Sextant

Sextant is a desktop application for managing Kubernetes clusters — an alternative to Lens, written in Rust on Tauri 2. It reads your kubeconfig, shows the resources of every cluster in live tables and lets you inspect, edit and operate them in one window. Linux, macOS and Windows.

Features

• Your kubeconfig — every context is a cluster; several can be connected at once. Add files one by one, or a whole folder of them, whose subfolders become workspaces.

• Cloud clusters — find your Amazon EKS, Google GKE, Azure AKS and Yandex Cloud clusters through the aws, gcloud, az and yc you already use, and add them in a few clicks.

• Every resource in live tables, with details, a YAML editor, scale, restart, cordon, drain and CronJob actions; custom columns from labels, annotations and field paths, persistent column filters with nested AND/OR conditions per cluster and table, and Set image… with a preview and a patch of the image fields only.

• Logs, shells and port forwarding — container logs with search, logs of several pods at once, a shell in any container, debug containers, copying files to and from containers, a shell on a node (a temporary privileged pod, removed when you close it), a local terminal already pointed at the cluster.

• Problems and notifications — everything wrong in a cluster on one page, and desktop notifications for new problems that you can turn off globally, per kind of problem, per cluster or for an hour.

• Command palette (Ctrl+K) to jump to any object or page; rollout history with a diff and rollback.

• Understand the cluster — right-sizing of requests and limits from real usage, cert-manager and the expiry of every TLS certificate, a map of how objects relate (and what a delete would break), RBAC: who can do what.

• Safer changes — a dry run and a diff before applying YAML or upgrading a Helm release, upgrade readiness (deprecated and removed APIs, version skew), security posture (Pod Security Standards, Trivy reports), and an overview of several clusters.

• Troubleshooting — a timeline of what changed and by whom, why autoscaling did or did not scale, a cleanup of objects that are provably unused, and a network policy check: can pod A reach pod B.

• Your workspace — saved views of tables, pinned objects, workspaces of clusters, export and import to share them with your team (never credentials), and kubeconfig management: rename, duplicate, delete and merge contexts with a preview and a backup, and credential expiry.

• Power tools — a YAML editor that knows the cluster's schema (completion, validation, Explain), storage insights (volume usage, snapshots, Velero), a cost view from OpenCost or Kubecost, and terminal panes with snippets.

• Scale and reach — Istio and Linkerd views with request routing and who may call a workload, comparing objects and namespaces across clusters (and drift from Helm), comfortable on clusters with tens of thousands of pods, and keyboard and screen-reader friendly.

• Faster diagnosis — best-practice checks (probes, :latest images, single replicas, PodDisruptionBudgets, requests and limits) with a fix to copy, why a Service, Ingress or route gets no traffic, link by link, Helm revision compare and newer chart versions, and container probes in plain words.

• Live traffic — a workload's request rate, error rate and latency (p50/p95/p99) with CPU throttling and a hint when the CPU limit is the cause, and a live graph of who calls whom with the rate, errors and latency of each call, from what Istio, Linkerd, ingress-nginx, Grafana Beyla or Cilium Hubble already report to Prometheus or VictoriaMetrics — nothing installed.

• Ecosystem — Argo Rollouts (status, steps, weights, analysis; promote, abort and retry as the kubectl plugin sends them), Argo Workflows (the step tree with the failed step and its logs, CronWorkflows), Knative Serving, Crossplane (claim → composite → managed resources, paused state), Kyverno (policy results on every object), External Secrets (never the secret data), CloudNativePG (primary, replicas, backups, hibernation), Strimzi and Prometheus Operator (what a monitor selects and which Prometheus picks it up), each from the operator's own status.

• In your language — English, Russian, Ukrainian, German, French, Spanish, Portuguese (Brazil), Italian, Polish, Turkish, Chinese (Simplified and Traditional), Japanese and Korean.

• Metrics from metrics-server and Prometheus or VictoriaMetrics (both found automatically); Helm releases and charts; Flux and Argo CD (sync, diff).

• MCP server for AI agents — connect Claude Code, Claude Desktop or Cursor to your clusters, with permissions you set per cluster, confirmations in the window and an activity log; read-only diagnostic tools give agents the window's own answers (problems, traffic diagnosis, connectivity, permissions, recent changes, autoscaling), only from what the agent may read.

• Extensions — install more from the catalog (signed by their publishers, checked by Sextant) or write your own: pages, details panels, actions, columns, problem rules and metric charts, in isolated frames with the permissions you agree to — see Extensions below.

• No account, no server, no telemetry.

An AI agent asks to scale a deployment; Sextant asks you first and records the call:

Related MCP server: kubernetes-mcp

Extensions

Sextant keeps its core focused on what every cluster needs and grows through extensions: small web pages, with an optional sandboxed WebAssembly backend, that add views for the operators and tools you actually run. Open Settings → Extensions → Catalog, pick one, read what it asks for, and press Install.

