Unified Kubernetes cluster management with risk classification, blast radius analysis, GitOps detection, Application Lens, live log streaming, and multi-cluster diagnostics.

A production-grade VS Code/Kiro IDE extension for governed Kubernetes cluster management with risk classification, blast radius analysis, GitOps ownership detection, Application Lens, live log streaming, and multi-cluster diagnostics.

Features

Application Lens (NEW)

A dedicated sidebar view that groups cluster resources by application — not raw resource types. Auto-discovers:

Helm releases (standalone helm install)
FluxCD HelmReleases (reconciled Helm charts)
FluxCD Kustomizations (reconciled manifests)
ArgoCD Applications (synced from Git)

For each application you see:

Health score (0–100) with visual gauge in the dashboard
Status — healthy / degraded / progressing / suspended
Version — chart version, Git revision, or Helm revision number
Resource breakdown — workloads, pods, networking, config, storage
Container images — all images running in the app
Issues — pods not ready, excessive restarts, unavailable deployments

Commands:

Command	Description
`K8s Control: Application Lens — Select Namespace`	Scope the lens to a cluster + namespace
`K8s Control: Open Application Dashboard`	Rich WebView with health gauge, metrics, events
`K8s Control: Application Logs`	View logs from any pod in the application
`K8s Control: Application Events`	Show K8s events filtered to this app's resources
`K8s Control: Restart Application`	Rollout restart all workloads in the app (with confirmation)
`K8s Control: Refresh Application Lens`	Re-discover applications

Risk-Classified Operations

Every mutating action is automatically classified into LOW / MEDIUM / HIGH / CRITICAL risk levels with appropriate safety gates:

LOW: View, describe, logs — no confirmation needed
MEDIUM: Scale, restart, apply single resource — preview + confirm
HIGH: Service/Ingress changes, exec, multi-resource patches — impact analysis + confirm
CRITICAL: Namespace/CRD deletion, RBAC changes — blast radius + change plan + confirm

GitOps Ownership Detection

Before any mutation, automatically detects:

FluxCD (Kustomize + Helm controllers)
ArgoCD
Helm (standalone)
Operators (via ownerReferences)
Crossplane

Warns when direct changes will be reverted by reconciliation.

Blast Radius Analysis

For HIGH and CRITICAL operations, automatically assesses:

Affected pods, services, PVCs
PodDisruptionBudget violations
HPA/VPA interference
Traffic disruption estimate

Multi-Cluster Workspace

Register multiple clusters with unique aliases
Collision detection prevents duplicate registrations
Proxy support (SOCKS5/HTTP) for private clusters
Production namespace detection with auto-escalation

Drift Detection

Right-click any YAML manifest in the editor to diff against live cluster state.

Installation

cd vscode-k8s-control
npm install
npm run compile
npm run package
# Install the .vsix file in VS Code

Or for development:

npm run watch
# Press F5 in VS Code to launch Extension Development Host

Requirements

VS Code 1.85+
kubectl in PATH
helm in PATH (optional, for Helm operations)
Valid kubeconfig with cluster access

Extension Settings

Setting	Default	Description
`k8sControl.kubeconfigPaths`	`[]`	Additional kubeconfig paths
`k8sControl.defaultProxy`	`""`	Default proxy for connections
`k8sControl.productionNamespacePatterns`	`["-prod", "production"]`	Patterns triggering production escalation
`k8sControl.secretRedaction`	`true`	Redact secrets by default
`k8sControl.confirmationTimeout`	`30`	Confirmation dialog timeout (seconds)
`k8sControl.gitopsDetection`	`true`	Auto-detect GitOps ownership
`k8sControl.kubectl`	`"kubectl"`	kubectl binary path
`k8sControl.helm`	`"helm"`	helm binary path

Commands

Command	Description
`K8s Control: Register Cluster`	Add a cluster to the workspace
`K8s Control: Remove Cluster`	Remove a cluster from the workspace
`K8s Control: Refresh Clusters`	Refresh cluster tree view
`K8s Control: View YAML`	View resource as YAML
`K8s Control: View Logs`	View pod logs
`K8s Control: Scale`	Scale a deployment/statefulset
`K8s Control: Rollout Restart`	Restart a workload
`K8s Control: Delete Resource`	Delete a resource (with blast radius)
`K8s Control: Apply Manifest`	Apply the active editor's YAML
`K8s Control: Dry-Run Manifest`	Server-side dry-run validation
`K8s Control: Detect Drift`	Diff local YAML vs live state
`K8s Control: Blast Radius Analysis`	Analyze impact of an operation
`K8s Control: Diagnose`	Run event-first diagnostics
`K8s Control: Port Forward`	Create a port-forward session
`K8s Control: Exec in Pod`	Execute command in a pod
`K8s Control: Security Posture Check`	Audit RBAC and privileges
`K8s Control: Cluster Health Dashboard`	Overview of all registered clusters

Architecture

src/
├── extension.ts              # Entry point, service initialization
├── commands/
│   ├── index.ts              # All command registrations with risk gates
│   └── appLensCommands.ts    # Application Lens commands (dashboard, logs, events, restart)
├── providers/
│   ├── ClusterTreeProvider        # Sidebar: Clusters → Contexts → Namespaces
│   ├── ApplicationLensProvider    # Sidebar: Applications → Resource Groups → Resources → Containers
│   ├── ApplicationDashboardPanel  # WebView: Rich app health dashboard
│   ├── ResourceTreeProvider       # Sidebar: Resources by category
│   └── DiagnosticsTreeProvider    # Sidebar: RCA findings
├── services/
│   ├── KubectlService           # kubectl/helm execution layer
│   ├── WorkspaceState           # Cluster registry + persistence
│   ├── ApplicationDiscovery     # App detection (Helm/Flux/Argo) + resource grouping + health
│   ├── RiskClassifier           # Operation risk classification
│   ├── GitOpsDetector           # Ownership detection
│   └── BlastRadiusAnalyzer      # Impact analysis (PDB, HPA, traffic)
└── utils/
    └── ConfirmationDialog    # Risk-classified confirmation UI

Safety Principles

Never fabricate cluster state — all data comes from live kubectl calls
Preview-then-confirm — mutations always show a preview first
Single-use confirmation — approval never carries forward
Secrets redacted — encoded values hidden unless explicitly requested
Risk escalation — production clusters and GitOps-managed resources auto-escalate
Fail loud — errors include remediation guidance, never silent retry

License

MIT License

K8s Control Engine