release table (agentop.K3sReleases) holds version and sha256 per architecture; add a release by copying the sha256 from the release'ssha256sum-<arch>.txt. - Vault names:
cluster/<id>/connection(JSON material),cluster/<id>/k3s-token. - UI:
ui/(cluster list and wizard, cluster page tabs, logs, shell, YAML with plan diff, Helm, overview with namespaces).
Levels
accessOf maps the actor to manage (kubernetes.manage), view (kubernetes.view) or account (namespace.use on a
hosting account). Every call goes through scoped(cluster, namespace, write).
Not here
Managed clusters (w11-154), a websocket gateway for the shell, per-action parameter schemas (all use schemas/params.json).