lemazain is a Kubernetes IDE that stays fast when the cluster is big. Live tables for every kind, one screen that shows what is broken, and production locked until you say otherwise.
Everything kubectl can list, rendered the way kubectl prints it, and kept live. Scroll through a normal incident.
The sidebar is built from the cluster's own discovery, and rows come from the API server's Table projection, so a Kafka topic or a cert-manager Certificate gets the same columns kubectl get shows. A watch updates rows in place as pods come and go.
ns:payments, app=web, tier!=db, node:pool-b, is:problem, -job. Terms combine, the counts on the health chips follow along, and a single keystroke narrows twelve thousand pods to the three that matter.
Crash loops, image pull failures, OOM kills, pods stuck pending or terminating, rollouts past their deadline, unready or pressured nodes, failed jobs and unbound claims, grouped by cause with a sentence on what usually fixes each one. Every row opens the object.
Containers with live usage, conditions, rollout state, decoded Secrets, the pods behind a Service. The owner is a link: pod to ReplicaSet to Deployment, and a node opens the pods scheduled on it.
Stream one container or every container of the pod in time order, filter by text or level, and see matches highlighted. Follow pauses the moment you scroll up and resumes with one click. Previous shows the run that crashed.
Kinds, loaded objects, namespaces, contexts, problems and actions on the selection, ranked as you type. > for actions, # for namespaces, @ for contexts, ! for problems.
Contexts that look like production open locked, tinted red, and ask before they unlock. Deleting on production, or more than three objects anywhere, makes you type what you are about to do.
Built in, native, and wired to the same context and namespace scope as the table you are looking at.
Exec over the v5 channel protocol, implemented natively. Distroless images say so plainly instead of failing with an OCI error, and a quick bar runs the usual first commands.
View, edit and apply like kubectl edit, with no smart quotes, a warning when the object changed under you, and a refusal to retarget kind, version or namespace.
Releases decoded straight from their secrets, values and rendered manifest side by side. No helm binary required.
From any pod or service, onto a free local port it picks for you, with a status list, restart and open-in-browser.
Select many rows and restart, cordon, copy or delete them together. Scale, rollout restart, run a CronJob now, suspend its schedule.
Every row copies its get -o yaml, describe, logs -f, exec -it and rollout commands with the right context and namespace, for when a real TTY is what you need.
The table is an AppKit table view that only draws the rows on screen. Watches arrive in the Table format and patch rows in place, so a rollout of four hundred pods costs a few row updates, not four hundred relists.
A GUI makes destructive things one click away. lemazain puts them back behind a decision.
$ lemazain probe context eu-staging auth exec gke-gcloud-auth-plugin lock looksLikeProduction=false → opens unlocked ✓ /version → v1.35.8 ✓ discovery → 136 listable kinds, 71 custom ✓ Table(pods) → 200 rows; Name, Ready, Status… ✓ watch(pods, as=Table) → DELETED runner-r46c4 with 9 cells, rows update in place ✓ paged list(pods) → 998 rows in 1.16s ✓ access review → can delete pods: true ✓ metrics → 78 nodes, 86019m CPU, 271Gi ✓ logs · exec · YAML round trip core OK — read-only, nothing was changed
No Xcode project: Swift's command line tools build the app bundle directly.
xcode-select --install
make install
make probe
macOS 14 or later on Apple silicon or Intel. A kubeconfig at ~/.kube/config or in $KUBECONFIG.
Port forwarding runs kubectl port-forward, so it needs kubectl on your PATH. Everything else talks to the API server directly.
LEMAZAIN_ALLOW_WRITES=1 starts production contexts unlocked, for the day you really mean it.
Yes. lemazain reads your kubeconfig and runs the same exec credential plugins kubectl does, so gke-gcloud-auth-plugin, aws eks get-token and kubelogin all work. Bearer tokens, token files, client certificates, basic auth and impersonation are supported too.
It is a native Mac app, so it opens instantly and idles at a fraction of an Electron app's memory. Unlike k9s it is a window you can point at, with an inspector, a Problems view and multi-select. Like both, it reads the kubeconfig you already have.
Production-looking contexts open read-only and ask before they unlock. Every delete confirms, and on production or for more than three objects you type the confirmation. Actions your credentials cannot perform are greyed out before you click them.
Not yet: it runs commands one per line with no PTY, which covers most debugging. For vim or top, the toolbar copies the exact kubectl exec -it command to paste into your terminal.
No. It talks to the API servers in your kubeconfig and nothing else. There is no account, no telemetry and no update check.
Lemazain is Basque for helmsman, which is what the Greek κυβερνήτης, the root of Kubernetes, means.
Open the cluster, see what is broken, fix it, and lock the door behind you.