kubernetes desktop gui for macOS, Linux and Windows
Your Kubernetes clusters, live.
Nothing installed in them.
Klustr is a free, open-source Kubernetes desktop client for macOS, Linux and Windows. It reads the kubeconfig you already have and drives the Kubernetes API the way kubectl does: live resources, RBAC review, Helm, Argo CD, Flux, Gateway API and cert-manager in one window.
$ brew tap sametkum/klustr $ brew install klustr
$ paru -S klustr-bin # or: yay -S klustr-bin
$ V=$(curl -fsSL https://api.github.com/repos/SametKUM/klustr/releases/latest \ | grep -oP '"tag_name":\s*"\K[^"]+') $ curl -LO https://github.com/SametKUM/klustr/releases/download/$V/klustr_${V#v}_amd64.deb $ sudo apt install ./klustr_${V#v}_amd64.deb
PS> $V = (Invoke-RestMethod https://api.github.com/repos/SametKUM/klustr/releases/latest).tag_name PS> Invoke-WebRequest "https://github.com/SametKUM/klustr/releases/download/$V/klustr-$V-windows-amd64.zip" -OutFile klustr.zip PS> Expand-Archive klustr.zip "$env:LOCALAPPDATA\Programs\Klustr" -Force PS> & "$env:LOCALAPPDATA\Programs\Klustr\klustr.exe"
$ mise install # Go, Node, Wails CLI $ wails dev
twelve workflows
The jobs kubectl makes you stitch together.
One Kubernetes GUI for the day-to-day work and for the platform tooling around it. Each integration below appears when its CRDs are found in a cluster and comes with its own status views and actions.
Multi-cluster: two clusters, one table.
Check two or more contexts on the Connections screen and every list fans out across them with a Context column. Save the selection as a named group, tag production with a color, and the top bar paints a stripe so you always know which environment you are touching. Per-context read-only mode blocks every mutation when you only mean to look.
Debugging: logs, exec, debug containers, node shell.
Stream logs across every pod of a workload with a color per pod, follow, regex and save. Open a shell in any container, or inject an ephemeral debug container when the image has no shell. From a node, open a root shell through a temporary nsenter pod that is removed when you close it, then cordon and drain with live progress.
Helm: dry-run first, then apply.
Helm v3 runs inside Klustr through the upstream library, with no helm binary on your PATH. Every install and upgrade renders as a dry-run diff you confirm before anything changes. Releases are read from the Secret informer that is already open, so the list stays live without extra polling.
Argo CD: sync and refresh through the API.
Applications appear as soon as the Argo CD CRDs are detected, with Sync and Health pills, revision and repo on every row. Sync sends the same PATCH that argocd app sync does, Refresh flips the annotation, and Rollback and cascade-aware Delete are one click. The Resources tab lists every managed object and deep-links into it. No argocd-server ingress, no Argo login, no CLI.
Flux CD: reconcile and suspend, nine kinds.
Kustomizations, HelmReleases, Git, Helm and OCI repositories, Buckets, Providers, Alerts and Receivers, each with conditions, source and applied revision up front. Reconcile and Suspend set the standard Flux annotations, so a failed Kustomization is fixed from the same screen that shows why it failed.
Tekton: why a pipeline failed, in one table.
PipelineRuns show the controller’s status, a task tally and a live duration. A run’s detail joins the resolved pipeline with its TaskRuns: the task that failed, the tasks its failure skipped and why, and the finally tasks that still ran. Step logs open on the failed step, and Cancel and Rerun work without tkn.
Gateway API: route status you can read.
Gateways, HTTP, GRPC, TLS, TCP and UDP routes, ListenerSets and BackendTLSPolicies through typed informers. A route renders as a per-rule match, backend and weight matrix with the RouteParentStatus beside it, so a parent that has not accepted a route or a RefNotPermitted backend is one click away. Vendor-neutral: Envoy Gateway, Cilium, Istio, Contour or NGINX Gateway Fabric.
cert-manager: the issuance chain, one tab away.
Certificates with ready state and expiry, Issuers and ClusterIssuers with their type collapsed into one column, and a drill-down from Certificate through CertificateRequest and Order to the Challenge, with the ACME error that explains a stuck issuance. Renew is one click, with no cmctl on your PATH.
Kyverno: policy findings on the resource they flag.
ClusterPolicies, Policies, CEL ValidatingPolicies and PolicyExceptions with their rules, actions and what they match. Policy reports list a resource’s results worst first, each policy lists the resources it fails, and a Deployment or Pod with a report gets a Policy tab with the failing count on its label. Read-only, through the Kubernetes API.
Istio: traffic splits without the YAML.
