A fast desktop app on your kubeconfig - or the very same UI served from inside the cluster behind OIDC login, where every person acts as themselves and Kubernetes RBAC decides what they can touch.
Free and open source, AGPL-3.0 · no account, no telemetry
The interface is identical. Only the transport and the identity change - so what you learn in one, you already know in the other.
An Electron shell that talks to the cluster from the main process. It reads the kubeconfig you already have.
The same UI served from a pod behind your identity provider, for teams who should not be passing kubeconfigs around.
Built for the things you actually do all day, not a dashboard you glance at once a week.
Tables ride self-healing watch streams, so rows change the instant the cluster does. Reconnects with backoff on their own.
All CustomResourceDefinitions are discovered and grouped by API group, with dedicated ArgoCD and Crossplane sections.
Streaming logs with filters, a real xterm.js terminal with live resize, and one-click port-forwards that pick a free local port.
A YAML editor using server-side apply, with a dry run first and a diff against the live object before anything is written.
Drag panels where you want them, hide what you do not need. Thresholds colour themselves and problems flash. The layout survives restarts.
A verb-by-resource matrix answered by the cluster's own authorizer, not guessed from Role objects - so webhooks and aggregation count.
Install and upgrade charts with a values diff, roll back from history, and see ArgoCD sync and health with drift called out.
Measured usage against declared requests: what is OOM-killing, what is about to, and what is quietly burning ten times what it uses.
Every kubeconfig context probed in parallel, trouble first - without switching context to find out something is on fire.
Ask why a pod is crashlooping, what changed in the last hour, or to scale a deployment down. It reads logs, events, metrics and objects to find the answer, and it can act - but only through you.
Three ways to connect, so nothing is locked to one vendor or one bill:
Point it at a local model and the whole loop stays on your machine.
New in 3.1.0: give it tools beyond Panope by adding your own MCP servers (a command or an HTTP endpoint). Their tools are namespaced so they cannot shadow a Panope tool, and every external call stops at the same confirmation card - because Panope cannot vouch for a third-party tool the way it can for its own. On the Claude Code provider there is also an opt-in unrestricted mode that hands the CLI its own shell and files, clearly marked as running outside Panope's gate.
Real screens against a real cluster.
# read-only by default, no Ingress, nothing exposed helm install panope oci://ghcr.io/buzzwordy/charts/panope \ --namespace panope --create-namespace # for a team: OIDC login + per-user impersonation. # the allowlist is required - the chart refuses a # blanket impersonation grant. helm upgrade panope oci://ghcr.io/buzzwordy/charts/panope -n panope \ --set auth.mode=oidc \ --set rbac.impersonate.enabled=true \ --set 'rbac.impersonate.groups={platform-admins}'
# the same server the chart deploys docker pull ghcr.io/buzzwordy/panope:3.2.0 # it refuses to start without auth - deliberate. # to try it locally against your own kubeconfig, # opt out explicitly (never behind an Ingress): docker run --rm --network host \ -v ~/.kube/config:/kubeconfig:ro -e KUBECONFIG=/kubeconfig \ -e PANOPE_INSECURE_NO_AUTH=true -e PORT=8080 \ ghcr.io/buzzwordy/panope:3.2.0
In cluster mode the ServiceAccount holds only the impersonate verb - it cannot
read a single pod on its own. Every request carries the logged-in user's identity, so the
API server authorises against their RBAC. Impersonation is applied at the client
level, which means watches, logs, exec and port-forwards all carry it too, and reserved
system: subjects are refused outright.
Point it at something you already run. It is read-only until you say otherwise.
Panope is free and open source. If it saves you time:
Buy me a coffee