K8s Control Engine

Unified Kubernetes cluster management with risk classification, blast radius analysis, GitOps detection, Application Lens, live log streaming, and multi-cluster diagnostics.

A production-grade VS Code/Kiro IDE extension for governed Kubernetes cluster management with risk classification, blast radius analysis, GitOps ownership detection, Application Lens, live log streaming, and multi-cluster diagnostics.

Features

Application Lens (NEW)

A dedicated sidebar view that groups cluster resources by application — not raw resource types. Auto-discovers:

• Helm releases (standalone helm install)
• FluxCD HelmReleases (reconciled Helm charts)
• FluxCD Kustomizations (reconciled manifests)
• ArgoCD Applications (synced from Git)

For each application you see:

• Health score (0–100) with visual gauge in the dashboard
• Status — healthy / degraded / progressing / suspended
• Version — chart version, Git revision, or Helm revision number
• Resource breakdown — workloads, pods, networking, config, storage
• Container images — all images running in the app
• Issues — pods not ready, excessive restarts, unavailable deployments

Commands: | Command | Description | |---------|-------------| | K8s Control: Application Lens — Select Namespace | Scope the lens to a cluster + namespace | | K8s Control: Open Application Dashboard | Rich WebView with health gauge, metrics, events | | K8s Control: Application Logs | View logs from any pod in the application | | K8s Control: Application Events | Show K8s events filtered to this app's resources | | K8s Control: Restart Application | Rollout restart all workloads in the app (with confirmation) | | K8s Control: Refresh Application Lens | Re-discover applications |

Risk-Classified Operations

Every mutating action is automatically classified into LOW / MEDIUM / HIGH / CRITICAL risk levels with appropriate safety gates:

• LOW: View, describe, logs — no confirmation needed
• MEDIUM: Scale, restart, apply single resource — preview + confirm
• HIGH: Service/Ingress changes, exec, multi-resource patches — impact analysis + confirm
• CRITICAL: Namespace/CRD deletion, RBAC changes — blast radius + change plan + confirm

GitOps Ownership Detection

Before any mutation, automatically detects:

• FluxCD (Kustomize + Helm controllers)
• ArgoCD
• Helm (standalone)
• Operators (via ownerReferences)
• Crossplane

Warns when direct changes will be reverted by reconciliation.

Blast Radius Analysis

For HIGH and CRITICAL operations, automatically assesses:

• Affected pods, services, PVCs
• PodDisruptionBudget violations
• HPA/VPA interference
• Traffic disruption estimate

Multi-Cluster Workspace

• Register multiple clusters with unique aliases
• Collision detection prevents duplicate registrations
• Proxy support (SOCKS5/HTTP) for private clusters
• Production namespace detection with auto-escalation

Drift Detection

Right-click any YAML manifest in the editor to diff against live cluster state.

Installation

cd vscode-k8s-control
npm install
npm run compile
npm run package
# Install the .vsix file in VS Code

Or for development:

npm run watch
# Press F5 in VS Code to launch Extension Development Host

Requirements

• VS Code 1.85+
• kubectl in PATH
• helm in PATH (optional, for Helm operations)
• Valid kubeconfig with cluster access

Extension Settings

Commands

Architecture

src/
├── extension.ts              # Entry point, service initialization
├── commands/
│   ├── index.ts              # All command registrations with risk gates
│   └── appLensCommands.ts    # Application Lens commands (dashboard, logs, events, restart)
├── providers/
│   ├── ClusterTreeProvider        # Sidebar: Clusters → Contexts → Namespaces
│   ├── ApplicationLensProvider    # Sidebar: Applications → Resource Groups → Resources → Containers
│   ├── ApplicationDashboardPanel  # WebView: Rich app health dashboard
│   ├── ResourceTreeProvider       # Sidebar: Resources by category
│   └── DiagnosticsTreeProvider    # Sidebar: RCA findings
├── services/
│   ├── KubectlService           # kubectl/helm execution layer
│   ├── WorkspaceState           # Cluster registry + persistence
│   ├── ApplicationDiscovery     # App detection (Helm/Flux/Argo) + resource grouping + health
│   ├── RiskClassifier           # Operation risk classification
│   ├── GitOpsDetector           # Ownership detection
│   └── BlastRadiusAnalyzer      # Impact analysis (PDB, HPA, traffic)
└── utils/
    └── ConfirmationDialog    # Risk-classified confirmation UI

Safety Principles

1. Never fabricate cluster state — all data comes from live kubectl calls
2. Preview-then-confirm — mutations always show a preview first
3. Single-use confirmation — approval never carries forward
4. Secrets redacted — encoded values hidden unless explicitly requested
5. Risk escalation — production clusters and GitOps-managed resources auto-escalate
6. Fail loud — errors include remediation guidance, never silent retry

License

MIT License