VirtualServices show their hosts, gateways and every HTTP rule as a match with weighted destinations. DestinationRules show TLS mode, load balancer and subsets; PeerAuthentications show the mTLS mode and selector. The served API version comes from the discovered CRD, so the views follow whatever Istio the cluster runs.
Karpenter: node pools and claims, live.
NodePools with weight, node class, consolidation policy and CPU and memory against their limits. NodeClaims with node, instance type, capacity type, zone and the Launched, Registered and Initialized steps, so a claim stuck before registration stands out. The group appears when the karpenter.sh CRDs are present.
KEDA: triggers instead of s0-prometheus.
A KEDA-managed HPA is a plain autoscaler whose metrics are all External and named s0, s1 and so on. Klustr maps each back to its ScaledObject trigger and shows the type with the metadata that predicts scaling: the cron schedule and timezone, the Prometheus query and threshold, the Kafka topic and lag.
Counted from the source.
Counts from the repository and the latest release, not benchmark claims.
everything else
Built for the whole cluster, not a demo namespace.
Every built-in kind
Workloads, networking, storage, config, admission, autoscaling and the full RBAC set, each with list, detail, YAML edit, delete and scale where it applies.
Access Review
Pick a user, group or ServiceAccount and read its effective permissions as a resource-by-verb matrix, with the binding and role behind every cell. Wildcards and cluster-admin are flagged.
Custom resources
CRDs are discovered on connect and grouped by API group. A kind installed while you are connected appears without a restart.
Istio, Karpenter and KEDA
VirtualServices and DestinationRules, NodePools and NodeClaims, and KEDA triggers mapped back onto the HPAs they drive.
YAML, scale and rollout
Monaco editor with a server-side dry-run diff, inline scale, restart, pause and resume, in-place pod resize, and rollout history with one-click rollback.
Nodes
Usage and pressure per node, cordon and uncordon, PDB-aware drain with live progress, and a root shell without SSH.
Terminal drawer
A local shell per context with KUBECONFIG already set, so kubectl, helm and k9s hit the right cluster. Or launch your own terminal app with the context selected.
Cluster overviews
Capacity donuts, workload health bars and a recent-events feed, for a single cluster or an aggregated set.
compare
Klustr vs Lens, k9s and Headlamp.
Looking for a Lens alternative? Each of these is a good tool with a different shape. The table keeps to facts you can check in their documentation, and the page behind each name says where that tool is the better pick.
| Criterion | Klustr | Lens | k9s | Headlamp |
|---|---|---|---|---|
| License and price | Apache-2.0, free | ProprietaryFree Personal plan with eligibility limits, paid plans beyond | Apache-2.0, free | Apache-2.0, free |
| Installed in the cluster | NothingOptional one-click metrics-server, removable from Klustr | Nothing requiredOptional metrics stack | Nothing | OptionalDesktop app runs locally; web mode is deployed in-cluster |
| Account or sign-in | NoneYour kubeconfig is the only credential | Lens ID requiredNeeded to activate the desktop app | None | None on desktopToken or OIDC when deployed in-cluster |
| Several clusters at once | Aggregated tableTwo or more contexts in one list, named groups, color tags | One cluster per viewCatalog and hotbar to switch | One context at a timeSwitch with :ctx | Multi-cluster viewSelect clusters and compare side by side |
| RBAC | Access Review matrixSubject to effective permissions with the binding chain | Roles and bindings | RBAC and policy viewsReverse lookup for a user, group or ServiceAccount | Roles and bindings |
| Helm | Built inInstall, upgrade, rollback, uninstall with a dry-run diff; repo search | Built inCharts and releases, upgrade and rollback | Release viewValues, history and rollback; no install or upgrade | Via pluginApp Catalog plugin, bundled with the desktop app |
| Argo CD and Flux | Built in, through the APISync, refresh, reconcile, suspend; no CLIs | Built in, paid plansNot in the free Personal plan | Community pluginsSync, refresh, reconcile, suspend; Flux needs the flux CLI | Via pluginsOfficial Flux plugin and Argo CD plugin (alpha) |
| Gateway API | Typed viewsListeners, rule matrix, RouteParentStatus | Built inIncluding TCP, UDP and TLS routes and ListenerSets | Generic CRDs | Built inIncluding TCPRoute and UDPRoute |
Facts checked against each tool’s documentation on 2026-10-16. Full pages: Klustr vs Lens, Klustr vs k9s and Klustr vs Headlamp.
Point it at a context.
One binary on your machine. Nothing in the cluster. Every context in your kubeconfig.
- macOS on Apple Silicon, notarized
- Linux amd64 as tarball, .deb and AUR
- Windows amd64 as zip, not code-signed yet