Cluster assessment
Ranked findings instead of a pod list: crash loops, OOM kills, pods that will never schedule, sizing problems — each with what to do about it.
Free and open source · Apache-2.0 · macOS, Linux, Windows
Your cluster, assessed.
Every other Kubernetes client hands you a pod list and leaves you to work out what is wrong. PodSteer reads the cluster and tells you — ranked, grouped, and with what to do about it. Then it lets you fix it, safely, across every cluster you have open.
Latest release v0.6.0 — macOS, Linux and Windows. What's new →
What it looks like
Ten stops through a cluster we broke on purpose.
Every picture is PodSteer itself, on a demo cluster with a crash loop, an out-of-memory kill and a pod nothing will ever schedule. Start where you would start — with what is wrong — and follow it down.
A healthy cluster, at a glance. When nothing is wrong, the overview says so first, then shows how much of the cluster is spoken for. More on this →
Findings, named by the workload. Each finding names the workload it belongs to and says what the state means, before a single pod has been opened. More on this →
Observed traffic over the map. Rates, errors and latency from the Prometheus the mesh already feeds, drawn over the relationships rather than instead of them. More on this →
The detail panel, in the manifest's order. Environment values are shown as the container sees them, and a password stays masked. More on this →
Logs with a minimap. A filter marks every match on the minimap, so you can see where the declined payments fall before scrolling to them. More on this →
A shell in a pod. A shell into the container from the pod's own panel, with the pod list still beside it. More on this →
An Argo CD Application, as a typed panel. Sync, health, source and the resources Argo CD manages, quoted from the Application's own status. More on this →
One revision, read on request. Listing releases reads no Secret's contents; one revision's chart, values and manifest are read when you open a tab that shows them. More on this →
The privileges workloads take. Read from the pod specs, and reported as notes, because every real cluster runs a few privileged agents. More on this →
A role, inspected. What a role reaches, flagged with what each rule permits, from a dialog on the Permissions page. More on this →
Failing pods, in every open cluster. One table across every open tab, so a problem in the second cluster is not hidden behind the first. More on this →
A Trivy report, read as a panel. Severities, the image and the fixed versions, and how many other workloads run the same image. More on this →
What it does
Everything is in the free application.
GitOps views, a security page, an MCP server for coding agents — the things other clients put behind a subscription are in the one Apache-2.0 application here.
Topology and traffic
One namespace, several or all of them as one map — every line a relationship Kubernetes has — with observed traffic from Istio, Linkerd, Beyla, Caretta or Hubble.
Day-2 operations
Apply any kind including CRDs, roll back, drain, bulk-act with a review step — and see the kubectl command for each.
New in v0.3.0
GitOps: Argo CD and Flux
Typed panels for Argo CD Applications and Flux Kustomizations and HelmReleases, and a warning before any change a controller will undo.
New in v0.3.0
Helm releases
Every Helm release and revision, listed from labels alone; one revision's values and manifest read only when you ask.
New in v0.3.0
Security and RBAC
Privileges a spec takes, vulnerabilities your scanner already found, and what an account can actually do — answered by the API server.
New in v0.3.0
MCP server and coding agents
podsteer mcp: nineteen read-only tools for Claude Code and other agents, over stdio — no port, no writes, Secret values masked.
New in v0.3.0
Shells and terminals
Exec, debug containers, node shells, an in-cluster shell and your own local terminal — with the pods PodSteer creates cleaned up after.
New in v0.3.0
Multi-cluster
Real tabs, one cluster each; one table across every open cluster; clusters found through your own cloud CLI.
Operator panels
Built-in views for cert-manager, KEDA, External Secrets, Argo Rollouts, Trivy, Karpenter, Gateway API and more — no plugin API, nothing to install.
New in v0.3.0
The number nobody prints
Requests decide what schedules. Not usage.
A cluster can refuse new pods while every usage graph looks calm, because scheduling is decided by what pods reserved, not by what they use. PodSteer draws both on one track and names the gap between them — so "47 of 102 cores requested, 9% of that actually used" is a sentence you can act on rather than two dials you have to reconcile.
How it is built
Native, not Electron
Go and the operating system's own webview, on Wails. There is no bundled browser engine in the process tree — which is where most of an Electron client's memory footprint and startup time go.
Your kubeconfig, and GitHub if you let it
PodSteer talks to the clusters your kubeconfig names, through the same client library kubectl uses. No account and no telemetry; one daily update check to GitHub that sends no identifier and switches off; and no network access at all from the interface itself.
Open source, Apache-2.0
Every dependency it ships is permissively licensed, the inventory is generated from what is actually linked into the binary, and the build fails if that stops being true.
Questions
The things people ask first.
Is PodSteer really free?
Yes, and it needs no account. The application is Apache-2.0 licensed, which is a grant you keep rather than a trial that lapses. If paid services for teams follow later they will stand alongside it, not be carved out of it.
Can PodSteer change my clusters?
Yes — it can apply manifests of any kind, scale, restart, roll back, drain, evict and delete, open shells and copy files, and it can create a node-shell or in-cluster-shell pod, which it deletes when the terminal closes. It does all of it with the credentials your kubeconfig already grants, and enforces no permissions of its own: restricting what it may do means restricting those credentials, with RBAC, exactly as you would for kubectl.
What does it send over the network?
Kubernetes API traffic to the clusters your kubeconfig names, and once a day a request to GitHub asking whether a newer release exists — it sends no identifier, and you can switch it off. There is no account and no telemetry, and the interface itself has no network access at all, which is enforced by a content security policy inside the application rather than just promised here. The security page lists every other destination and when it is used.
How is this different from k9s, Lens or kubectl?
Those show you the cluster; PodSteer assesses it. Instead of a list to read, you get ranked findings with what to do about each, and capacity measured against requests rather than usage — the number that actually decides whether a pod schedules. And the things Lens puts in paid tiers — GitOps views, a security centre, an MCP server — are in the free application here.
Does it work with Argo CD, Flux and Helm?
Yes. It shows what Argo CD Applications and Flux Kustomizations manage, warns before any change a GitOps controller will revert, and lists Helm releases and their revisions without reading Secret payloads. It shows Helm's upgrade, rollback and uninstall commands rather than running them.
Can my coding agent use it?
Yes. The same binary is a read-only Model Context Protocol server: run podsteer mcp from Claude Code or another MCP client and the agent can list, describe, read logs and run the assessment. It serves over stdio, opens no port, and offers no tool that writes.
Which operating systems does it run on?
macOS 13 Ventura or later, as one universal build for Apple Silicon and Intel; Windows on x86-64; and Linux on x86-64 with GTK 3 and WebKitGTK 4.1 installed. On macOS it also installs through Homebrew.
Does it work with my managed Kubernetes?
It talks to the API server through the same client library kubectl uses, so anything your kubeconfig can reach works: EKS, GKE, AKS, OpenShift, k3s, kind and self-managed clusters alike. Custom resources your operators install are browsable without an update to PodSteer.
Will my operating system warn me about it?
Not on macOS: the build is signed with an Apple Developer ID, notarised, and the notarisation ticket is stapled into the bundle, so Gatekeeper accepts it without a prompt. On Windows it will — that build is not signed yet, and SmartScreen reports every unsigned binary as though it were a verdict about the file. It is the absence of a certificate, not a finding. Verify either download against the published SHA-256 checksums rather than taking our word.
The application is free, and stays that way.
PodSteer is Apache-2.0 licensed and needs no account. It reads the kubeconfig you already have and sends no telemetry — here is everything it does connect to. If paid services for teams follow later, they will be additions standing alongside it — not pieces taken out of it.