Sextant's own extensions. The catalog starts with extensions Sextant makes itself, kept out of the core so they ship on their own versions. The first is Rook Ceph:

• Ceph's health and each health check in plain words;

• raw capacity, versions, and a "stale" mark when the operator stops refreshing the status;

• the operator, monitors, managers, OSDs by node, MDS, RGW and CSI drivers with their readiness;

• the storage classes and claims on every pool, filesystem and object store;

• charts of health, capacity, OSDs and placement groups from the Ceph mgr's metrics;

• problems and notifications when Ceph is unhealthy or its status goes stale;

• since 1.1.0, management through Rook's own objects: Ceph upgrades checked against the versions Rook supports, the CRUSH tree and OSDs (replace, stop, remove with Rook's purge Job), a node's CRUSH location, pool, MDS and gateway settings, new pools, filesystems, object stores and StorageClasses, muted health checks and the toolbox;

• since 1.2.0 (Sextant 0.29), ceph commands in Rook's toolbox fixed in its manifest: status, health detail, the OSD tree and usage, the cluster's OSD flags, marking OSDs out or in and reweighting them, Ceph's own ok-to-stop and safe-to-destroy checks before an OSD is stopped or removed, and a sidebar section of its own with a problem counter.

Every change is shown before it is sent and confirmed in Sextant. It speaks every language Sextant does. Each of Sextant's own extensions has its documentation in its folder: Rook Ceph, all of them.

What an extension can add:

• a page in the sidebar;

• a section or tab in an object's details;

• an action in its menu;

• a table column;

• a dock tab;

• a settings section;

• problem rules that Sextant evaluates itself, with nothing of the extension running, and that show up on the Problems page and in notifications;

• charts from the cluster's Prometheus or VictoriaMetrics, through queries written in its manifest;

• a backend that calls the services you agree to, such as a pager or ticket system.

You stay in control.

• An extension asks for permissions in the same model as AI agents: which clusters, namespaces, kinds and actions. The consent screen shows them in plain words, with every metric query word for word, before anything is installed.

• Every call is checked in Sextant's core, and changes ask you first. Secret values never reach an extension unless you allow them.

• Each extension runs in an isolated frame with no network, and every call is written to an activity log.

• Catalog packages are signed by their publisher and checked before they are unpacked. An update that asks for more asks you again, and nothing updates by itself.

Write your own. The SDK in sdk/ gives a template, examples, a test host, typed APIs, translations into Sextant's 14 languages and the sextant-ext tool to build, check, pack and sign. Rook Ceph is a full extension to learn from. Start with Writing extensions. To share yours, publish a signed release and open a pull request to the catalog.

Install

Download the installer from the latest release:

The installers are not code-signed, so macOS and Windows warn on first start — see Installation. The AppImage, .dmg and .msi update themselves; .deb, .rpm and the portable .zip (Scoop's: scoop update sextant) are updated with your package manager, and the app tells which when a new version is out.

Package managers:

brew install --cask friendsofkubernetes/sextant/sextant                 # macOS, Homebrew
scoop bucket add sextant https://github.com/FriendsOfKubernetes/sextant-scoop
scoop install sextant/sextant                                           # Windows, Scoop

winget (winget install FriendsOfKubernetes.Sextant) is coming soon.

Documentation

The wiki describes everything:

• Installation — installers, unsigned builds, updates

• Getting started — kubeconfig, cloud clusters (EKS, GKE, AKS, Yandex Cloud), connecting, the window

• Using Sextant — tables, YAML, logs, shells (containers and nodes), port forwarding, Helm, Flux, Argo CD

• Problems and notifications — a cluster's problems on one page, desktop notifications and how to turn them off

• Right-sizing, cert-manager and certificates, Resource map, RBAC

• Safe apply, Upgrade readiness, Security posture, All clusters

• Change timeline, Autoscaling, Cleanup, Connectivity

• Best practices, Traffic diagnosis, Request metrics and traffic

• Views and workspaces, Kubeconfig management

• YAML editor, Storage, Cost, Terminal

• Service mesh, Compare, Large clusters, Accessibility

• Argo Rollouts and Argo Workflows, Ecosystem views — Knative, Crossplane, Kyverno, External Secrets, CloudNativePG, Strimzi, Prometheus Operator

• Custom columns, Table filters, Set image

• Gateway API — Gateways and routes with explained problems, topology, the request check and the hostname map

• Installing Flux and Argo CD — from the app: sources and checks, rights, preview, removing them by hand

• MCP server — AI agents: setup, permissions, confirmations, security

• Extensions and Writing extensions — the catalog, Sextant's own extensions (Rook Ceph), permissions and consent; for authors the SDK in sdk/, problem rules, metric queries and translations

• Settings and Troubleshooting

• Building from source, Development and Translating — the translations are machine-made; corrections from native speakers are welcome

Community

Questions, ideas and projects go to Discussions: Q&A for help, Ideas for suggestions, Show and tell for what you built. Found a bug? Open an issue.

Articles about Sextant (in Russian, on Habr): a Lens replacement written entirely by a model, two roadmaps in two days: what is new in 0.12–0.19 and 13 releases in a week and the first outside contributors: 0.20–0.25.5.

Support the project

Sextant is free and will stay free: every feature is for everyone, with no paid edition, account or telemetry. If it saves you time and you want to say thanks, you can buy the author a coffee. A star on GitHub, a bug report or a word about Sextant to your colleagues helps just as much.

Roadmap

What we plan for the next releases. Each release is a milestone with one issue per feature; plans can change, and ideas are welcome in Discussions.

Further out: resource templates and forms, code-signed installers (#20), a mobile app (#17).

License

Licensed under either of

• Apache License, Version 2.0 (LICENSE-APACHE)

• MIT license (LICENSE-MIT)

at your option.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.