Kubernetes

Clusters appear on their own Kubernetes tab, separate from servers.

Connect

Pick a cluster and hit Connect. The app generates a local kubeconfig — it contains no real credentials, only a pointer at a local proxy. The connection card shows the generated kubeconfig path; its copy button copies that path (namespaced by account id, with a short target id), so you can point any kubeconfig-based tool at it:

export KUBECONFIG=~/.tessera/kubeconfigs/<account>/<cluster>-<id>.yaml
kubectl get pods -A

The card also has Copy config (copies the full kubeconfig contents), Open in terminal (opens a shell with KUBECONFIG already exported), and a Remap (↻) button to move the local port if it’s taken.

Every kubectl request is brokered: the controller injects the cluster’s token or client certificate. exec, logs -f and port-forward all work normally in read-write sessions. In a read-only session exec, attach and port-forward are blocked, while logs -f still works.

Use it with any tool

The kubeconfig path and local port are stable per account and cluster, so you can point any kubeconfig-based tool or IDE at the generated file once and it keeps working across reconnects. Just set KUBECONFIG to the generated path; all traffic flows through Tessera.

Cleanup

Generated kubeconfigs contain no secrets — only a pointer at a local port that stops responding once you disconnect. They’re kept on purpose: the path and port are stable, so any tool you pointed at the file keeps working across reconnects without regenerating anything. Tessera removes a cluster’s kubeconfig only when you remove the account from the app — disconnecting or quitting leaves the (now-inert) file in place.

Read-only clusters

A read-only grant filters mutating API verbs at the proxy — see Read-only sessions.