Workloads & Live Operations
Browse, edit and debug any managed cluster from the browser, including clusters behind NAT. Everything runs over the agent’s outbound connection, and the console only offers what you are allowed to do.
Explore & Edit
Cluster Explorer
Every kind, grouped the way the Kubernetes API reference groups them. Each object opens to YAML, describe and events.
API Explorer
Everything the cluster’s discovery returns, unedited: vendor CRDs, aggregated APIs and versions about to disappear. Search by name, group or scope.
Manifest Editor
Completion, hover docs and schema checks from the cluster’s own OpenAPI, CRDs included. Dry-run, then server-side apply.
Storage Overview
StorageClasses, PersistentVolumes, claims and VolumeSnapshots in one read-only view, with a panel for claims stuck in Pending.
Live Resource Watch
Lists update as objects are added, modified or deleted, streamed from a watch on the cluster instead of polling.
The editor never fetches a schema from the internet, so it works the same on air-gapped clusters.
Live Access
| Capability | Who | What you get |
|---|---|---|
| Log tail | Cluster owner | Follow a container, or read the previous instance after a crash. Up to 100,000 lines per request. |
| Pod shell | Cluster owner | Interactive terminal in the browser |
| Port-forward | Cluster owner | Raw TCP to a pod port, tunnelled over the agent’s outbound connection |
| Process list | Cluster owner | Processes inside a container: PID, state, user, memory and command line, sorted by memory |
| Node shell | Admin only | Like kubectl debug node: a short-lived privileged pod with a locked image, cleaned up when the session closes |
Events Beyond the One-Hour Window
- Kubernetes drops Events after about an hour; ServerMind keeps them
- The agent collects Events every 30 seconds and buffers them on disk before shipping
- Archive kept for 30 days by default, adjustable by a platform admin
- Live and Archive tabs share one filter bar: namespace, reason, type, involved object and time range
- Events arrive only from the agent. There is no API to inject them.
Guardrails
- With Kubernetes impersonation on, row actions the cluster’s RBAC would refuse are hidden, checked per namespace
- Logs, shells and port-forwards in platform namespaces such as kube-system require an admin
- Shells into pods that use hostPID, hostPath or privileged containers require an admin
- Secrets and RBAC objects are admin-only in the explorers and in live watches
- Applying Secrets, RBAC or privileged pod specs is refused for non-admins before the cluster is contacted
- Open streams are re-checked every 60 seconds; a revoked session or a lost editor role closes them
- Up to 50 concurrent streams per user, shared by logs, shells, port-forwards and watches